awscdk cfnPractitioner

Building a Continuous Modernization Pipeline with AWS Transform Custom

5 min read AWS DevOps BlogAug 28, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

In today's fast-paced development environment, relying on periodic modernization sprints can lead to technical debt piling up. AWS Transform custom enables you to automate the modernization process, integrating it directly into your CI/CD pipeline. This means that instead of waiting for a scheduled sprint, your codebase continuously evolves, addressing vulnerabilities and outdated dependencies as they arise.

AWS Transform custom allows you to set up a DIY modernization pipeline using your existing CI/CD platform. It shifts code transformation into an automated, pipeline-driven practice. Key parameters include TRANSFORMATION_NAME, which defaults to Remediate-Critical-GitHub-Dependabot-Alerts-Java-Maven, and BUILD_CMD, typically set to mvn clean install. You can also configure MAX_RETRIES to control how many times the pipeline attempts to run the transformation on failure. The provided bash script illustrates how to execute the transformation in headless mode, retrying up to three times if necessary, which is crucial for maintaining reliability in production.

However, be cautious when using the –trust-all-tools flag in your atx custom def exec command. This flag allows tools to execute without interactive confirmation, which is essential for CI/CD but may pose security risks. Always review your organization's security policies before enabling it in production. Additionally, ensure that your dependencies are up to date; for instance, using Spring Boot 1.5.19 is risky due to known CVEs. Proper IAM permissions and AWS Transform CLI setup are prerequisites for a successful implementation.

Key takeaways

→Automate modernization by integrating AWS Transform custom into your CI/CD pipeline.
→Set `TRANSFORMATION_NAME` to customize the remediation process for your specific needs.
→Use the bash script to manage retries and ensure successful execution of transformations.
→Review security policies before using the `–trust-all-tools` flag in production.
→Keep dependencies updated to avoid vulnerabilities, especially with outdated libraries.

Why it matters

Continuous modernization reduces the risk of accumulating technical debt, allowing teams to maintain a secure and efficient codebase. This proactive approach can significantly enhance your application's resilience and performance.

Code examples

Bash

1#!/usr/bin/env bash
2set -euo pipefail
3
4# -------------------------------------------------------------------
5# run_dependabot_alert_fixes.sh
6# Runs the Dependabot alert remediation transformation in headless mode.
7# Retries up to MAX_RETRIES times on failure.
8#
9# Usage:
10#   ./run_dependabot_alert_fixes.sh [-n <transformation-name>] [-p <path>] [-c <build-command>]
11#
12# Defaults:
13#   -n  Remediate-Critical-GitHub-Dependabot-Alerts-Java-Maven
14#   -p  .                   (current directory)
15#   -c  mvn clean install   (Maven build)
16# -------------------------------------------------------------------
17
18TRANSFORMATION_NAME="Remediate-Critical-GitHub-Dependabot-Alerts-Java-Maven"
19CODE_PATH="."
20BUILD_CMD="mvn clean install"
21MAX_RETRIES=3
22
23while getopts "n:p:c:" opt; do
24  case $opt in
25    n) TRANSFORMATION_NAME="$OPTARG" ;; 
26    p) CODE_PATH="$OPTARG" ;; 
27    c) BUILD_CMD="$OPTARG" ;; 
28    *) echo "Usage: $0 [-n <transformation-name>] [-p <path>] [-c <build-command>]" && exit 1 ;;
29  esac
30done
31
32echo "=== AWS Transform Custom ==="
33echo "Transformation: $TRANSFORMATION_NAME"
34echo "Code path:      $CODE_PATH"
35echo "Build command:  $BUILD_CMD"
36echo "============================"
37
38attempt=1
39while [ $attempt -le $MAX_RETRIES ]; do
40  echo "--- Attempt $attempt of $MAX_RETRIES ---"
41
42  if atx custom def exec \
43    -n "$TRANSFORMATION_NAME" \
44    -p "$CODE_PATH" \
45    -c "$BUILD_CMD" \
46    -x -t; then
47    echo "=== Transformation completed successfully ==="
48    exit 0
49  fi
50
51  echo "Attempt $attempt failed."
52attempt=$((attempt + 1))
53
54  if [ $attempt -le $MAX_RETRIES ]; then
55    echo "Retrying in 10 seconds..."
56sleep 10
57  fi
58done
59
60echo "=== All $MAX_RETRIES attempts failed ==="
61exit 1