Automate malware scanning of incoming files to your Amazon S3 bucket before processing

Hello.

If a malware file is found, tag it.

This is a feature of GuardDuty Malware Protection.
https://docs.aws.amazon.com/guardduty/latest/ug/how-malware-protection-for-s3-gdu-works.html

Then move it to a new bucket that I have created and delete it from the original upload location.

When malware is found, an event with "scanResultStatus" of "THREATS_FOUND" is issued.
https://docs.aws.amazon.com/ja_jp/guardduty/latest/ug/monitor-with-eventbridge-s3-malware-protection.html#s3-object-scan-status-malware-protection-s3-ev

Therefore, by setting an event rule in EventBridge as shown below, it is possible to isolate files to another location by running Lambda via EventBridge when malware is detected.
EventBridge can execute not only Lambda but also StepFunctions.
In your case, you are using StepFunctions, so you can target EventBridge to StepFunctions.

{
  "detail-type": ["GuardDuty Malware Protection Object Scan Result"],
  "source": ["aws.guardduty"],
  "detail": {
    "scanResultDetails": {
      "scanResultStatus": ["THREATS_FOUND"]
    }
  }
}

Send an email alert that malware was found.

If you also set up Amazon SNS when setting up EventBridge above, you can send email notifications.

If no malware is found, ignore and do nothing.

The above EventBridge rule is a rule that matches when malware is found, so it will not react otherwise.

The following AWS blog explains in detail how to implement it.
https://aws.amazon.com/jp/blogs/security/using-amazon-guardduty-malware-protection-to-scan-uploads-to-amazon-s3/

Hi,

To your question, you have here a step-by-step guidance on how to create an EventBridge rule for GuardDuty: https://repost.aws/knowledge-center/guardduty-eventbridge-sns-rule

You should use to create the proper rule for malware detection as suggested by Riku in his answer

Best,

Didier