Enabling Anti-Virus on an S3 Bucket

Question

Hi, users will be uploading zip files to my S3 bucket directly through my website shop.
To ensure security I would need 2 things from AWS.

1. Anti virus scan for the uploaded zip files, if a detection occurs than we'd need to collect relevant incident details, ensure the file has no way to interact with anything and remove it completely.
2. complete separation of the files on storage, that means that even if a file is corrupted and it somehow passed the anti-virus from step one than it will not be able to spread anywhere cause its will be contained in its own box.

Are this possible? if yes how can I start?
Does AWS provide a scanner or do I need to purchase those from a 3rd party?

Answer

Hi there

There isn't a managed service from AWS for S3 AntiVirus.  However take a look at this previous re:post answer for some ideas.  There are a few options on the AWS marketplace or you can build your own.

https://repost.aws/questions/QU-AQ_-MzFRsuSSBQC1W8KCw/how-to-exacute-virus-scan-before-uploading-the-file-to-the-s-3-bucket

Here are a couple of blog posts that cover how to do this:

[Integrating Amazon S3 Virus Scanning into Your Application Workflow with Cloud Storage Security](https://aws.amazon.com/blogs/apn/integrating-amazon-s3-malware-scanning-into-your-application-workflow-with-cloud-storage-security/)

[ Amazon S3 Malware Scanning Using Trend Micro Cloud One and AWS Security Hub](https://aws.amazon.com/blogs/apn/amazon-s3-malware-scanning-using-trend-micro-cloud-one-and-aws-security-hub/)

[Virus scan S3 buckets with a serverless ClamAV based CDK construct](https://aws.amazon.com/blogs/developer/virus-scan-s3-buckets-with-a-serverless-clamav-based-cdk-construct/)

Answer

Between your front end and the s3 bucket, there could be one step added: the uploaded file could be saved at a temporary location (say /tmp) and the front end can call a virus scan API server to perform the virus check.

The file scan before uploading to the s3 bucket can be done through the API Server available at the marketplace:

https://aws.amazon.com/marketplace/pp/prodview-giign63hhwqo6

More information can be found at

https://docs.elmcomputing.io/ami/x86/api_virus_scan_clamav.html

Answer

We offer a solution for you: [bucketAV scans your S3 buckets for viruses, worms, and trojans](https://bucketav.com/). bucketAV detects malware in real-time, periodically, on-access, or on-demand. bucketAV is available in the AWS Marketplace.
For your use case, I recommend to use two buckets—one for uploads and one for downloads. Clean files are moved from the staging bucket to the target bucket. Infected files are deleted or quarantined.
More details: https://bucketav.com/help/use-cases/user-uploads.html#staging-bucket

Enabling Anti-Virus on an S3 Bucket

Relevant content