Fully managed malware and antivirus protection for Amazon S3
summary
Fully managed malware scanning for new S3 uploads that uses multiple AWS and industry engines to agentless detect threats, write GuardDuty findings and emit EventBridge scan-status events; scans download objects into an isolated Lambda VPC over PrivateLink, encrypts ephemeral storage with Lambda-managed KMS, then deletes it. Findings and tags objects (values: no-threats-found, threats-found, unsupported, access-denied, failed) let Lambda workflows move infected files to quarantine or enforce tag-based bucket policies. Pricing example: $21.22 per 1,000 PUTs + $0.60/GB; 5 GB limit per object and no CPK-encrypted object support.
AI-written summary · about
chapters (6)
- 0:00Introduction and S3 security
- 2:40GuardDuty malware protection
- 11:40How malware scanning works
- 16:16Configuration and pricing
- 19:56Operationalizing security
- 27:56Multi-account and conclusion
related talks
27mProactively identifying threats & protecting sensitive data in S3
06mDemo - Amazon S3 security posture management and threat detection
15mDemo - Monitor your Amazon S3 inventory & identify sensitive data
43mSimplify and accelerate security for simple storage: Case studies (PRT276)
56mContinuous innovation in AWS detection and response services
27mManaged file transfers to Amazon S3 and EFS over SFTP, FTPS, and FTP
32mAdvanced threat detection and response on AWS
34mHow Amazon MGM Studios protects its most important data