terraform-aws-s3-anti-virus

Creates an AWS Lambda function to do anti-virus scanning of objects in AWS S3 using bucket-antivirus-function

While waiting for updates on that repo you will need to use a special fork and branch:

git clone [email protected]:upsidetravel/bucket-antivirus-function.git
cd bucket-antivirus-function
git checkout v2.0.0

With that repo checked out you must run the make command and then copy the resulting zip file to AWS S3 with:

VERSION=2.0.0
aws s3 cp bucket-antivirus-function/build/lambda.zip "s3://lambda-builds-us-west-2/anti-virus/${VERSION}/anti-virus.zip"

NOTE: It is a good idea to make VERSION match the git tag you are deploying.

Creates the following resources for anti-virus updates:

• IAM role for Lambda function to update Anti-Virus databases in S3
• CloudWatch Event to trigger function on a schedule.
• AWS Lambda function to download Anti-Virus databases files to S3

Creates the following resources for anti-virus scanning:

• IAM role for Lambda function to scan files in S3
• S3 Event to trigger function on object creation
• AWS Lambda function to scan S3 object and send alert to slack if any objects are infected and quarantined.

Terraform Versions

Terraform 0.12. Pin module version to ~> 2.0.0. Submit pull-requests to master branch.

Terraform 0.11. Pin module version to ~> 1.1.1. Submit pull-requests to terraform011 branch.

Usage

module "s3_anti_virus" {
  source = "trussworks/s3-anti-virus/aws"
  version = "2.1.2"

  name_scan   = "s3-anti-virus-scan"
  name_update = "s3-anti-virus-updates"

  lambda_s3_bucket = "lambda-builds-us-west-2"
  lambda_version   = "2.0.0"
  lambda_package   = "anti-virus"

  av_update_minutes = "180"
  av_scan_buckets   = ["bucket-name"]

  av_definition_s3_bucket   = "av-update-bucket-name"
  av_definition_s3_prefix   = "anti-virus"
  av_scan_start_sns_arn     = "sns-topic-name"
  av_status_sns_arn         = "sns-topic-name"

  tags = {
    "Environment" = "my-environment"
    "Purpose"     = "s3-anti-virus"
    "Terraform"   = "true"
  }
}

Providers

Name	Version
aws	n/a

Inputs

Name	Description	Type	Default	Required
av_definition_s3_bucket	Bucket containing antivirus database files.	string	n/a	yes
av_definition_s3_prefix	Prefix for antivirus database files.	string	"clamav_defs"	no
av_scan_buckets	A list of S3 bucket names to scan for viruses.	list(string)	n/a	yes
av_scan_start_sns_arn	SNS topic ARN to publish notification about start of scan (optional).	string	""	no
av_status_sns_arn	SNS topic ARN to publish scan results (optional).	string	""	no
av_status_sns_publish_clean	Publish AV_STATUS_CLEAN results to AV_STATUS_SNS_ARN.	string	"True"	no
av_status_sns_publish_infected	Publish AV_STATUS_INFECTED results to AV_STATUS_SNS_ARN.	string	"True"	no
av_update_minutes	How often to download updated Anti-Virus databases.	string	180	no
cloudwatch_logs_retention_days	Number of days to keep logs in AWS CloudWatch.	string	90	no
lambda_package	The name of the lambda package. Used for a directory tree and zip file.	string	"anti-virus"	no
lambda_s3_bucket	The name of the S3 bucket used to store the Lambda builds.	string	n/a	yes
lambda_version	The version the Lambda function to deploy.	string	n/a	yes
name_scan	Name for resources associated with anti-virus scanning	string	"s3-anti-virus-scan"	no
name_update	Name for resources associated with anti-virus updating	string	"s3-anti-virus-updates"	no
tags	A map of tags to add to all resources.	map(string)	{}	no

Outputs

Name	Description
scan_aws_cloudwatch_log_group_arn	ARN for the Anti-Virus Scanning Cloudwatch LogGroup.
scan_aws_cloudwatch_log_group_name	The Anti-Virus Scanning Cloudwatch LogGroup name.
scan_lambda_function_arn	ARN for the Anti-Virus Scanning lambda function.
scan_lambda_function_iam_role_arn	Name of the Anti-Virus Scanning lambda role.
scan_lambda_function_iam_role_name	Name of the Anti-Virus Scanning lambda role.
scan_lambda_function_name	The Anti-Virus Scanning lambda function name.
scan_lambda_function_version	Current version of the Anti-Virus Scanning lambda function.
update_aws_cloudwatch_log_group_arn	ARN for the Anti-Virus Definitions Cloudwatch LogGroup.
update_aws_cloudwatch_log_group_name	The Anti-Virus Definitions Cloudwatch LogGroup name.
update_lambda_function_arn	ARN for the Anti-Virus Definitions lambda function.
update_lambda_function_iam_role_arn	ARN of the Anti-Virus Definitions lambda role.
update_lambda_function_iam_role_name	Name of the Anti-Virus Definitions lambda role.
update_lambda_function_name	The Anti-Virus Definitions lambda function name.
update_lambda_function_version	Current version of the Anti-Virus Definitions lambda function.