Everyone's gonna say "just use Snyk Code" or "roll with GitHub Advanced Security." Don't. They're either too expensive for a team this size or they'll drown you in noise, especially with Lambda's oddball packaging.
You need something that understands serverless context and doesn't flag every third-party lib in your `vendor` folder as a critical CVE. Most SAST tools are built for fat containers or VMs. Look for something that hooks into SAM/CDK, runs in CI *before* you build the zip, and has decent Python support (not just Java). Ignore the marketing about "500+ language support." You need it to work for *your* stack.
Just my two cents.
Just my two cents.
I'm a director of engineering at a 50-person fintech. We've been running Python APIs and event processors on Lambda for three years, and I've personally wrangled the SAST procurement for teams of this size.
My core criteria for your scenario:
* **Lambda-Aware Packaging:** Most tools fail here. You need something that scans your actual dependencies *before* you build the deployment package. Checkmarx SAST, in my experience, will still analyze the vendored mess inside the zip and light up like a Christmas tree. Snyk Code, via the CLI, can be run at the source/dependency stage before packaging, which is a win. SonarQube, with the right quality profile, will ignore the `vendor` directory entirely, but that's manual config.
* **True Pricing for 5 Eng:** GitHub Advanced Security is a non-starter - it's bundled with other enterprise features and you're looking at a $40+/user/month commit minimum. Snyk's Developer plan is ~$25/user/month for Code alone, and you'll hit seat limits fast. SonarCloud's cheapest paid tier is about $15/user/month for the first 10 devs, billed annually, which puts you at ~$900/year. Semgrep OSS is free, but the Pro tier (needed for the CI/CD depth you want) is about $5/user/month with team pricing.
* **Noise-to-Signal Configuration:** This is the hidden time cost. Out-of-the-box, Snyk will overwhelm you with "high severity" issues in transitive dependencies. SonarQube's default Python profile is archaic and will nag you about PEP8 formatting unless you aggressively tune it. Semgrep lets you write custom rules easily, which is great, but now you're maintaining security rules as code.
* **CI/CD Integration Friction:** Any tool that requires a persistent daemon or a heavy scanner container in your pipeline will murder your Lambda build times. Snyk's CLI is relatively lightweight. Semgrep's CI scan is a single binary call. SonarQube's scanner can be a pig; the cloud version is better. Ignore anything that requires a long-lived "central server" you have to manage.
I'd push you toward Semgrep Pro, but only if someone on your team of five is willing to spend a half-day a month tuning rules. If you want a more "set and forget" experience at the cost of some accuracy, Snyk Code's CLI integrated into your SAM build stage is the pragmatic choice. Tell me your CI runtime budget per build and whether you have any compliance requirements (SOC2, etc.), and I can lock this in.
Trust but verify.