Amazon GuardDuty Malware Protection for S3 versus bucketAV

We started working on bucketAV in 2015. Since then, we have received a lot of feedback from our customers and improved bucketAV every month. Recently, I compared bucketAV with the new kid on the block: Amazon GuardDuty Malware Protection for S3 released in June 2024.

My approach to comparing malware scanners for Amazon S3 is mostly feature-based. I also compared the operational and pricing models of both solutions. Let’s start with the features.

Features

I grouped the features into four categories:

• Scan modes: Do you want to scan a single file or the whole bucket? When do you want to scan to happen? in real-time, right after the upload, on a schedule, on-demand, or on-access, in the moment a file is downloaded? GuardDuty can scan files in real-time, right after the file is uploaded. bucketAV supports real-time file scanning as well. On top of it, bucketAV can scan a whole bucket on a schedule. bucketAV can also scan files and buckets on-demand. Additionally, bucketAV supports on-access file scan, to scan a file just before the download.
• Mitigation: What should happen with the files after the scan? Do you want to delete infected files, move them to a quarantine bucket, or just tag them? GuardDuty supports tagging with the key GuardDutyMalwareScanStatus. bucketAV supports tagging as well with a configurable tag key. On top of it, bucketAV can delete infected files and move files into other buckets which is handy to move infected files into a quarantine bucket for further analysis.
• Reporting: How can you observe the scan results? Do you prefer a daily/weekly/monthly report, a real-time notification via email, Slack, Microsoft Teams, a real-time dashboard, or integration into AWS security services like Security Hub that can also integrate with an SIEM? GuardDuty Malware Protection for S3 can be used in two modes. If you also subscribe to GuardDuty, you will see findings created in GuardDuty for infected files. If you use GuardDuty Malware Protection for S3 independently, there is no way to track the scan results of files besides the object tag. bucketAV supports daily/weekly/monthly reports with statistics and CSV files, and real-time notifications via email, Slack, or Microsoft Teams. bucketAV also offers a real-time dashboard as well as integrations into AWS Security Hub and AWS Systems Manager OpsCenter.
• Developer: Last but not least, what capabilities are provided to extend or embed the solution into your existing applications? For example, what options are available to notify your application about scan results? Is there an API to scan files on-demand? GuardDuty publishes all scan results via EventBridge. bucketAV uses SNS or EventBridge to publish similar information. All solutions publish CloudWatch metrics to inform about the number of files scanned, infected, clean, and unscannable files. bucketAV also offers HTTPS APIs to scan files on-demand using an API outside of S3.

The following table provides an overview of the features.

Operational model

Amazon GuardDuty Malware Protection for S3 is a managed service operated by AWS. bucketAV, on the other hand, is installed by the customer and runs in the customer’s AWS account. bucketAV provides CloudFormation templates and EC2 AMIs that our customers use to deploy the solution.

Pricing model

Comparing the pricing model is a little harder. I will use three examples that represent typical customers of bucketAV.

In the following, I present detailed cost estimations of all examples. I end with a detailed comparison of the pricing models.

Tiny workload

The customer scans 300 files per day with an average file size of 10 MB. This results in 9,000 files and 90 GB per month. Objects are tagged with scan results. AWS region is us-east-1.

Small workload

The customer scans 20,000 files per day with an average file size of 5 MB. This results in 600,000 files and 3,000 GB per month. Objects are tagged with scan results. AWS region is us-east-1.

Larger workload

The customer scans 500,000 files per day with an average file size of 1 MB. This results in 15,000,000 files and 15,000 GB per month. Objects are tagged with scan results. AWS region is us-east-1.

Detailed pricing model comparison

The following table shows the various aspects of the pricing models.

Limitations

Last but not least, we dive into the technical limitations the products come with.

Summary

bucketAV and Amazon GuardDuty Malware Protection for S3 are two solutions for Amazon S3 malware scanning, each with distinct features, operational models, and pricing. bucketAV, developed since 2015, offers comprehensive scan modes including real-time, scheduled, on-demand, and on-access scans, along with mitigation options such as tagging, deletion, and quarantining of infected files. It provides detailed reporting and integration capabilities and uses either Sophos or ClamAV engines. GuardDuty, released in June 2024, focuses on real-time scanning post-upload and uses tagging for mitigation, with more limited reporting and integration primarily through GuardDuty findings. GuardDuty is a managed AWS service, whereas bucketAV requires customer deployment and management within their AWS account. In terms of cost, GuardDuty is more cost-effective for tiny workloads, while bucketAV becomes more economical for non-tiny data volumes. Both services integrate with various AWS services for operational and reporting purposes, with bucketAV offering more extensive customization and developer support.