Amazon Q Developer & AI code review

What Amazon Q Developer's code review does, how access is granted through AWS, and what an automated reviewer can and cannot tell you.

Amazon Q Developer is AWS's AI assistant for software development. Its code review runs in the developer's editor: you ask it to check recent changes, a single file, or a whole project, and it reports security and code-quality problems before a human reviewer looks. AWS also offers a preview of Amazon Q Developer inside GitHub.com and GitHub Enterprise Cloud, which can carry out code reviews there.

Quick summary

Access is granted through your AWS account. There are two tiers: a free tier with monthly limits, and Amazon Q Developer Pro, charged per user and usually assigned through IAM Identity Center. Connecting it to GitHub means granting permissions over your repositories — so it reads your source code. Treat it as an extra reviewer that never gets tired, not as a replacement for human review or for security testing. One planning note: AWS has said it will discontinue support for the Amazon Q Developer IDE plugins on 30 April 2027, and points people to Kiro for similar capabilities.

How access works

It's an AWS service. Subscriptions and users are managed from the AWS console under your account — see AWS accounts & IAM.

The paid tier is per person. Amazon Q Developer Pro is charged per user, per month, and each developer gets their own subscription. Assigning it through IAM Identity Center is what gives admins the dashboards and controls.

Repository access is a separate grant. Connecting to GitHub grants permissions over your repositories, including reading the code. Scope it to specific repositories rather than the whole organisation.

Review the permissions before approving. Whoever approves the connection is granting a third party read access to source code — that's an organisation-level decision, not an individual developer's.

What automated review is good at

Consistency. It reviews every change with the same attention, including the ones people skim at 6pm on a Friday.
Well-known bug patterns. AWS lists resource leaks, SQL injection and cross-site scripting among the things its detectors look for, alongside hardcoded secrets, infrastructure misconfiguration and out-of-date third-party libraries.
Speed. Feedback arrives in minutes, when the author still has the change in their head.
Reducing reviewer load. Mechanical issues get caught before a human spends attention on them.

What it isn't

Automated review is not a security audit

An AI reviewer sees a diff, not your threat model. It cannot tell you that a particular endpoint should require authorisation, that a business rule is wrong, or that a change breaks an assumption made elsewhere in the system. It produces false positives, and — more dangerously — it produces silence on things it simply didn't consider. A clean automated review is not evidence that a change is safe.

Two failure modes worth naming:

Alert fatigue. A noisy reviewer trains the team to click "resolve" without reading. Tune it, or it becomes worse than nothing.
False confidence. "The bot approved it" is not a review. Human judgement on design, security boundaries, and business logic still has to happen.

Data and confidentiality

Your source code is sent to a third-party service for analysis. Before enabling it:

Check your contractual obligations. Some client agreements restrict sending code to third-party services.

Read the current data-handling terms, including whether content may be retained or used for model training, and what the paid Pro subscription changes. AWS states that with Amazon Q Developer Pro your proprietary content is not used for service improvement.

Consider which repositories to include. Repositories holding especially sensitive logic can be excluded.

Make sure secrets aren't in the code anyway — see environment variables & secrets.

Common questions

Does this replace code review?

No. It changes what human review is spent on — less time on formatting and obvious mistakes, more on architecture, security boundaries, and whether the change actually solves the problem. The human review still has to happen.

What does it cost?

There are two tiers. The free tier has monthly usage limits; Amazon Q Developer Pro is charged per user, per month and adds higher limits, IAM Identity Center support with admin controls, and IP indemnity. Prices and limits change, so check current AWS pricing rather than relying on a figure quoted anywhere.

Can it change our code?

It can suggest fixes, and in its agentic mode it can read and write files and generate code diffs for you. Anything it produces should go through the same review and testing as any other change. Never let automated fixes merge without review.

Are there alternatives?

Several, including GitHub's own review tooling and other vendors. They differ mainly in data handling and how well they integrate with your existing workflow. If your code is already on GitHub, the fewest moving parts is usually the deciding factor.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.