On-access file scan

This feature is only available for bucketAV for Amazon S3!

Scan files before downloading for maximum protection against the latest threats powered by S3 Object Lambda.

Setup

• Amazon S3
• Cloudflare R2

aws s3 cp s3://YOUR_BUCKET_NAME/report.pdf .

aws s3 cp s3://S3_OBJECT_LAMBDA_ACCESS_POINT_ALIAS/report.pdf .

Run Lambda in a VPC

By default, the add-on deploys Lambda functions with access to the Internet. In case you want to deploy the Lambda functions into a VPC, configure the LambdaVpc and LambdaSubnets parameters.

The add-on requires access to the following endpoints (replace REGION with the AWS region like eu-west-1):

https://s3.REGION.amazonaws.com
https://sqs.REGION.amazonaws.com
https://dynamodb.REGION.amazonaws.com

Ensure that the subnets configured in the LambdaSubnets parameter have access to these endpoints via a NAT Gateway or VPC Endpoints.

Multi-account setup

Multi-account support requires version >= 2.3.0 of this Add-On. To update to the latest version, follow the update instructions.

If the bucket is created in a different AWS account, you can still use on-access file scanning.

1. In AWS account a (the AWS account where bucketAV is running), follow the setup instructions from above.
   1. Set the BucketAccountId parameter to AWS account b (the AWS account where the bucket is created).
2. In AWS account b, add a bucket policy to the bucket (replace YOUR_BUCKET_NAME with the name of your bucket and YOUR_ACCOUNT_A_ID with the AWS account ID of AWS account a):

{
  "Version": "2012-10-17",
  "Statement": [{
     "Effect": "Allow",
     "Principal": {
         "AWS": "*"
     },
     "Action": [
         "s3:GetObject",
         "s3:ListBucket"
     ],
     "Resource": [
         "arn:aws:s3:::YOUR_BUCKET_NAME",
         "arn:aws:s3:::YOUR_BUCKET_NAME/*"
     ],
     "Condition": {
         "StringEquals": {
             "s3:DataAccessPointAccount": "YOUR_ACCOUNT_A_ID"
         }
     }
  }]
}

Recommendations

• Use bucketAV powered by Sophos®.
• Use a separate bucketAV stack for scan-on-access workloads to avoid delays caused by real-time or scheduled scans.
• Increase the InstanceType parameter of your bucketAV stack (e.g., m5.xlarge).
• Increase the VolumeThroughput parameter of your bucketAV stack (e.g., 250).

CloudFormation snippet

• Amazon S3
• Cloudflare R2

# [...]
Resources:
  # [...]
  ScanOnAccess:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      Parameters:
        BucketAVStackName: 'bucketav' # if you followed the docs, the name is bucketav
        BucketName: 'YOUR_BUCKET_NAME' # TODO replace bucket name placeholder
      TemplateURL: 'https://bucketav-add-ons.s3.eu-west-1.amazonaws.com/scan-on-access/v2.5.0/bucketav-add-on-scan-on-access.yaml'

Terraform snippet

• Amazon S3
• Cloudflare R2

resource "aws_cloudformation_stack" "bucketav_add_on_scan_on_access" {
  name         = "bucketav-scan-on-access"
  template_url = "https://bucketav-add-ons.s3.eu-west-1.amazonaws.com/scan-on-access/v2.5.0/bucketav-add-on-scan-on-access.yaml"
  capabilities = ["CAPABILITY_IAM"]
  parameters = {
    BucketAVStackName = "bucketav" # if you followed the docs, the name is bucketav
    BucketName        = "YOUR_BUCKET_NAME" # TODO replace bucket name placeholder
  }
}

Update

Which version am I using?

• Amazon S3
• Cloudflare R2

Architecture

The following AWS services are used:

• DynamoDB Table to store scan results temporarily.
• SNS Subscription to connect to the Findings Topic.
• Lambda Function to store the scan results in DynampDB and to implement the S3 Object Lambda.
• S3 Object Lambda Access Point to implement the S3 Object Lambda.
• S3 Access Point as the supporting access point for the S3 Object Lambda Access Point.
• CloudWatch Alarms to monitor the used AWS services.
• CloudWatch Logs to store logs.

Limitations

• Parallel byte-range fetches are supported using the Range header or query parameter. We do not support the partNumber query parameter. We need to scan the whole file even if we return just a portion. We recommend turning on caching.
• S3 Object Lambda timeout is 60 seconds (not fixable).
  • The scan result timeout is 55 seconds.
• S3 Object Lambda does not allow anonymous or public access (not fixable).
• Object size restriction is around 10 GB (Lambda memory limitation because of missing stream support in AWS SDK v3).
• Please research S3 Object Lambda pricing and understand the performance impact of S3 Object Lambda.

Run Lambda in a VPC

By default, the add-on deploys Lambda functions with access to the Internet. In case you want to deploy the Lambda functions into a VPC, configure the LambdaVpc and LambdaSubnets parameters.

The add-on requires access to the following endpoints (replace REGION with the AWS region like eu-west-1):

https://s3.REGION.amazonaws.com
https://sqs.REGION.amazonaws.com
https://dynamodb.REGION.amazonaws.com

Ensure that the subnets configured in the LambdaSubnets parameter have access to these endpoints via a NAT Gateway or VPC Endpoints.

Release Notes

• Amazon S3
• Cloudflare R2