0

I am setting up AWS SFTP which uses s3 to store files. I am setting up sftp to exchange files with third party organisations. When i receive files i want to ensure no malicious content is received. How do i scan objects that arrive into my s3?

I have had a look at google and stackoverflow but not finding any definitive way to do achieve this.

I would appreciate any help/guidance.

1

I see no support to prevent malware uploads in the present S3 API or S3 Developer Guide.

What is possible is to analyze the incoming objects outside of S3, e.g. download and inspection on a machine which is equipped with software that can identify malware.

You might use only PUT permissions to prevent further processing until your inspection has cleared the incoming objects.

Amazon Macie seems to be able to classify your S3 objects and raise alerts (File hosting, Ransomware alerts), I have not tried it though.

SFTP access then is also controllable via permissions.

It would require some self written application to run all this.

1
  • Hi - thanks for your response. this is just what i was thinking. I think its abit short sighted that AWS does not provide such a capability / add on service to s3. Nov 8 '19 at 10:54
2

you can try the approach of using ClamAV which is an open-source AV.

https://github.com/upsidetravel/bucket-antivirus-function

Also Second approach if you can use the Virustotal enterprise API for scanning S3 buckets that's another thing I am trying out currently.

1

There are a handful of folks who have taken ClamAV, as suggested above, and productized it. Along with ideas of providing use of other scanning engines. Checkout AWS Marketplace: https://aws.amazon.com/marketplace/search/results?x=0&y=0&searchTerms=s3+antivirus.

You can certainly build it yourself, but these are supported and robust.

1

A simple way to do this would be to create a specific-purpose AWS Lambda function which would execute a well-known vulnerability scanner or firewall (e.g. the open-source ClamavNet). This would be triggered upon the object's arrival on S3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.