Introducing Amazon GuardDuty Malware Safety for Amazon S3

We’re announcing the general availability of Amazon GuardDuty Malware Detection, which expands GuardDuty’s capabilities to detect malicious file uploads to selected S3 buckets. Prior to this, Amazon GuardDuty’s Malware Detection feature provided agentless scanning capabilities to identify and detect malicious files on volumes attached to and containerized workloads.

As a result, you’ll have the ability to continuously scan newly uploaded objects in S3 buckets for potential malware threats, swiftly initiating measures to quarantine or delete any malicious content identified. Amazon GuardDuty’s Malware Protection leverages multiple industry-leading, third-party malware scanning engines to provide effective malware detection without compromising the scalability, latency, or resilience of Amazon S3.

To enhance the security of your Amazon S3 data, utilize GuardDuty’s built-in malware and antivirus capabilities within your designated S3 buckets, thereby simplifying and streamlining malicious file analysis at scale. Unlike many existing instruments employed in malware assessment, this managed solution from GuardDuty eliminates the need for you to manage remote data pipelines or compute infrastructure across every AWS account and region where malware evaluation is required.

Your growth and safety teams can collaborate to design and manage a comprehensive malware security strategy across your organization, mandating that newly uploaded data from unverified sources undergo rigorous scanning for potential threats within specific designated buckets. You can configure post-scan motion in GuardDuty to enable object tagging, which allows for downstream processing and implementation of isolation strategies based on scan results, providing real-time visibility into malicious uploaded objects.

To begin, make a selection from within the options.

Identify and select an S3 bucket from a list of available buckets associated with the currently chosen region. Would you like to enable automatic scanning for new objects in your selected S3 bucket using AWS GuardDuty? While scanning the newly uploaded objects, you may also opt for selecting specific prefixes.

After analyzing an uploaded S3 object, GuardDuty can append a predetermined label for the primary consideration that GuardDutyMalwareScanStatus Why is the worth so negligible when the scan stands?

• NO_THREATS_FOUND No malicious content detected during the scan of the object.
• THREATS_FOUND A potential threat has been identified during our comprehensive scanning process.
• UNSUPPORTED The object cannot be scanned by GuardDuty due to a measurement issue.
• ACCESS_DENIED – GuardDuty can’t entry object. Verify permissions.
• FAILED Guard Duty failed to scan the article.

To integrate GuardDuty with Amazon S3 and apply tags to your scanned objects. When using tags, you’ll be able to create insurance policies that prevent objects from being accessed before the malware scan completes, thereby preventing your application from accessing potentially malicious objects.

Establish a secure position that satisfies all necessary authorization protocols.

• EventBridge actions to create and manage a managed rule, enabling Malware Safety for S3 to listen to your events?
• Configure Amazon S3 and Amazon EventBridge actions to send S3 occasion notifications to EventBridge for all occurrences within this specific bucket.
• What triggers Amazon S3 actions to enter the uploaded S3 object and append a preconfigured label to the examined S3 object?
• To facilitate early article entry, consider the following key steps: firstly, scan the bucket contents that support DSSE-KMS and SSE-KMS.

To incorporate these permissions, replicate the coverage template and believe relationship template for subsequent integration. These templates contain placeholder values that should be replaced with relevant data specific to your bucket and AWS account. You must also substitute the **$AWS_KMS_KEY_ID** for the AWS KMS key ID.

Selecting this button will open the AWS Identity and Access Management (IAM) console in a brand-new tab. You can choose to either create a new IAM role or update an existing IAM role by mapping its permissions using the copied templates. To create or replace an IAM position upfront, navigate to the relevant section within the AWS documentation.

Select the GuardDuty browser tab with the IAM console open, then choose your recently created or updated IAM role.

Within the designated safety column, you will note the details for this secured container.

Here are the GuardDuty findings related to your S3 bucket: Upon identifying the discovery of a suspicious type, namely Object:S3/MaliciousFile, AWS GuardDuty has identified the specified S3 object as malicious. Observe the really useful remediation steps within the selected particulars panel. To learn more, refer to the comprehensive resources available within the Amazon Web Services (AWS) documentation.

You can enable GuardDuty Malware Protection for S3 buckets without GuardDuty being enabled on your AWS account. Despite allowing GuardDuty access in your account, it is essential to enable comprehensive monitoring by utilizing key logging mechanisms, including administrative event logs, Flow Logs, and DNS query logs, in conjunction with malware detection capabilities. Safety findings can be dispatched to designated personnel for further investigation.

GuardDuty can scan records data belonging to the following synchronized storage options: S3 Standard, S3 Intelligent-Tiering, S3 Standard-Infrequent Access, S3 One Zone-Infrequent Access, and Amazon S3 Glacier Instant Retrieval. The software can scan files to detect and identify file codecs that may potentially harbour or contain malware, allowing for swift and effective mitigation of potential threats. At launch, our technology enables file sizes up to 5 gigabytes, while archived data can accommodate up to five tiers and a staggering 1,000 files per tier upon decompression.

GuardDuty will automatically send scanning metrics to your Amazon EventBridge for each protected S3 bucket, providing real-time insights into potential security threats and allowing for swift incident response. You can configure alarms and define subsequent scan actions, such as labeling the file or moving it to a quarantine repository. To learn more about various monitoring options, such as metrics and S3 object tagging, refer to the AWS documentation for additional information.

Amazon GuardDuty’s malware detection capabilities are currently available globally, with the exception of China regions and US GovCloud areas.

Pricing is based on the volume of gigabytes (GB) processed and the number of unique objects evaluated within a 30-day period.

This characteristic comes with a restricted AWS Free Tier, which includes 1,000 requests and 1 GB per month, subject to terms, applicable for the first 12 months of account creation for new AWS accounts, or until June 11, 2025, for existing AWS accounts. Wanting to learn more? Visit our website for additional guidance!

Amazon S3 provides advanced security features, including GuardDuty malware protection, to safeguard sensitive data stored in buckets.

To ensure the integrity of your S3 bucket, implement the following measures:

1. Enable GuardDuty: In the AWS Management Console, navigate to the GuardDuty dashboard and toggle the switch to “Enabled”. This will activate real-time threat detection and alerts for potential malware infections.

2. Configure S3 Bucket Policies: Set restrictive policies on your S3 buckets using Amazon S3 bucket-level permissions. Limit access to specific users or roles by specifying IP addresses, geolocation, or time ranges.

3. Utilize Amazon S3 Block Public Access: By default, public access is disabled for new buckets. Ensure that this setting remains in place by configuring the “Block Public Access” feature to prevent unintended exposure of your data.

4. Monitor Bucket Activity: Keep a close eye on bucket activity and logs using Amazon CloudWatch. This will allow you to identify unusual patterns or potential security threats, enabling swift action to mitigate any issues.

5. Implement Encryption: Ensure that all sensitive data stored in S3 buckets is encrypted at rest using Amazon S3 encryption. This can be done by configuring the “Server-Side Encryption” feature during bucket creation.

6. Utilize IAM Role-Based Access Control (RBAC): Define and manage role-based access control for your AWS users and roles to ensure that only authorized personnel can interact with your S3 buckets.

7. Limit Bucket Permissions: Restrict permissions on your S3 buckets by limiting the actions that users or roles can perform, such as listing, reading, writing, or deleting bucket contents.

8. Utilize Amazon S3 Versioning: Enable versioning for critical buckets to maintain a history of changes and prevent accidental overwrite or deletion of important data.

9. Conduct Regular Security Audits: Periodically review and audit your S3 bucket configurations, access controls, and security settings to identify potential vulnerabilities and strengthen your overall security posture.

By following these best practices, you can significantly reduce the risk of malware infections and ensure the safety and integrity of your Amazon S3 buckets. For additional information, visit the website and submit your shipping suggestions through the portal or contact your standard Amazon Web Services (AWS) support channels directly.

—

We updated the screenshot to ensure malware safety for S3 buckets and added hyperlinks to relevant AWS documentation.