Penetration testing every deployment with AWS Continuum

AWS Continuum for penetration testing integrates AI agents to confirm exploitable vulnerabilities in running applications, moving security testing into the CI/CD pipeline as a gate. This process scopes penetration tests only to the specific changes deployed in a commit range, making them fast and economical enough for every deployment. The flow involves deploying to staging, running a scoped test against that change via an OIDC-based call to Continuum, waiting for results, and conditionally blocking promotion to production based on a severity threshold.
The practical implementation requires configuring a penetration test, establishing an IAM role for pipeline assumption via OpenID Connect (OIDC), and integrating a gate step into platforms like GitHub Actions or GitLab CI/CD. Scoping is managed by defining the commit range tested, which determines whether findings are evaluated against defined thresholds. Teams can manage rollout by starting in report-only mode to observe findings before tightening thresholds, while acknowledging that passing runs advance the baseline, requiring specific actions to reset reassessment ranges.

* Security tooling like SAST, SCA, and DAST flags potential issues from patterns and signatures.
* AWS Continuum for penetration testing uses AI agents to find and confirm exploitable vulnerabilities in running applications.
* The gate runs a penetration test scoped to the change just deployed.
* The gate can block promotion to production if findings meet a chosen severity threshold.
* Scoping tests only the commit range—the head and base commits of the change.
* The flow involves deployment to staging, an OIDC call to Continuum for testing, result waiting, and conditional blocking.
* Authentication uses OIDC federation with AWS STS, avoiding long-lived access keys in the pipeline.
* Settings governing failure depend on severity threshold, scope conflict, and infrastructure error handling, which are independent.
* Report-only mode starts with a threshold of NONE to observe findings before setting thresholds like HIGH.
* Pipeline variables on GitLab can override job settings, requiring restrictions on who can modify them.

The core tension in this process lies between the need for frequent, automated security feedback and the rigor required for actual penetration testing confirmation. The mechanism of scoping to commit ranges is an attempt to resolve this by making the test computationally feasible within a CI/CD context. However, this efficiency introduces specific risks related to baseline management. If a successful test advances the baseline, as noted in the text, subsequent threshold changes might ignore previously found vulnerabilities unless explicit commit range overrides are used. This suggests a potential for state manipulation where observed results implicitly define future testing scopes. Furthermore, the emphasis on OIDC and least-privilege IAM roles highlights an architectural shift toward ephemeral, workload-based security context rather than static credential management. The instruction to set `fail-on-infrastructure-error` to true aligns with a principle of security gate enforcement over pure automation comfort, suggesting that operational failure in the testing mechanism should halt progression more readily than allowing uncertain states. The pattern shifts the focus from finding bugs *periodically* to confirming bugs *per change*, demanding robust mechanisms for state history tracking during automated remediation cycles.
Bridge Questions: What are the risks associated with relying on an automatically advanced baseline without manual review of previously cleared ranges? How can organizations architect IAM policies that effectively enforce context-aware scoping without creating complex, brittle trust relationships across numerous CI/CD platforms? If a pipeline dynamically overrides security settings via variables, what controls are necessary to ensure that runtime configuration does not subvert the intended security posture established by the repository configuration?