Enabling S3 Malware Protection

Overview

Malware Protection for S3 allows you to scan objects in S3 buckets for malware. This feature can be enabled through the GuardDuty console or API/CLI. You must first set up an IAM role with the appropriate permissions to let GuardDuty perform scans and, optionally, tag scanned objects.

Ensure to Enable GuardDuty within your enviroment otherwise S3 Malware Protection will not generate.

Using the GuardDuty Console:

1. Enter S3 Bucket Details:

   • Navigate to Malware Protection for S3 in the GuardDuty console.

   • Select the AWS Region and enter the bucket name or browse to select the S3 bucket.

   • Choose whether to scan all objects or limit scans to specific prefixes (up to 5 prefixes).

2. Enable Optional Tagging:

   • Enable object tagging to assign a predefined tag (GuardDutyMalwareScanStatus) with scan results like:

     • NO_THREATS_FOUND

     • THREATS_FOUND

     • ACCESS_DENIED

   • Tagging allows integration with tag-based access control (TBAC) policies to manage malicious objects.

3. Choose the IAM Role:

   • Assign an IAM role with the required permissions for malware scanning and optional tagging.

   • Update the role if using it across multiple buckets.

   • Ensure the trust relationship policy is configured correctly for the role.

4. Tagging the Malware Protection Plan (Optional):

   • Add up to 50 tags to the Malware Protection plan resource, if needed.

   • Tags are case-sensitive and help manage resources efficiently.

5. Enable Protection:

   • After configuring all settings, click Enable to protect the bucket.

Using API/CLI to Enable Malware Protection:

1. Prerequisites: Ensure you have created an IAM role ARN with the required permissions.

2. API Example: Use the CreateMalwareProtectionPlan API to enable Malware Protection for an S3 bucket.

3. CLI Commands:

Basic Command without Tagging:

aws guardduty create-malware-protection-plan \
  --role "arn:aws:iam::111122223333:role/role-name" \
  --protected-resource "S3Bucket"={"BucketName"="amzn-s3-demo-bucket1"}

With Specific Prefixes:

aws guardduty create-malware-protection-plan \
  --role "arn:aws:iam::111122223333:role/role-name" \
  --protected-resource '{"S3Bucket":{"BucketName":"amzn-s3-demo-bucket1", "ObjectPrefixes": ["Object1","Object2"]}}'

With Tagging Enabled:

aws guardduty create-malware-protection-plan \
  --role "arn:aws:iam::111122223333:role/role-name" \
  --protected-resource "S3Bucket"={"BucketName"="amzn-s3-demo-bucket1"} \
  --actions "Tagging"={"Status"="ENABLED"}

Plan ID: A Malware Protection plan ID will be generated for further actions, like updates or disabling the protection.

Considerations for Successful Setup:

• Tag Limits: If an object already has 10 tags, GuardDuty cannot add another tag.

• IAM Role Permissions: Ensure the IAM role has permissions to scan objects and apply tags.

• EventBridge Integration: Scan results are also published to the default EventBridge event bus and CloudWatch for monitoring.