Amazon CodeGuru

What CodeGuru is

Amazon CodeGuru is really two tools that share a brand. CodeGuru Reviewer uses program analysis plus machine learning to comment on your Java or Python code — on pull requests, or as a one-off scan of a whole repository — flagging resource leaks, concurrency bugs, and AWS/Java/Python best-practice violations that are easy to miss in a human review. CodeGuru Profiler watches your application while it runs: a lightweight agent samples where the code actually spends CPU and wall-clock time, ships those samples to a profiling group, and points at the most expensive methods, often with cost-framed recommendations.

In 2026, CodeGuru has been substantially wound down. Reviewer stopped accepting new repository associations on 2025-11-07, and CodeGuru Security reached end of support on 2025-11-20 — its scanning folded into Amazon Q Developer and Amazon Inspector Code Security. Profiler is the half that’s still supported. Design Beaver models CodeGuru as an external, regional service, so it validates each half’s connections and the IAM they need as you draw — and steers a new design away from the legacy halves.

When to use CodeGuru (and when not to)

Reach for CodeGuru Profiler when you run a long-lived JVM or Python service — on Lambda, ECS, EC2, EKS, or Fargate — and want always-on, low-overhead production profiling to chase CPU and latency hot spots. That’s Profiler’s core use, and it’s still supported. Keeping an existing Reviewer repository association from before 2025-11-07 is fine too; the automated PR feedback you already configured keeps working.

Don’t reach for CodeGuru to set up new automated code review — Reviewer won’t take new repos, so use Amazon Q Developer’s code review or Amazon Inspector instead. Don’t use it for security scanning of source; that was CodeGuru Security, now end-of-support. Both halves are limited to Java/JVM and Python, so a Go, Node, .NET, or Rust service gets nothing. And CodeGuru never builds or deploys — that’s CodeBuild, CodeDeploy, and CodePipeline. CodeGuru only reviews and profiles.

Variants: two separate products, not tiers

CodeGuru isn’t tiers you choose between — it’s two distinct offerings under one brand, and one of them is legacy while the other is the forward-looking half.

CodeGuru pricing in plain English

The two halves bill on different meters, and both should be treated as rough intuition rather than a billing source — verify against the live pricing page before quoting numbers.

How CodeGuru connects to other services

CodeGuru’s two halves connect to completely different parts of your architecture — Reviewer reaches into source repositories, while Profiler receives telemetry from running compute. The direction and the IAM on each edge are where the real work hides, so Design Beaver models them rather than letting you draw a plausible-looking arrow that wouldn’t function.

• →CodeCommit

  CodeGuru Reviewer is associated with a CodeCommit repository and automatically reviews pull requests (and on-demand full-repository scans), posting recommendations as comments

• ←CodeBuild

  A CodeBuild action runs a CodeGuru Reviewer analysis as part of a build — CodeBuild provides the full clone (including Git metadata) that Reviewer needs for pipeline-context analysis

• ←CodePipeline

  A CodePipeline pipeline includes a CodeGuru Reviewer analysis stage (typically run via a CodeBuild action) and gates promotion of the code to preproduction/production on the outcome

• ←Lambda

  A Lambda function is onboarded to CodeGuru Profiler — the bundled profiling agent samples the function's runtime and submits profiles so you can see the most CPU-expensive code paths

• ←EC2

  A JVM or Python application running on an EC2 instance runs the CodeGuru Profiler agent, which samples the process and submits profiles to a profiling group for CPU/latency analysis

• ←ECS

  A containerized JVM/Python app running as an ECS task (EC2 or Fargate launch type) runs the CodeGuru Profiler agent and submits profiles to a profiling group

One detail worth calling out: for Profiler, the permission lives on the compute, not on CodeGuru. The agent runs inside your process, so it’s the Lambda execution role, EC2 instance profile, or ECS task role that must carry the codeguru-profiler:* actions. Design Beaver models that IAM requirement on the compute node’s edge toward CodeGuru — which is exactly where forgetting it leaves you with “profiling enabled, no data showing up.”

What CodeGuru can’t connect to

Chaining the whole Code* suite into one line is a common instinct, but some of those edges don’t exist. Design Beaver flags them instead of letting you draw a diagram that can’t be built.

• ✕CodeDeploy

  CodeGuru does not deploy anything — it reviews source (Reviewer) and profiles running code (Profiler). Deployment is CodeDeploy's job. Wiring the whole Code* suite together as one chain is a common mistake, but there is no CodeGuru-to-CodeDeploy edge: CodeGuru produces recommendations and profiles, not deployable artifacts or deployment triggers.

• ✕DynamoDB

  CodeGuru is never in an application's data path. It doesn't read or write application databases — Reviewer analyzes source text and Profiler ingests runtime profile samples. A CodeGuru-to-DynamoDB connection has no meaning; the database access belongs to your application code, which CodeGuru only reviews or profiles.

Anti-patterns Design Beaver catches

These are the CodeGuru mistakes that pass a diagram review but don’t hold up — the ones the validation engine flags as you draw.

Gotchas that bite in production

• This is a wound-down service. The biggest surprise is that you can’t start Reviewer on a new repo (cutoff 2025-11-07), and CodeGuru Security is gone entirely (end-of-support 2025-11-20, no data migration). If a design leans on either for new work, redirect it to Amazon Q Developer or Amazon Inspector.
• Java and Python only — both halves. It’s easy to draw CodeGuru against a Node or Go service and assume it’ll help. It won’t, and the node is just decoration.
• Profiler is not APM. It samples code-method CPU and wall-clock time to find expensive lines. It is not distributed tracing, service maps, or error tracking — pair it with X-Ray and CloudWatch for those.
• The profiling permission lives on the compute, not on CodeGuru. The agent runs in your process, so it’s your function, instance, or task role that needs the codeguru-profiler:* actions. That’s the usual reason profiling is “on” but no profiles appear.
• Reviewer’s pipeline integration needs a CodeBuild full clone. Running the analysis in a CodeBuild action requires a full clone with Git metadata for pipeline-context analysis — a plain zip artifact isn’t enough.

Further reading

• Official AWS documentation
• AWS X-Ray — distributed tracing