Using Amazon Q Developer in Your IDE: Real-Time Code Generation, Security Scanning, and Code Transformation

Modern software engineering teams face three persistent bottlenecks: boilerplate code authoring, late-stage security vulnerabilities discovered right before deployment, and aging codebases stuck on legacy runtimes. Amazon Q Developer, an AI-powered software development assistant built on Amazon Bedrock, directly integrates into mainstream Integrated Development Environments (IDEs) to address these hurdles across the entire development lifecycle.

Through official extensions for Visual Studio Code, JetBrains IDEs (including IntelliJ IDEA and PyCharm), and Visual Studio 2022, Amazon Q Developer provides three core engineering capabilities:

1. Real-time inline code generation and contextual conversational coding that dynamically predicts syntax and writes functions from natural language prompts.
2. Automated static security scanning powered by the Amazon CodeGuru Detector Library that surfaces vulnerabilities, hardcoded secrets, and Common Weakness Enumerations (CWEs) directly in the IDE's Problems pane with one-click remediation patches.
3. Automated legacy code transformation, where an autonomous transformation agent upgrades Java versions (such as Java 8 or 11 to Java 17 or 21) and modernizes .NET applications, executing local builds and unit tests to validate backwards compatibility.

This practical guide details how to install and configure Amazon Q Developer, operate each core feature effectively in daily engineering workflows, and manage enterprise security and licensing trade-offs.

1. Prerequisites and IDE Setup

Amazon Q Developer operates across several major IDE ecosystems. Before initiating code generation or security scans, ensure your development environment satisfies compatibility and authentication prerequisites.

Supported IDE Environments

Authentication Models: Free Tier vs. Pro Tier

Amazon Q Developer provides two distinct authentication pathways depending on individual or organizational licensing:

• AWS Builder ID (Free Tier): Individual software engineers can access Amazon Q Developer completely free without entering an AWS account ID or credit card. During the IDE extension sign-in prompt, choose Use for free with AWS Builder ID. A browser window opens to log into or create a personal AWS Builder ID. This tier includes perpetual access to inline code completions, chat, security scans, and up to 50 agentic tasks per month.
• IAM Identity Center (Pro Tier - $19/user/month): Enterprise engineering teams authenticate using corporate Single Sign-On (SSO) credentials through AWS IAM Identity Center (integrated with Okta, Microsoft Entra ID, or Ping Identity). In the IDE, choose Sign in with IAM Identity Center, enter your corporate Start URL (e.g., https://my-company.awsapps.com/start) and the AWS Region. Pro tier active sessions persist for 90 days by default, eliminating daily token expirations, and unlock centralized administration, IP indemnification, custom code repository references, and pooled monthly allowances for multi-file agentic tasks and code transformations.

[!NOTE] Support Lifecycle Notice: AWS has documented an end-of-support milestone for legacy Amazon Q Developer IDE plugins on April 30, 2027. AWS recommends developers monitor official roadmap updates and explore transition pathways toward Kiro for next-generation agentic coding, Model Context Protocol (MCP) tooling, and conversational capabilities.

2. Real-Time Code Generation and Conversational Assistance

Amazon Q Developer generates source code through two primary interfaces inside the IDE: ambient inline completions as you type, and interactive chat dialogs equipped with slash commands.

Real-Time Inline Suggestions

As you write code or document intent using natural language comments, Amazon Q analyzes the active file, cursor position, imported libraries, and surrounding workspace context to recommend single-line completions or full multi-line function implementations. Inline suggestions appear directly at your cursor in grey ghost text.

Core Keyboard Shortcuts

Practical Code Generation Example

When writing a Python asynchronous utility, defining a descriptive function header and docstring triggers Amazon Q to synthesize the entire implementation:

import aiohttp
import asyncio
from typing import Dict, Any, Optional

# Prompting Amazon Q Developer via inline docstring:
async def fetch_json_with_retry(
    url: str, 
    headers: Optional[Dict[str, str]] = None, 
    max_retries: int = 3, 
    backoff_factor: float = 1.5
) -> Optional[Dict[str, Any]]:
    """
    Fetch JSON payload from a remote endpoint with exponential backoff retry.
    Handles client connection timeouts and non-200 HTTP responses.
    """
    # Press Tab to accept Amazon Q's generated block:
    timeout = aiohttp.ClientTimeout(total=10)
    for attempt in range(1, max_retries + 1):
        try:
            async with aiohttp.ClientSession(timeout=timeout) as session:
                async with session.get(url, headers=headers) as response:
                    if response.status == 200:
                        return await response.json()
                    elif response.status in (429, 500, 502, 503, 504):
                        await asyncio.sleep(backoff_factor ** attempt)
                    else:
                        response.raise_for_status()
        except (aiohttp.ClientError, asyncio.TimeoutError):
            if attempt == max_retries:
                raise
            await asyncio.sleep(backoff_factor ** attempt)
    return None

IDE Chat Pane and Inline Chat

For tasks requiring broader architectural context or multi-step logic, open the Amazon Q chat panel by clicking the Amazon Q logo in the activity bar or using the command palette:

• Adding Context (@workspace, files, selections): In the chat window, Amazon Q automatically reads the active open file. You can attach specific files or highlight code blocks in your editor and ask questions like "Explain the time complexity of this sorting routine" or "Refactor this method to use functional streams".
• Inline Editor Chat: Highlight a block of code and trigger inline chat (via command palette or shortcut). A floating prompt appears directly above the selection, allowing you to instruct Amazon Q to add parameter validation, write logging statements, or adapt types without moving your focus to a side panel.
• Unit Test Generation (/test): Highlight a function and enter /test. Amazon Q inspects edge cases, mock dependencies, and generates testing suites matching your project's framework (such as JUnit 5, PyTest, or Jest).
• Agentic Feature Implementation (/dev): For multi-file changes, typing /dev Add a rate-limiting middleware using Redis tokens prompts the Amazon Q Developer Agent for software development to generate an implementation plan, create new files, modify existing routing configurations, and present a diff for review.

Reference Tracker and IP Attribution

When Amazon Q Developer generates code that closely matches public open-source training data, the built-in Reference Tracker flags the recommendation. In the chat pane or status notification, it lists the source repository URL and the associated open-source license (such as MIT, Apache 2.0, or BSD-3-Clause). In enterprise environments configured under IAM Identity Center, administrators can enforce strict policies that automatically block code recommendations containing open-source matches.

3. Automated Security Vulnerability Scanning and One-Click Remediation

Traditional Static Application Security Testing (SAST) often runs late in the CI/CD pipeline, forcing developers to context-switch hours or days after writing code. Amazon Q Developer brings security scanning directly inside the IDE, evaluating both custom business logic and third-party dependencies.

Detection Engine and Coverage

The security analyzer combines generative reasoning with rule-based automated formal reasoning powered by the Amazon CodeGuru Detector Library. Scans identify risks across several critical vectors:

• OWASP Top 10 Vulnerabilities: SQL injection, Cross-Site Scripting (XSS), XML External Entity (XXE) injection, and insecure object deserialization.
• Credential Leakage: Hardcoded AWS access keys, database connection strings, JWT signing secrets, and unencrypted private certificates.
• System and Resource Misconfigurations: Insecure directory traversal, path manipulation, weak cryptographic hashing algorithms (MD5/SHA1), unclosed streams, and overly permissive file permissions.
• Infrastructure as Code (IaC): Insecure configurations within AWS CloudFormation templates and AWS CDK constructs.

Executing a Security Scan

Engineers can run scans using two operational modes:

1. Continuous Auto-Scan: Amazon Q can be configured in IDE settings to automatically review code changes in real time as files are saved.
2. On-Demand Project / File Scan:
   • Open your project workspace in VS Code or JetBrains.
   • Click the Amazon Q icon in the status bar at the bottom of the window, or open the Amazon Q chat pane.
   • Select Run Security Scan (or type Run a security scan on this workspace in the chat).
   • Amazon Q packages the active project scope (up to 100 MB), excluding test folders and vendor binaries, and evaluates the codebase.

Reviewing and Remedying Vulnerabilities

Findings are populated into your IDE's native Problems tab, annotated with severity tags according to the Common Vulnerability Scoring System (CVSS): Critical, High, Medium, Low, or Info.

[Problems - Project Workspace]
├── src/api/user_controller.py
│   └── [High] Line 42: CWE-89 - SQL Injection vulnerability detected in query construction.

Clicking a finding opens the detail view in the Amazon Q panel:

1. Root Cause Explanation: Outlines why the pattern is dangerous and how untrusted user input reaches the database execution sink without parameterization.
2. CWE Classification: Cross-references the official MITRE Common Weakness Enumeration ID.
3. Automated Fix Generation: Amazon Q produces a unified diff demonstrating how to replace concatenated strings with parameterized queries or ORM models.
4. Applying the Patch: Click Apply Fix or Insert at cursor. The IDE modifies the file directly, allowing you to re-run the scan to verify remediation immediately.

4. Legacy Code Transformation: Upgrading Java and Modernizing Workflows

One of Amazon Q Developer's standout agentic capabilities is the Amazon Q Developer Agent for Code Transformation (formerly Amazon Q Code Transformation). Rather than requiring software engineers to spend weeks manually updating deprecated dependencies, resolving classpath breakages, and rewriting language syntax, the agent executes automated upgrades inside the IDE.

Supported Language and Runtime Paths

The transformation agent specializes in enterprise Java migrations, with expanding support for .NET modernizations:

Prerequisites for Java Code Transformation

Before initiating a transformation job, ensure the following local environment criteria are satisfied:

• Valid Maven Baseline: The project must compile successfully locally using Apache Maven (mvn clean compile succeeds).
• Installed Source JDK: The JDK version matching your project's current source level must be installed locally and referenced in IDE project SDK settings (e.g., JDK 8 must be locally present when transforming a Java 8 repository).
• Clean Network Dependencies: Project unit tests executed during transformation must not depend on external live databases, VPC-internal endpoints, or unmocked remote network services.
• Encoding and Plugins: Source files must use UTF-8 character encoding. Build configurations should avoid non-Java wrapper plugins (such as frontend-maven-plugin executing NodeJS builds inside Maven) during the core Java transformation step.
• S3 Connectivity: The IDE must be able to securely communicate with Amazon S3 endpoints used to exchange transformation artifacts.

The Step-by-Step Transformation Workflow

The transformation process operates as an end-to-end autonomous cycle:

flowchart TD
    A["1. Initiate Job (/transform)"] --> B["2. Local Pre-Build Validation"]
    B --> C["3. Encrypted Upload to Isolated AWS Worker"]
    C --> D["4. AI-Driven AST Analysis & Refactoring"]
    D --> E["5. Target JDK Compilation & Unit Test Verification"]
    E --> F["6. Download Patch to .aws/transform"]
    F --> G["7. Side-by-Side Diff Review & Acceptance"]

Step 1: Initiating the Transformation Job

In VS Code or IntelliJ IDEA, open the Amazon Q chat pane and enter the slash command:

/transform

Alternatively, select the Amazon Q: Code Transformation panel from the tool menu. Choose the target module and select your desired destination JDK (e.g., Java 17 or Java 21).

Step 2: Local Pre-Build and Packaging

Amazon Q invokes your local Maven environment to verify project structure, build dependencies, and extract the complete Abstract Syntax Tree (AST) context. If the project fails to compile locally under its existing JDK, the tool halts immediately and displays compiler errors in the log.

Step 3: Secure Processing and Automated Refactoring

Once pre-build validation passes, project code is uploaded to a dedicated, encrypted AWS execution environment. The transformation agent executes a multi-stage migration:

• Dependency Upgrades: Inspects pom.xml, updating Maven compiler plugins, upgrading frameworks (such as migrating Spring Boot 2.x to Spring Boot 3.x), and replacing deprecated third-party libraries with JDK-compatible counterparts.
• API and Syntax Modernization: Automatically rewrites deprecated Java APIs (e.g., replacing old JAXB or Java EE imports with Jakarta EE equivalents, updating deprecated date/time libraries to java.time, and refactoring legacy collection iterations to modern stream idioms).
• Security Vetting: Checks all newly introduced dependencies against vulnerability databases to prevent introducing known CVEs during the upgrade.

Step 4: Verification Build and Test Execution

The agent attempts to compile the upgraded project against the target JDK and executes the project's existing test suite. If compilation errors arise from changed method signatures, the agent performs iterative remediation cycles to resolve compiler errors while preserving test pass rates.

Step 5: Reviewing the Transformation Plan and Diff

When processing finishes, the generated diff patch and summary report are returned to your local IDE inside the .aws/transform folder:

• Open the Transformation Summary to inspect the list of upgraded dependencies, modified files, and test results.
• Review file-by-file changes in the IDE's side-by-side diff viewer.
• Click Accept changes to commit the modifications into your working tree, or selectively accept patches on individual files.

5. Architectural Comparison: Free vs. Pro Tiers

When planning team adoption, engineering managers must weigh pricing structures, governance controls, and usage allowances:

6. Engineering Best Practices and Decision Framework

To maximize productivity while preventing technical debt when using Amazon Q Developer, incorporate these operational best practices:

• Enforce Robust Test Suites Prior to Transformation: The automated transformation agent relies heavily on existing unit tests to verify that refactored code maintains functional parity. Ensure test coverage is comprehensive before initiating /transform.
• Review Security Patches in Context: While Amazon Q's automated security fixes resolve syntactic and architectural flaws (e.g., parameterizing SQL statements), always verify that the suggested logic does not bypass required domain authorization checks or business rules.
• Utilize Focused Inline Prompts: When prompting inline code generation, write short, declarative comments specifying expected parameters, boundary conditions, and return types. Granular guidance produces higher-quality suggestions than broad statements.
• Track License Attribution in Commercial Codebases: In enterprise repositories with strict open-source governance, keep the Reference Tracker enabled. If Amazon Q generates code matching GPL-licensed public repositories, evaluate whether the snippet complies with your organization's intellectual property policies.
• Prepare for the 2027 Tooling Transition: With the April 30, 2027 end-of-support notice for current Amazon Q Developer IDE plugins, evaluate AWS roadmap announcements and assess Kiro as the future platform for agentic coding and Model Context Protocol workflows.

References

• What is Amazon Q Developer? - Amazon Q Developer
• Using Amazon Q Developer in the IDE - Amazon Q Developer
• Installing the Amazon Q Developer extension or plugin in your IDE - Amazon Q Developer
• Chatting with Amazon Q Developer about code - Amazon Q Developer
• Reviewing code with Amazon Q Developer - Amazon Q Developer
• Starting a code review with Amazon Q Developer - Amazon Q Developer
• Addressing code issues with Amazon Q Developer - Amazon Q Developer
• Upgrading Java versions with Amazon Q Developer - Amazon Q Developer
• Transforming code in the IDE with Amazon Q Developer - Amazon Q Developer
• Tiers of service for Q Developer – Free and Pro - Amazon Q Developer
• AI for Software Development – Amazon Q Developer Pricing – AWS