Skip to content

Automatic deployment of serverless aws s3 bucket antivirus scanner using terraform

License

Notifications You must be signed in to change notification settings

gchamon/terraform-aws-bucket-antivirus

Repository files navigation

AWS S3 Bucket Antivirus Scanner

Deprecation notice: the original bucket-antivirus-function repo has its own official cloudformation stack. It is advisable to use that instead. Sometime in the future I will rewrite this module to use the official stack directly, wrapping it in terraform, if it hasn't been done already.

Used to create lambda functions prepared to scan buckets for viruses. Two functions are created, one namely to scan the uploads, and another that runs periodically to update the antivirus definitions.

The deployed function is based on bucket-antivirus-function. All due credits to the original developers, as this project aims only to document the required infrastructure using terraform.

Pre-requisites

  • git
  • docker
  • run docker commands without sudo
  • enough space and permissions to use /tmp to compile the lambda code

Usage

module "antivirus" {
  source = "gchamon/bucket-antivirus/aws"

  buckets-to-scan = [
    aws_s3_bucket.test.bucket
  ]

  scanner-environment-variables = {
    AV_DELETE_INFECTED_FILES = "True"
  }
  
  allow-public-access = true
}

Terraform version

Developed using version 0.12.9. Should work on 0.12.x

Examples

Test file scan and deletion - Detailed instructions in the example's readme

Input variables

Name Description Type Default Required
buckets-to-scan List of bucket names to be scanned by the antivirus list(string) - yes
scanner-environment-variables Custom environment variables for the scanner function map(string) {} no
updater-environment-variables Custom environment variables for the definitions update function map(string) {} no
antivirus-lambda-code Optional argument to provide precompiled zip file containing the lambda code, skipping the built in compilation process string null no
allow-public-access If true, contents of the bucket in which the antivirus definitions are saved will be public. Good for sharing the same definitions across multiple accounts bool false no
antivirus-update-rate Configures the antivirus update rate. Syntax is the same of cloudwatch rate schedule expression for rules string "3 hours" no

Output variables

Name Description
definitions-bucket The bucket created to store de antivirus definitions
scanner-function The created scanner function resource
update-function The created definitions update function resource
scanner-function-role The role used by the scanner function
update-function-role The role used by the definitions update function
scanner-function-policy The policy attached to the scanner function role
scanner-function-policy The policy attached to the definitions update function role

About

Automatic deployment of serverless aws s3 bucket antivirus scanner using terraform

Resources

License

Stars

Watchers

Forks

Packages

No packages published