#MalwareProtectionforS3

[govindhtech]

AWS Transfer Family and GuardDuty Malware Protection for S3

S3 malware protection

Protecting against malware using AWS Transfer Family and GuardDuty

Businesses often must deliver online content safely. Public file transfer servers put the firm at risk from threat actors or unauthorised users submitting malware-infected files. Businesses can limit this risk by checking public-channel files for malware before processing.

AWS Transfer Family and Amazon GuardDuty may scan files transferred over a secure FTP (SFTP) server for malware as part of a transfer operation. GuardDuty automatically updates malware signatures every 15 minutes instead of scanning a container image, avoiding the need for human patching.

Prerequisites

What you need to implement the solution:

AWS account: This solution requires AWS access. If you don't have an AWS account, see Start developing today.

CLI: AWS Command Line Interface Install and link the AWS CLI to your account. Configure AWS account environment variables using your access token and secret access key.

The sample code will be fetched from GitHub using Git.

Terraform: Automation will use Terraform. Follow Terraform installation instructions to download and install.

Solution overview

This solution uses GuardDuty and Transfer Family. Smart threat detection service GuardDuty and secure file transfer service Transfer Family may be used to set up an SFTP server. AWS accounts, workloads, and data are protected by GuardDuty from odd and hazardous activity. The high-level solution uses these steps:

Transfer Family SFTP servers receive user file uploads.

Transfer Family workflows call AWS Lambda to conduct AWS Step Functions workflows.

Workflow begins after file upload.

Partial uploads to the SFTP server trigger an error handling Lambda function to report an error.

After a step function state machine runs a Lambda function to move uploaded files to an Amazon S3 bucket for processing, GuardDuty scans.

Step gets GuardDuty scan results as callbacks.

Clean or move infected files.

The process sends results using Amazon SNS. This might be an alert about a hazardous upload or problem that happened during the scan, or it could be a message about a successful upload and a clean scan that can be processed further.

Architecture and walkthrough of the solution

GuardDuty Malware Protection for S3 checks freshly uploaded S3 things. GuardDuty lets you monitor object prefixes or design a bucket-level malware defence approach.

This solution's procedure begins with file upload and continues through scanning and infection classification. From there, adjust the procedures for your use case.

Transfer Family uploads files using SFTP.

A successful upload starts the Managed Workflow Complete workflow and uploads the file to the Unscanned S3 bucket using Transfer Family. Successful uploads are managed by the Step Function Invoker Lambda function.

The Step Function The invoker starts the state machine and process by calling GuardDuty Scan Lambda.

GuardDuty Scan moves the file to Processing. The scanned files will come from this bucket.

GuardDuty automatically checks uploaded items. This implementation develops a Processing bucket malware prevention strategy.

After scanning, GuardDuty sends Amazon EventBridge the result.

A Lambda Callback function is invoked by an EventBridge rule after each scan. EventBridge calls the method with scan results. See Amazon EventBridge S3 item scan monitoring.

Lambda Callback alerts GuardDuty Scan using callback task integration. The Move File task receives GuardDuty scan results after returning to the Scan function.

If the scan finds no threats, the transport File operation will transport the file to the Clean S3 bucket for further processing.

Move File now posts to Success SNS to notify subscribers.

The Move File function will send the file to the Quarantine S3 bucket for extra analysis if the conclusion suggests that the file is dangerous. To warn the user to the upload of a potentially hazardous file, the function will further delete the file from the Processing bucket and publish a notification in the SNS’s Error topic.

Transfer Family will commence the Managed procedure Partial process if the file upload fails and is not entirely uploaded.

Controlled Workflow The Error Publisher function, which is used to report errors that emerge anywhere in the process, is called by the Partial error handling workflow.

The issue Publisher function detects the type of issue and adjusts the error status appropriately, depending on whether it is due to a partial upload or a problem elsewhere in the process. Then it will send an error message to the SNS Error Topic.

The GuardDuty Scan job has a timeout to broadcast an event to Error Topic if the file isn't scanned, requiring a manual intervention. If GuardDuty Scan fails, the Error clean up Lambda function is invoked.

Finally, the Processing bucket has an S3 Lifecycle policy. This ensures no file stays in the Processing bucket longer than a day.

Code base

The GitHub AWS-samples project implements this method using Terraform and Python-based Lambda functions.This solution may be built with AWS CloudFormation. The code includes everything needed to finish the procedure and demonstrate GuardDuty's malware protection plan and Transfer Family.

Install the fix

Applying this solution to testing.

Clone the repository to your working directory with Git.

Enter the root directory of the copied project.

Customise Terraform locals.tf's S3 bucket, SFTP server, and other variables.

Execute Terraform.

If everything seems good, run Terraform Apply and select Yes to construct resources.

Clear up

Preventing unnecessary costs requires cleaning up your resources after testing and examining the solution. Remove this solution's resources by running the following command in your cloned project's root directory:

This command deletes Terraform-created SFTP servers, S3 buckets, Lambda functions, and other resources. Answer “yes” to confirm deletion.

In conclusion

Follow the instructions in the post to analyse SFTP files uploaded to your S3 bucket for hazards and safe processing. The solution reduces exposure by securely scanning public uploads before sending them to other portions of your system.