Manual code reviews

Performing manual code reviews is a critical practice in ensuring the quality and security of the software you produce. Manual code reviews provide an opportunity to identify potential issues, such as security vulnerabilities, logic flaws, or coding standard violations, that automated tools might miss. By involving multiple reviewers in the process, code reviews help maintain consistency, share knowledge across the team, and verify that best practices are followed.

1. Establish code review guidelines: Develop clear guidelines for code reviews, specifying the types of issues to look for, such as security vulnerabilities, logic errors, coding standard violations, and performance concerns. The guidelines should also define the scope of reviews, the review process, and expected outcomes. Standardized guidelines help reviewers understand their responsibilities and provide a consistent basis for evaluating code.
2. Enforce peer reviews: Ensure that every piece of code is reviewed by at least one other team member who did not write the code. Peer reviews help verify that code meets quality standards and follows best practices, and they provide a fresh perspective that can catch issues that the original author may have overlooked. Peer reviews also encourage knowledge sharing, as team members learn from each other’s code.
3. Focus on security and quality: During manual code reviews, emphasize both security and code quality. Reviewers should check for common security issues such as improper input validation, hardcoded secrets, unsafe use of third-party libraries, and incorrect permissions. Code quality considerations include code readability, maintainability, adherence to coding standards, and efficiency.
4. Use collaborative code review tools: Use code review tools such as GitHub, GitLab, AWS CodeCommit, or Bitbucket to facilitate collaborative reviews, provide comments, track changes, and approve code. These tools enable asynchronous reviews, allowing developers to review code when they have time, and they provide a record of all comments, changes, and approvals. Using code review tools helps ensure that the process is organized, transparent, and well-documented.
5. Review small changes frequently: Encourage frequent code reviews for small, incremental changes rather than waiting for a large pull request. Smaller code changes are easier to review thoroughly, reducing the likelihood of missing critical issues. Reviewing small changes frequently also enables faster feedback cycles, which helps improve the overall development pace and code quality.
6. Encourage constructive feedback and collaboration: Create a positive code review culture that focuses on constructive feedback and continuous improvement. Reviewers should provide actionable suggestions that help improve the quality and security of the code while being respectful and supportive. A collaborative code review culture encourages developers to learn from each other, share best practices, and maintain a shared commitment to high-quality code.
7. Combine manual reviews with automated checks: Use automated testing tools and static analysis tools alongside manual code reviews to ensure a comprehensive review process. Automated tools can quickly identify many types of security vulnerabilities and coding errors, while manual reviews can focus on higher-level issues, such as architecture, design, and business logic. Combining both approaches helps ensure that the code is rigorously evaluated from multiple perspectives.
8. Perform targeted security reviews for critical code: Conduct in-depth, manual security reviews for critical portions of the codebase, such as authentication mechanisms, encryption modules, or code handling sensitive data. These reviews should be conducted by experienced security experts to identify subtle vulnerabilities that may be missed during standard peer reviews or by automated tools.

Supporting Questions:

• How do you ensure that code quality and security are reviewed by someone other than the original author?
• What guidelines and processes are in place to facilitate effective code reviews?
• How do you balance manual code reviews with automated checks to ensure comprehensive code quality?

Roles and Responsibilities:

Application Developer:

• Responsibilities:
  • Submit code for review, ensuring that all new code is reviewed by at least one peer before merging.
  • Address feedback received during code reviews and collaborate with reviewers to improve code quality and security.

Reviewer (Developer or Security Expert):

• Responsibilities:
  • Review code to identify potential security vulnerabilities, logic errors, and deviations from coding standards.
  • Provide constructive feedback to the original author to improve the quality, readability, and security of the code.

Security Analyst:

• Responsibilities:
  • Participate in code reviews for critical portions of the codebase, such as authentication, encryption, or other sensitive areas.
  • Ensure that security best practices are followed during code reviews and provide specialized guidance for security-critical code.

Artefacts:

• Code Review Guidelines: A document outlining the guidelines, scope, and expectations for manual code reviews, including specific areas to focus on for quality and security.
• Code Review Comments and Feedback Records: Records of comments, suggestions, and approvals from code reviews, providing a documented history of changes and improvements.
• Security Review Checklist for Critical Code: A checklist used during in-depth security reviews of critical code, outlining specific areas to assess and verify for security vulnerabilities.

Relevant AWS Services:

Code Review Tools:

• AWS CodeCommit: Provides a secure Git-based repository to manage code changes, facilitate pull requests, and conduct peer code reviews.
• AWS CodeGuru Reviewer: Uses machine learning to review code automatically and provide recommendations for improvements, supplementing manual code reviews.

Security and Compliance Tools:

• Amazon Inspector: Assesses applications and their environments for vulnerabilities, helping verify that software meets security requirements before it is released.
• AWS Security Hub: Aggregates security findings, helping identify vulnerabilities that may have been introduced into the codebase, and provides a centralized view of the security posture.

CI/CD Integration Tools:

• AWS CodePipeline: Integrates automated testing tools and manual approval steps to ensure that reviewed and tested code is deployed in a controlled and secure manner.
• AWS IAM (Identity and Access Management): Manages access controls for code repositories, ensuring that only authorized personnel can submit, review, or approve code changes.