S3 malware / virus scanner powered by attachmentAV and AWS CloudFormation

A CloudFormation template scanning S3 buckets for malware / viruses using the attachmentAV API. This solution automatically scans files uploaded to an S3 bucket using the attachmentAV API and tags files with scan results or even deletes infected files.

Features

• 🛡️ Automatic Malware Scanning: Scans files up to 5GB using asynchronous attachmentAV API
• ⚡ Flexible Triggers: Choose between S3 event notifications (default) or EventBridge
• 🔐 Secure API Key Storage: Uses AWS Systems Manager Parameter Store for API key management
• 📊 CloudWatch Logging: Structured scan results logged for monitoring and auditing
• ✉️ Object Tagging: Tags all scanned files with scan results for additional processing
• 🚨 Automatic Malware Deletion: Support for automatic deletion of infected files
• 🎯 Configurable Filters: Support for S3 key prefix and suffix filtering
• 🚀 Production Ready: Includes IAM roles, permissions, and error handling

Architecture

┌──────────┐      ┌──────────────┐      ┌───────────────┐
│ S3       │─────▶│ Scanner      │─────▶│ attachmentAV  │
│ Bucket   │      │ Lambda       │      │ API           │
└──────────┘      └──────────────┘      └───────────────┘
       ▲                  │                      │
       │                  │                      │
       │                  ▼                      │
       │          ┌──────────────┐               │
       │          │ SSM          │               │
       │          │ Parameter    │               │
       │          │ Store        │               │
       │          └──────────────┘               │
       ─────────────────────────────────────     │
                                           │     ▼
                  ┌──────────────┐      ┌───────────────┐
                  │ CloudWatch   │◀─────│ Callback      │
                  │ Logs         │      │ Lambda        │
                  └──────────────┘      └───────────────┘

Installation

1. Sign up at attachmentav.com to obtain an attachmentAV API Key
2. Store your API key as an AWS SSM Parameter of type SecureString
   1. Visit https://console.aws.amazon.com/systems-manager/parameters/aws/create
   2. Set Name to /attachmentav/api-key
   3. Set Type to SecureString
   4. Set Value to your attachmentAV API Key obtained in the previous step
   5. Click on Create parameter
3. Create AWS CloudFormation Stack
   1. Visit
   2. Double check that the value of API Key Parameter Name matches with the SSM parameter you created in the previous step
   3. Set S3 Bucket Name to name of your S3 bucket that you want to protect (must be in the same region as the AWS CloudFormation stack!)
   4. Enable I acknowledge that AWS CloudFormation might create IAM resources.
   5. Click on Create stack
4. Wait for the stack to reach status CREATE_COMPLETE.
5. Upload a file to your bucket and check tags under object details.

CloudFormation Parameters

Required Parameters

Parameter	Default	Description
ApiKeyParameterName	/attachmentav/api-key	SSM Parameter name containing the attachmentAV API key
S3BucketName		S3 bucket name for triggering scans.

Optional Parameters

Parameter	Default	Description
TriggerStrategy	S3_EVENT	Trigger strategy: S3_EVENT or EVENTBRIDGE
TagObjectWithScanResult	true	Tag objects with scan results: true or false
DeleteInfectedObject	false	Delete infected objects: true or false
S3KeyPrefix	(empty)	S3 key prefix filter for triggering scans
S3KeySuffix	(empty)	S3 key suffix filter for triggering scans
ApiUrl	https://eu.developer.attachmentav.com	attachmentAV API base URL
TenantId	(empty)	attachmentAV tenant ID for callback verification

Trigger Strategies

S3_EVENT (Default)

• Uses native S3 event notifications
• Lower latency
• Directly invokes Lambda function
• Recommended for most use cases

EVENTBRIDGE

• Routes S3 events through Amazon EventBridge
• More flexible for complex event routing
• Allows additional event consumers
• Slightly higher latency