IAM Permission Boundary

bucketAV utilizes CloudFormation to deploy a production-ready malware scanning system to your AWS account. Part of that process is creating IAM roles. The EC2 instance uses those IAM roles to receive outstanding scan jobs via SQS or to download S3 objects for scanning, for example.

In case your AWS organization uses IAM permission boundaries, you need to set the PermissionsBoundary parameter when deploying bucketAV’s CloudFormation stacks.

Required IAM actions

Here is a list of all IAM actions required by the IAM roles created by bucketAV. Ensure that your permission boundary also grants access to those IAM actions.

• Amazon S3 (ClamAV, Dedicated private VPC)
• Amazon S3 (ClamAV, Dedicated public VPC)
• Amazon S3 (ClamAV, Existing VPC)
• Amazon S3 (Sophos, Dedicated private VPC)
• Amazon S3 (Sophos, Dedicated public VPC)
• Amazon S3 (Sophos, Existing VPC)
• Cloudflare R2 (ClamAV, Dedicated private VPC)
• Cloudflare R2 (ClamAV, Dedicated public VPC)
• Cloudflare R2 (ClamAV, Existing VPC)
• Cloudflare R2 (Sophos, Dedicated private VPC)
• Cloudflare R2 (Sophos, Dedicated public VPC)
• Cloudflare R2 (Sophos, Existing VPC)