Secure an App with AWS Security Agent

Use AWS Security Agent to run automated code review and penetration testing.

Introduction

30 Second Summary

Every application has vulnerabilities. The question is whether your team finds them first, or an attacker does.

In this project, you will set up AWS Security Agent to perform automated security testing against a deliberately vulnerable web application. You will trigger code reviews on pull requests and run an autonomous penetration test that validates real exploits.

What You'll Build

You will configure AWS Security Agent to perform both code-level and runtime security analysis on OWASP Juice Shop, an intentionally vulnerable web application deployed on your own infrastructure.

By the end of this project, you'll have:

  • An AWS Security Agent Agent Space with automated code review catching vulnerabilities in pull requests.
  • OWASP Juice Shop deployed on EC2 and accessible via your Route 53 subdomain.
  • A completed penetration test with findings showing validated exploits, CVSS scores, attack paths, and remediation guidance.
  • Secret Mission: Run a design security review and connect architectural risks to real vulnerabilities.

Are there any prerequisites?

You need an AWS account, a GitHub account, and a domain already registered in Route 53. If you do not have a Route 53 domain yet, set one up before starting this project.

Before We Start

Before We Start...

Set Up AWS Security Agent

Security testing is often a manual, time-consuming process that happens too late in the development cycle. AWS Security Agent changes this by providing an AI-powered agent that automates both code review and penetration testing for your applications.

In this step, you will create an Agent Space for the OWASP Juice Shop application. An Agent Space is a dedicated workspace that holds all security configurations, findings, and test results for a single application.

In this step, get ready to:
  • Create an Agent Space named "Juice-Shop" with IAM-only access.
  • Enable managed security requirements for web applications.
  • Verify the Agent Space status is active.
Navigate to AWS Security Agent and run initial setup

AWS Security Agent is only available in specific regions. You need to make sure your console is set to a supported region before starting.

  • Sign in to the AWS Management Console.
  • In the top-right corner of the console, click the region dropdown and select US East (N. Virginia) (us-east-1).
  • In the search bar at the top, type Security Agent and select AWS Security Agent from the results.
  • Click Set up Security Agent.

What regions are supported?

AWS Security Agent is available in US East (N. Virginia), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Asia Pacific (Sydney), and Asia Pacific (Tokyo). You can choose any of these, but this project uses US East (N. Virginia) as the default.

  • In the Agent Space name field, enter Juice-Shop.
  • In the Description field, enter Security testing for OWASP Juice Shop.
  • In the Access method section, select IAM-only access.
  • Expand the Permissions configuration - optional section.
  • Select Create default role.
  • Click Set up at the bottom of the page.

What is IAM-only access?

IAM-only access lets you launch the Security Agent Web Application directly from the AWS Console using an admin access link. It is simpler to configure for a single-user learning project because it does not require setting up IAM Identity Center (SSO).

AWS Security Agent will create your Agent Space, set up the web application, and configure the IAM role automatically. This takes a few seconds.

Don't see the Set up Security Agent button?

Make sure you are in a supported region. Check the region dropdown in the top-right corner and switch to us-east-1 if needed. If you have already set up Security Agent previously, you will see the Agent Spaces page instead.

Help me troubleshoot the AWS Security Agent setup page.

Enable security requirements for your Agent Space

Security requirements are policies that AWS Security Agent checks against during code reviews and design reviews. AWS provides managed requirements based on industry best practices that you can enable with a few clicks.

  • In the left navigation pane, click Security requirements.
  • Select the Managed security requirements tab.
  • Review the list of AWS-provided requirements.
  • Select the checkboxes next to at least 3-5 requirements relevant to web applications (look for requirements covering input validation, authentication, and logging).
  • Click Enable.

What are managed security requirements?

Managed security requirements are AWS-provided, industry-standard security policies. They cover common security concerns such as proper authentication handling, input validation, and secure logging practices.

When enabled, AWS Security Agent automatically validates these requirements during code reviews. This means every pull request will be checked against these standards without you needing to define custom rules from scratch.

Not seeing any managed requirements?

Make sure you are on the Managed security requirements tab, not the Custom security requirements tab. Managed requirements are pre-populated by AWS and should appear immediately.

Help me find the managed security requirements in AWS Security Agent.

Verify the Agent Space is ready
  • In the left navigation pane, click Agent Spaces.
  • Confirm that your Juice-Shop Agent Space appears in the list and shows an active status.
  • Click on Juice-Shop to open it.
  • Select the Web app tab and note the Admin access link.

You will use this Admin access link in a later step to launch the Security Agent Web Application and run penetration tests.

Your Agent Space is configured and ready. Next up, you will connect a GitHub repository so Security Agent can perform automated code reviews on your pull requests.

Connect GitHub and Enable Code Review

Your Agent Space is active and ready for security testing. The next step is giving AWS Security Agent access to your application's source code so it can automatically review pull requests for vulnerabilities.

AWS Security Agent integrates with GitHub to perform automated code reviews on pull requests. Since code review only works with private repositories, you'll create a private copy of OWASP Juice Shop and connect it to your Agent Space.

In this step, get ready to:
  • Create a private GitHub repository with Juice Shop source code.
  • Connect the repository to AWS Security Agent via a GitHub integration.
  • Enable automated code review with security requirements and vulnerability detection.
Create a private GitHub repository with Juice Shop code

AWS Security Agent code review only works with private repositories. Since OWASP Juice Shop is a public repository on GitHub, you cannot simply fork it. Forks of public repos remain public.

Instead, you'll create a fresh private repo and push the Juice Shop code into it.

  • Open GitHub in your browser and sign in to your account.
  • Click the + button in the upper-right corner.
  • Select New repository from the dropdown menu.
  • Enter juice-shop-security-test in the Repository name field.
  • Under Visibility, select Private.
  • Do NOT check Initialize this repository with a README. The repository must be empty so you can push existing code into it.
  • Click Create repository.

Why a private repository?

AWS Security Agent code review is only available for private repositories. This is a security measure. Code review findings could reveal sensitive vulnerability details, so they are restricted to repos the owner controls.

Now you'll clone the Juice Shop source code locally and push it to your new private repo.

  • Open your terminal. Press Cmd+Space (macOS) or the Windows key (Windows) to open your search bar, type Terminal (macOS) or PowerShell (Windows), and press Enter.
  • Move to your Desktop by running this command:
cd ~/Desktop
  • Clone the OWASP Juice Shop source code by running this command:
git clone https://github.com/juice-shop/juice-shop.git --depth 1

What does this command do?

git clone downloads a copy of the Juice Shop repository to your computer. The --depth 1 flag creates a shallow clone, downloading only the latest snapshot instead of the full commit history. This saves time and disk space since the full history is large and unnecessary for security testing.

  • Confirm the clone succeeded by running:
ls juice-shop

You should see a list of files and folders including package.json, routes, and server.ts.

Clone failing?

If you see command not found: git, Git is not installed on your machine. Install it from git-scm.com/downloads and try again.

If the clone times out, check your internet connection and retry the command. help me fix a git clone error

  • Push the Juice Shop code to your private repository by running these commands:
cd juice-shop
git remote set-url origin https://github.com/[[GITHUB_USERNAME="your GitHub username"]]/juice-shop-security-test.git
git push -u origin master

What do these commands do?

cd juice-shop moves into the cloned folder.

git remote set-url origin changes where Git pushes code to. Instead of pointing at the original public Juice Shop repo, it now points at your private repo.

git push -u origin master uploads all the code to your private GitHub repository on the master branch.

  • Refresh your juice-shop-security-test repository page on GitHub.

You should see the Juice Shop source code populated in the repository, with folders like routes, models, and files like package.json.

Push failing?

If you see a permission error, make sure you are authenticated with GitHub. GitHub may prompt you to sign in via a browser window or ask for a personal access token.

If you see "repository not found," double-check that your repository name is exactly juice-shop-security-test and that your GitHub username is correct in the URL.

help me fix a git push authentication error

Connect the GitHub repository to AWS Security Agent

With your private repository ready, you'll now create a GitHub integration in the AWS Security Agent console. This authorizes Security Agent to read your repository and post review comments on pull requests.

  • In the AWS Security Agent console, click Integrations in the left sidebar.
  • Click Add integration.
  • Select GitHub.
  • Click Install and authorize. This redirects you to GitHub.
  • On the GitHub authorization page, select your GitHub account.
  • Under repository access, select Only select repositories.
  • Choose juice-shop-security-test from the repository list.
  • Click Install & Authorize. You will be redirected back to the AWS console.
  • Back in the AWS console, enter My-GitHub as the registration name.
  • Select User as the account type.
  • Click Connect.

What just happened?

You installed the AWS Security Agent GitHub App on your account. This app has permission to read code and post comments on pull requests for the repositories you selected.

The registration name (My-GitHub) is how this connection appears in the AWS console. You can connect multiple GitHub accounts if needed, each with its own registration name.

  • Verify the integration by checking the Integrations page. You should see My-GitHub listed with a connected status.

Don't see the integration listed?

If the connection did not appear, try refreshing the page. The GitHub authorization redirect sometimes takes a moment to register.

If you were redirected to GitHub but never saw the repository selection screen, make sure you are signed in to the correct GitHub account that owns juice-shop-security-test.

help me connect my GitHub account to AWS Security Agent

Enable code review for the repository

The GitHub integration is connected, but code review is not active yet. You need to explicitly enable it for your repository and choose what Security Agent checks for.

  • Navigate to your Juice-Shop Agent Space in the left sidebar.
  • Choose Enable code review from the capabilities menu.
  • Select your connected GitHub organization or user account.
  • Check the box next to juice-shop-security-test.
  • Click Add repositories.
  • Toggle the Enable switch in the Code review column for the repository.
  • Under Code review settings, select Security requirements and vulnerability findings.
  • Click Enable to activate code review.

What do the code review modes do?

AWS Security Agent offers three code review modes:

  • Security requirement validation checks code against the managed security requirements you enabled in Step 1.
  • Security vulnerability findings scans for common vulnerabilities like SQL injection, XSS, and insecure deserialization.
  • Security requirements and vulnerability findings does both. This is the most thorough option.
  • Confirm that the Code review column shows an enabled status next to juice-shop-security-test.

Repository not showing up?

If juice-shop-security-test does not appear in the repository list, the GitHub integration may not have been granted access to it.

Go back to Integrations, verify your My-GitHub connection is active, and check that the GitHub App was authorized for the correct repository. You can update repository access in your GitHub account under Settings > Applications > Installed GitHub Apps.

help me fix repository access for AWS Security Agent code review

Your repository is now connected and monitored. Next up, you'll create a pull request with deliberately vulnerable code to trigger Security Agent's automated review and see its findings in action.

Trigger a Code Review and Review Findings

Your repository is connected and code review is live. Now it is time to see AWS Security Agent in action by giving it something to find.

Security tools are only useful if they catch real problems. In this step, you will create a branch with deliberately vulnerable code, open a pull request, and watch Security Agent flag the issues automatically as PR comments.

In this step, get ready to:
  • Create a new branch containing a file with a SQL injection vulnerability.
  • Open a pull request on GitHub to trigger the automated code review.
  • Review Security Agent's findings posted directly on the pull request.
Create a branch with a deliberately vulnerable change

To trigger a code review, you need a pull request. To make the review interesting, the PR will contain code with an obvious SQL injection vulnerability. This simulates a developer accidentally introducing insecure code.

  • Open your terminal and navigate to the juice-shop folder you cloned in the previous step.
  • Create a new branch by running this command:
git checkout -b feature/user-search
  • You should see a message confirming the new branch was created.

Seeing a git error?

Make sure you are inside the juice-shop directory where you cloned the repository. Run ls and confirm you see folders like routes/ and server.ts.

help me fix this git error when creating a branch

  • Create a new file called routes/unsafe-search.js inside the routes/ directory. Open it in your code editor and paste the following code:
const express = require('express');
const router = express.Router();
const sqlite3 = require('sqlite3');

const db = new sqlite3.Database('juice-shop.db');

// Search for users by name
router.get('/api/unsafe-search', (req, res) => {
  const username = req.query.username;

  // VULNERABILITY: User input concatenated directly into query string
  const query = "SELECT * FROM Users WHERE username = '" + username + "'";

  db.all(query, [], (err, rows) => {
    if (err) {
      res.status(500).json({ error: err.message });
      return;
    }
    res.json({ users: rows });
  });
});

module.exports = router;

What does this code do?

This Express route takes a username query parameter and plugs it directly into a SQL query string using string concatenation.

An attacker could pass a crafted value like ' OR '1'='1 to bypass the intended query and extract all users from the database. This is a classic SQL injection pattern from the OWASP Top 10.

  • Save routes/unsafe-search.js.
  • Stage, commit, and push the change by running these commands:
git add . && git commit -m "Add user search feature"
git push origin feature/user-search
  • You should see output showing the branch was pushed to your remote repository.

Push rejected or authentication failed?

If git push fails with an authentication error, confirm you set the remote URL to your private repository in the previous step. Run git remote -v and check that the URL points to juice-shop-security-test, not the original OWASP repository.

help me fix a git push authentication error to my private GitHub repository

Open a pull request on GitHub

With the branch pushed, you can now open a pull request. This is what triggers AWS Security Agent's automated code review.

  • Go to your juice-shop-security-test repository on GitHub.
  • You should see a banner at the top saying your branch had recent pushes, with a button to create a pull request. Click Compare & pull request.
  • Enter Add user search feature as the pull request title.
  • Click Create pull request.

What happens next?

AWS Security Agent automatically detects new pull requests on repositories where code review is enabled. It begins analyzing the changed files within seconds of the PR being created.

The review checks for both common vulnerability patterns (like SQL injection) and any security requirements you enabled in your Agent Space.

  • Confirm the pull request was created successfully. You should see the PR page with the title "Add user search feature" and the diff showing your routes/unsafe-search.js file.
Review the security findings

AWS Security Agent posts its findings as comments directly on the pull request. The review typically takes a few minutes to complete.

  • Wait 2-5 minutes for Security Agent to complete its analysis.
  • Refresh the pull request page on GitHub.
  • Look for review comments posted by AWS Security Agent. These appear as inline annotations on the specific lines of code that contain vulnerabilities.

What should I see?

Security Agent posts comments highlighting specific lines with issues. For your vulnerable file, you should see findings flagging SQL injection risk on the line where username is concatenated into the query string.

Each finding includes a description of the vulnerability, why it is dangerous, and guidance on how to fix it (such as using parameterized queries instead of string concatenation). You may also see findings related to violations of your enabled security requirements.

  • Read through the findings. Note the specific vulnerability types flagged (SQL injection, missing input validation) and the remediation guidance provided.

Not seeing any review comments?

Code review can take up to 5 minutes. If you still see no comments after waiting, confirm that code review is enabled for your repository in the AWS Security Agent console under your Juice-Shop Agent Space.

Also verify the repository is private. AWS Security Agent code review only works with private repositories.

help me troubleshoot why Security Agent is not posting code review comments on my pull request

You have just seen AWS Security Agent catch a vulnerability at the code level before it ever reaches production. Next up, you will deploy Juice Shop to a live EC2 instance so Security Agent can test the running application with a penetration test.

Deploy OWASP Juice Shop on EC2

Your code review is live and catching vulnerabilities in pull requests. Now it's time to give Security Agent something to attack at runtime.

In this step, you'll deploy OWASP Juice Shop to an EC2 instance and point a Route 53 subdomain at it. This creates a publicly accessible target for the penetration test you'll configure next.

In this step, get ready to:
  • Launch an EC2 instance running Juice Shop with Docker.
  • Create a Route 53 A record pointing your subdomain to the instance.
  • Verify Juice Shop is accessible in your browser.
Plan your Juice Shop subdomain

Before launching the instance, decide on a subdomain you'll use for Juice Shop. You need this subdomain later when configuring your penetration test scope.

  • Choose a subdomain on your existing Route 53 domain. For example, juiceshop.yourdomain.com.
  • You'll create the actual DNS record after the instance launches and you have its public IP address.

Why a subdomain?

AWS Security Agent requires a verified domain to run penetration tests against. Using a subdomain on your existing Route 53 domain lets you take advantage of one-click DNS verification in the next step.

Launch an EC2 instance with Juice Shop

You'll launch an EC2 instance that automatically installs Docker and runs Juice Shop using a User Data script. This means the application starts itself without any manual SSH configuration.

  • Open the EC2 console by searching for EC2 in the AWS Console search bar.
  • Click Launch instance on the EC2 Dashboard.
  • In the Name field, enter JuiceShop-SecurityTest.
  • Under Application and OS Images (AMI), select Amazon Linux 2023 (it should be selected by default).
  • Under Instance type, select t2.micro (free tier eligible).
  • Under Key pair (login), select Proceed without a key pair from the dropdown. You won't need to SSH into this instance.
  • Under Network settings, click Edit.
  • Under Firewall (security groups), select Create security group.
  • Check the box for Allow HTTP traffic from the internet. This opens port 80 from 0.0.0.0/0.
  • Expand Advanced details at the bottom of the page.
  • Scroll down to the User data field and paste the following script:
#!/bin/bash
yum update -y
yum install -y docker
service docker start
docker pull bkimminich/juice-shop
docker run -d -p 80:3000 bkimminich/juice-shop

What does this script do?

  • yum update -y updates the system packages on the Amazon Linux instance.
  • yum install -y docker installs Docker so you can run containers.
  • service docker start starts the Docker daemon.
  • docker pull bkimminich/juice-shop downloads the official Juice Shop container image.
  • docker run -d -p 80:3000 bkimminich/juice-shop starts Juice Shop on port 3000 inside the container and maps it to port 80 on the instance, making it accessible via HTTP.
  • Click Launch instance.
  • Wait for the instance to reach the Running state. Click View all instances to see your instances list.
  • Click on your JuiceShop-SecurityTest instance and copy its Public IPv4 address from the instance details panel. Save this for the next substep.

Instance not reaching Running state?

  • If the instance shows Pending for more than a couple of minutes, refresh the page. EC2 instances typically start within 30-60 seconds.
  • If you don't see a Public IPv4 address, confirm that Auto-assign public IP was enabled in your Network settings (it should be enabled by default for the default subnet).

Help me troubleshoot my EC2 instance that won't start or doesn't have a public IP address.

Point your subdomain to the EC2 instance

Now that your instance has a public IP, you'll create a DNS record so your subdomain resolves to the Juice Shop instance.

  • Open the Route 53 console by searching for Route 53 in the AWS Console search bar.
  • In the left navigation pane, click Hosted zones.
  • Click on your domain name to open the hosted zone details.
  • Click Create record.
  • In the Record name field, enter just the subdomain prefix (e.g., juiceshop). Your domain is automatically appended.
  • For Record type, select A.
  • In the Value field, paste the public IPv4 address you copied from your EC2 instance.
  • Leave TTL at the default (300 seconds).
  • Click Create records.

What is an A record?

An A record maps a domain name to an IPv4 address. When someone visits your subdomain, DNS resolves it to the EC2 instance's IP address, which serves the Juice Shop application on port 80.

  • Wait 1-2 minutes for DNS to propagate.
  • Open a new browser tab and navigate to your subdomain (e.g., http://juiceshop.yourdomain.com).
  • You should see the OWASP Juice Shop storefront with a product catalog and shopping cart.

Don't see the Juice Shop storefront?

  • If you get a connection timeout, give the User Data script more time to finish. Docker needs to download the Juice Shop image (about 400 MB), which can take 3-5 minutes after the instance starts.
  • If you get a DNS resolution error, confirm your A record was created in the correct hosted zone and that the subdomain prefix matches what you typed in the browser.
  • If you get a connection refused error, check that your security group allows inbound HTTP on port 80 from 0.0.0.0/0. You can verify this in the EC2 console under your instance's Security tab.

Help me troubleshoot why I can't access Juice Shop through my subdomain.

Your Juice Shop instance is live and reachable on the public internet. Next up, you'll configure AWS Security Agent to run a penetration test against it.

Configure Penetration Testing

Your Juice Shop instance is live and accessible through your Route 53 subdomain. The next step is to let AWS Security Agent test it for real vulnerabilities at runtime.

Code review catches problems in source code, but penetration testing validates whether those problems are actually exploitable in a running application. To run a pen test, Security Agent needs permission to send traffic to your domain. That means verifying you own the domain first.

In this step, get ready to:
  • Enable penetration testing for your Agent Space.
  • Verify domain ownership using one-click DNS verification.
  • Save the penetration testing configuration.
Enable penetration testing for your Agent Space

Security Agent's penetration testing capability is configured per Agent Space. You need to tell it which domain to test and how to verify you own it.

  • In the AWS Security Agent console, click Agent Spaces in the left sidebar.
  • Click your Juice-Shop Agent Space to open it.
  • Click Enable penetration test in the Agent Space header.
  • A multi-step wizard opens. In Step 1 (Configure domain), enter your subdomain in the Domain field:
[[SUBDOMAIN="juiceshop.yourdomain.com"]]
  • In the Verification method dropdown, select DNS_TXT.
  • Click Next to proceed to domain verification.

Why DNS_TXT verification?

AWS Security Agent supports three verification methods: DNS_TXT, HTTP_ROUTE, and PRIVATE_VPC. Since your domain is managed in Route 53 within the same AWS account, DNS_TXT unlocks one-click verification. Security Agent handles the TXT record creation automatically.

Verify domain ownership using one-click verification

Because your domain lives in Route 53 in the same AWS account, you can skip manual DNS record creation entirely.

  • In Step 2 (Verify domains), you will see your subdomain listed in the Target Domains table.
  • Select your domain from the table.
  • Click One-click verification.
  • Wait a few seconds. AWS Security Agent automatically creates a DNS TXT record in your Route 53 hosted zone and verifies ownership.
  • Confirm the Status column changes to Verified.
  • Click Next to proceed to optional configuration.

What just happened in Route 53?

Security Agent created a TXT record in your hosted zone containing a verification token. This proves to AWS that you control the domain and authorize penetration testing against it. The record stays in your hosted zone and does not affect your website.

Domain status stuck on Pending?

Make sure your subdomain's hosted zone is in the same AWS account you are using for Security Agent. If the domain is in a different account, one-click verification will not work. You would need to copy the verification token manually and add the TXT record in the other account.

Also confirm you selected DNS_TXT as the verification method in Step 1. If you chose HTTP_ROUTE, one-click verification is not available.

help me verify my domain for penetration testing

Complete the penetration testing configuration

The final wizard step covers optional AWS integrations. For this project, you only need the default IAM role for service access.

  • In Step 3 (Optional capabilities), expand the Service access section.
  • Confirm Create default role is selected. This gives Security Agent the permissions it needs to run tests.
  • Optionally expand CloudWatch logs and select or create a log group if you want to review detailed test run logs later.
  • Click Save at the bottom of the page to enable penetration testing.

What does the default IAM role do?

The default role grants Security Agent permission to access your VPC resources, write to CloudWatch log groups, and interact with other AWS services required during testing. You do not need to configure these permissions manually.

You should see a confirmation that penetration testing is now enabled for your Juice-Shop Agent Space.

Seeing a permissions error on Save?

Your AWS user needs administrative permissions (or at minimum, permission to create IAM roles) to complete this step. If you see an access denied error, check that your IAM user or role has the required policies attached.

help me fix permissions for Security Agent setup

Penetration testing is now configured and ready to go. In the next step, you will launch the Security Agent Web App and kick off an autonomous penetration test against your live Juice Shop instance.

Run a Penetration Test and Review Findings

You have code review running on your pull requests and a verified domain pointing at a live Juice Shop instance. Now it is time to see what an autonomous attacker can actually exploit at runtime.

In this step, you will launch a penetration test from the Security Agent Web App. The agent will autonomously probe your Juice Shop instance for hours, validating real exploits and documenting the exact attack chains it used.

In this step, get ready to:
  • Launch the Security Agent Web App and create a penetration test.
  • Configure the test scope, credentials, and execute the test.
  • Review penetration test findings including attack paths and remediation guidance.
Launch the Security Agent Web App and create a penetration test

Penetration tests are created and managed inside the Security Agent Web Application, not the main AWS Console. You access the Web App through your Agent Space.

  • In the AWS Console, navigate to your Juice-Shop Agent Space.
  • Click the Web app tab.
  • Click Admin access to open the Security Agent Web Application with administrator privileges.

The Web Application opens in a new browser tab. This is where you manage penetration tests.

  • In the left sidebar, click Penetration Test.
  • Click Create your first penetration test.
  • Enter Juice Shop Initial Pentest as the title.

What is a penetration test?

A penetration test simulates a real attacker probing your application for weaknesses. AWS Security Agent runs this autonomously, meaning it explores your application, identifies potential vulnerabilities, and attempts to exploit them without any human guidance.

Each validated vulnerability includes the exact multi-step attack chain the agent used to exploit it. This is what separates a penetration test from a vulnerability scan.

Configure the test scope and execute

The test scope tells Security Agent which URLs to target. You can also provide authentication credentials so the agent can test areas behind login screens.

  • Under Penetration test scope, add your subdomain as the target URL: http://juiceshop.yourdomain.com.
  • Under Permissions, select the default service IAM role.

Optionally, you can provide Juice Shop's default admin credentials so the agent can test authenticated areas of the application.

  • Expand the authentication credentials section.
  • Enter admin@juice-sh.op as the username.
  • Enter admin123 as the password.
  • For the Access URL, enter your Juice Shop URL (the same target URL you added above).

Why provide credentials?

Without credentials, the agent can only test the public-facing areas of Juice Shop. With admin credentials, it can explore admin panels, user account features, and other protected functionality. This gives you a much more thorough assessment.

  • Optionally, enable Automatic code remediation if you want Security Agent to automatically create pull requests with code fixes for the vulnerabilities it finds.
  • Click Create and execute to start the penetration test.

Your penetration test is now running. The agent begins autonomously probing your Juice Shop instance.

How long does the test take?

Penetration tests run autonomously and take time to complete. A small web application like Juice Shop typically takes around 8 task-hours. You do not need to keep your browser open.

The test is covered by the 2-month free trial, which includes up to 400 pentesting task-hours per trial month. You will not be charged for this test.

Test not starting?

Make sure your target URL uses http:// (not https://) since your Juice Shop instance does not have TLS configured. Also verify that your domain is still showing as Verified in the penetration testing configuration.

help me troubleshoot why my penetration test won't start in AWS Security Agent

Review penetration test findings

Once your penetration test completes (or has been running long enough to produce initial findings), you can review what the agent discovered. Each finding documents a validated vulnerability with a reproducible attack path.

  • Return to the Security Agent Web App (or reopen it from the Web app tab in your Agent Space).
  • Click Penetration Test in the left sidebar.
  • Click on your Juice Shop Initial Pentest to open its details.

The findings page shows all validated vulnerabilities the agent discovered. Each finding contains several key pieces of information.

  • Review the CVSS risk scores assigned to each finding. These scores rate the severity of each vulnerability on a standard scale.
  • Review the application-specific severity ratings that reflect how critical each issue is in the context of your specific application.
  • Expand individual findings to see the reproducible attack paths. These show the exact multi-step chain the agent used to exploit each vulnerability.
  • Review the remediation suggestions provided for each finding. These are ready-to-implement fixes.

What makes these findings different from a vulnerability scanner?

Traditional vulnerability scanners flag potential issues based on patterns. Security Agent goes further by actually exploiting each vulnerability and documenting the proof. The attack path shows you step by step how a real attacker would chain actions together to reach the vulnerability.

This eliminates false positives. Every finding in your results is a validated, reproducible exploit.

Findings appear as the test runs

You do not need to wait for the full test to complete. Findings appear incrementally as the agent validates each vulnerability. Check back periodically to see new results.

You have now completed the full security testing lifecycle with AWS Security Agent. You ran an automated code review on a pull request and an autonomous penetration test against a live application. The combination gives you both code-level and runtime-level security insights.

Secret mission

Run a Design Security Review

Penetration tests find vulnerabilities in running code. But what about flaws baked into the architecture itself? In this secret mission, you will create an architecture document for your Juice Shop deployment, upload it to Security Agent for a design review, and connect the design-level risks to the real exploits your penetration test uncovered.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Your EC2 instance is free tier eligible (750 hours/month of t2.micro for 12 months). AWS Security Agent penetration testing is covered by a 2-month free trial with up to 400 task-hours per month. Code review is always free.

Cost warning

If your AWS free tier period has expired or you have used your 750 monthly hours, the EC2 instance will incur charges while running.

After the 2-month free trial ends, penetration testing costs $50.00 per task-hour. Stop or terminate resources if you are done with this project.

Resources you used:

  • EC2 instance (JuiceShop-SecurityTest).
  • Route 53 DNS records (A record and TXT verification record for your Juice Shop subdomain).
  • GitHub repository (juice-shop-security-test).

Keep everything running

No action needed. Choose this if you plan to run additional penetration tests or continue experimenting with Security Agent findings.

  • Your Juice Shop instance remains accessible at your subdomain.
  • You can trigger more code reviews by opening additional pull requests.
  • EC2 compute charges apply if your free tier has expired.

Pause - I'll come back to this later

Stop your EC2 instance to eliminate compute charges while keeping your files and configuration intact.

  • In the EC2 console, select your JuiceShop-SecurityTest instance.
  • Click Instance state, then Stop instance.
  • Your EBS volume is still charged while stopped (approximately $0.08/GB/month).
  • Your Juice Shop subdomain will stop resolving to a running application until you start the instance again.
  • When you restart, the public IP may change. Update your Route 53 A record with the new IP.

Delete - I don't want to use this again

Remove all project resources to avoid any ongoing charges.

Terminate the EC2 instance
  • Open the EC2 console and click Instances in the left sidebar.
  • Select the JuiceShop-SecurityTest instance.
  • Click Instance state, then Terminate instance.
  • Confirm the termination when prompted.
Delete the Route 53 DNS records
  • Open the Route 53 console and click Hosted zones in the left sidebar.
  • Click your domain name to open the hosted zone.
  • Select the A record for your Juice Shop subdomain (e.g. juiceshop.yourdomain.com).
  • Click Delete record and confirm.
  • Repeat for the TXT verification record that Security Agent created during domain verification.
Delete the GitHub repository
  • Go to your juice-shop-security-test repository on GitHub.
  • Click Settings in the repository navigation bar.
  • Scroll down to the Danger Zone section.
  • Click Delete this repository and follow the confirmation prompts.
Remove the Security Agent Agent Space (optional)
  • In the AWS Security Agent console, navigate to Agent Spaces in the left sidebar.
  • Select your Juice-Shop Agent Space and delete it.
  • This removes the Agent Space configuration, connected integrations, and any stored findings.

That's a Wrap!

That's a Wrap!

Nice work! You have set up AWS Security Agent and used it to perform end-to-end security testing on a real vulnerable application.

You've learned how to:

  • Set up an Agent Space and connected a GitHub repository for automated code review that catches vulnerabilities directly in pull requests.
  • Deployed OWASP Juice Shop on EC2 and made it accessible via your own Route 53 subdomain.
  • Configured and ran an autonomous penetration test that validated real exploits with reproducible attack paths, CVSS scores, and actionable remediation guidance.
  • Secret Mission: Performed a design security review and connected architectural risks to runtime vulnerabilities.

Ready to quiz yourself?