Abstract: Techniques for data flow analysis of cloud-based software applications are described. A first portion of source code of a software application is determined to obtain data from a data source identified by a first resource identifier of a cloud provider network, the determination based on a mapping of a first statement in the first portion of the source code to an application programming interface (API) call. A trace of a data flow from the first portion of the source code to a second portion of the source code is obtained. A data sink identified by a second resource identifier of the cloud provider network is determined based on a mapping of a second statement in the second portion of the source code to another API call. A result that includes an identification of a data flow from the data source identified by the first resource identifier to the data sink identified by the second resource identifier is generated.

Abstract: A partitioning technique is applied to divide input code into different portions. Different partitioning techniques can be applied in order to optimize the portioning of the code to account for various features of the code, such as code dependencies. Once partitioned, the code analysis tasks execute in parallel on the code portions. In this way, improved code analysis performance is obtained. Moreover, the addition of new code analysis tasks may not impact overall analysis performance as the partitioning can help to offset added or unknown analysis latency of new code analysis tasks.

Abstract: A partitioning technique is applied to divide input code into different portions. Different partitioning techniques can be applied in order to optimize the portioning of the code to account for various features of the code, such as code dependencies. Once partitioned, the code analysis tasks execute in parallel on the code portions. In this way, improved code analysis performance is obtained. Moreover, the addition of new code analysis tasks may not impact overall analysis performance as the partitioning can help to offset added or unknown analysis latency of new code analysis tasks.

Abstract: Techniques for visualizing dependent relationships in computer program analysis trace elements are described. A code analysis service analyzes computer code associated with a software application for at least one of errors or policy violations. The service outputs a trace log identifying a path within the computer code that results in an error or policy violation. The trace log includes a set of trace elements each corresponding to a line of the computer code. The output is displayed as a tree data structure including nodes. The nodes may include indentations indicating dependent relationships between and among variables initialized at lines in the computer code corresponding to the nodes. Alternatively, the nodes may be arranged as a hierarchy with edges connecting adjacent nodes, and nodes at different levels indicating dependent relationships. The tree data structure may include annotations providing additional contextual information about the actions performed at each node.