Amazon Web Services (AWS) has recently made an exciting announcement regarding the general availability of Amazon GuardDuty Malware Protection for Amazon Simple Storage Service (Amazon S3). This innovative new feature is set to revolutionize cloud storage security by expanding GuardDuty Malware Protection to detect malicious file uploads to selected S3 buckets.

Previously, GuardDuty Malware Protection offered agentless scanning capabilities to identify malicious files on Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon Elastic Compute Cloud (Amazon EC2) and container workloads. However, with this new update, AWS customers can now leverage this feature to continuously evaluate new objects uploaded to S3 buckets for malware, providing an added layer of security.

Amazon GuardDuty Malware Protection utilizes multiple AWS-developed and industry-leading third-party malware scanning engines to ensure malware detection without compromising the scale, latency, and resiliency profile of Amazon S3. This managed solution effectively eliminates operational complexity and cost overhead associated with automating malicious file evaluation at scale.

With GuardDuty Malware Protection now available for Amazon S3, development and security teams can collaborate to configure and oversee malware protection throughout their organization. This is particularly beneficial for select buckets where newly uploaded data from untrusted entities needs to be scanned for malware. Users can configure post-scan actions in GuardDuty, such as object tagging, to streamline downstream processing and utilize the scan status information provided through Amazon EventBridge to isolate any malicious uploaded objects.

To enable GuardDuty Malware Protection for an S3 bucket, users must create and attach an AWS Identity and Access Management (IAM) role with the necessary permissions. These permissions include EventBridge actions, Amazon S3 and EventBridge actions, and AWS Key Management Service (AWS KMS) key actions. Once the IAM role is set up, users can activate the protection in the GuardDuty console, where they can monitor S3 malware findings associated with their scanned S3 bucket and follow recommended remediation steps if a malicious file is detected.

It is important to note that GuardDuty Malware Protection for S3 buckets can be configured even without GuardDuty enabled for the AWS account. However, enabling GuardDuty provides comprehensive monitoring of foundational sources like AWS CloudTrail management events, Amazon Virtual Private Cloud (Amazon VPC) Flow Logs, DNS query logs, and malware protection features. Additionally, security findings can be sent to AWS Security Hub and Amazon Detective for further investigation.

Amazon GuardDuty Malware Protection for Amazon S3 is now generally available in all AWS Regions where GuardDuty is accessible, except for China Regions and GovCloud (US) Regions. Pricing for this feature is based on the GB volume of objects scanned and the monthly number of objects evaluated. An AWS Free Tier is available, offering 1,000 requests and 1 GB each month for the first 12 months of account creation for new AWS accounts or until June 11, 2025, for existing AWS accounts.

In conclusion, the introduction of Amazon GuardDuty Malware Protection for Amazon S3 marks a significant advancement in cloud storage security, providing users with enhanced malware detection capabilities and simplified security management tools to protect their data effectively. This new feature underscores AWS’s commitment to innovation and ensuring the highest level of security for its customers.

Source link