diff-scanning-with-aws-security-agent

AWS Security Agent — Diff Scan

Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.

Local state

Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.

Track scans in .security-agent/scans.json.

Resolving the values you need

Placeholder	How to resolve
<id> (agent space)	config.agent_space_id
<region>	config.region (default us-east-1)
<account>	aws sts get-caller-identity --query Account --output text
<role-arn>	arn:aws:iam::<account>:role/SecurityAgentScanRole
<bucket>	security-agent-scans-<account>-<region>
<WORKSPACE_ID>	printf '%s' "$(pwd)" | md5sum | cut -c1-12

---

Workflow

1. Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.

2. Ask what to scan against:

   • Uncommitted changes → BASE_REF=HEAD (default)
   • Branch vs main → BASE_REF=main
   • Custom ref → user provides

3. Generate diff (fail fast if empty):

   cd <absolute-workspace-path>
   if [ "$BASE_REF" = "HEAD" ]; then
     git diff HEAD > /tmp/diff.patch
   else
     git diff "$BASE_REF..HEAD" > /tmp/diff.patch
   fi
   [ -s /tmp/diff.patch ] || { echo "No changes vs $BASE_REF"; exit 1; }
   

4. Zip the workspace (same exclusions as full scan, 2 GB limit):

   cd <absolute-workspace-path>
   zip -r /tmp/source.zip . \
     -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
     -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
     -x "dist/*" -x "build/*" -x "target/*" \
     -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
     -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"
   

5. Upload both source zip and diff patch:

   SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
   aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
   aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch