AWS Security Agent Adds STRIDE Threat Modeling, Kiro Power, and Claude Code Plugin

Security review used to happen after code was written. AWS Security Agent’s latest updates are built around the opposite assumption: that threat modeling should happen at design time, and that security findings should surface in the IDE where developers can act on them without context switching.

What Happened

AWS Security Agent received a cluster of updates that extend its reach across the development workflow. Three changes stand out:

STRIDE threat modeling (preview): The agent now analyzes design documents or application source code to generate structured threat models using the STRIDE framework — mapping application components, trust boundaries, and data flows to surface attack paths while they’re still in the design or early development phase. Output includes STRIDE-categorized threats, recommended mitigations, and open assumptions saved to .security-agent/threat_model.md.

Kiro power integration: Developers using Kiro as their IDE can now trigger security operations via natural language prompt — “Run a full security scan on this repo” or “Build a threat model for this application” — without leaving the development environment. Results surface inline through the open MCP integration.

Claude Code plugin (AWS Agents for DevSecOps): A Claude Code plugin brings the same capabilities to Claude Code users — threat modeling, full-repo and PR code scanning, and remediation of validated findings directly from the CLI, with results surfaced inline.

Why It Matters

Threat modeling is the practice with the best-documented security ROI and the worst adoption rate in most development organizations. The primary barrier is friction: threat modeling requires security-knowledgeable practitioners, time outside the development workflow, and a structured process that most teams don’t have the bandwidth to run against every feature.

STRIDE automation addresses the bandwidth constraint. A tool that reads a design document or a codebase and returns a structured threat model — categorized by Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege — doesn’t replace a security architect, but it does surface the most common threat classes automatically against the specific application context. For teams that currently do no threat modeling, that’s a meaningful improvement.

The IDE integration addresses the friction constraint. Security findings that appear as inline IDE annotations are acted on orders of magnitude more often than findings that arrive in a separate security dashboard days after the code was written. The Kiro power and Claude Code plugin make the security output consumable in the context where the developer already is.

For platform teams that have already implemented Vault’s AI agent identity layer, the threat modeling output is useful input: understanding which components handle sensitive credentials and where trust boundaries cross is precisely the information Vault policy design requires.

What This Means for Platform Engineers

The open MCP integration means AWS Security Agent’s capabilities can be extended to any MCP-compatible AI-powered IDE, not just Kiro and Claude Code. For platform engineering teams standardizing on a specific development environment, this matters: the security layer doesn’t require IDE lock-in to deploy.

The threat model file output (.security-agent/threat_model.md) is version-control-friendly by design. Treating threat models as code artifacts — committed to the repository, updated when architecture changes, reviewed in pull requests — addresses the most common failure of traditional threat modeling: the threat model that gets created once and never maintained.

Source: AWS Blog

Content created with AI assistance and reviewed for accuracy.