Antivirus for S3 Buckets
Antivirus for S3 Buckets
Are you looking for a solution to ensure that your S3 buckets are virus free? Look no further.
Join the DZone community and get the full member experience.
Join For FreeDiscover a centralized approach to monitor your virtual infrastructure, on-premise IT environment, and cloud infrastructure – all on a single platform.
Many of our AWS consultancy clients ask me:
"How can we make sure that the files that we store on S3 are virus free?"
As always, our clients are looking for simple and cheap solutions. That's why I developed S3 VirusScan. Every file that is added to an S3 bucket is automatically scanned.
Features
- Uses ClamAV to scan newly added files on S3 buckets
- Updates ClamAV database every 3 hours automatically
- Scales EC2 instance workers to distribute workload
- Publishes a message to SNS in case of a finding
- Can optionally delete compromised files automatically
- Logs to CloudWatch Logs
How Does It Work
A picture is worth a thousand words:
- S3 VirusScan uses an SQS queue to decouple scan jobs from the ClamAV workers. Each S3 bucket can fire events to that SQS queue in case of new objects. This feature of S3 is called S3 Event Notifications.
- The SQS queue is consumed by a fleet of EC2 instances running in an Auto Scaling Group. If the number of outstanding scan jobs reaches a threshold a new ClamAV worker is automatically added. If the queue is mostly empty, workers are removed.
- The ClamAV workers run a simple Ruby script that executes the clamscan command. In the background, the virus database is updated every three hours.
- If
clamscanfinds a virus the file is directly deleted (you can configure that) and an SNS notification is published.
Installation & Configuration
Read more about S3 VirusScan and learn how to install and configure our solution in minutes.
Read on
- Learn more about AWS with our book Amazon Web Services in Action
- Avoid Sharing Key Pairs for EC2
- Event Driven Security Automation on AWS
- Monitor your AWS account to detect suspicious behavior in real time
- Your single AWS account is a serious risk
Feedback
Anything missing? Looking forward to your feedback! @hellomichibye or michael@widdix.de.
Learn how to auto-discover your containers and monitor their performance, capture Docker host and container metrics to allocate host resources, and provision containers.
Like This Article? Read More From DZone
Published at DZone with permission of Michael Wittig , DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.
{{ parent.title || parent.header.title}}
{{ parent.tldr }}
{{ parent.linkDescription }}
{{ parent.urlSource.name }}