Construct Hub

An aws-cdk construct that uses ClamAV® . to scan objects in Amazon S3 for viruses. The construct provides a flexible interface for a system to act based on the results of a ClamAV virus scan.

The construct creates a Lambda function with EFS integration to support larger files. A VPC with isolated subnets, a S3 Gateway endpoint will also be created.

Additionally creates an twice-daily job to download the latest ClamAV definition files to the Virus Definitions S3 Bucket by utilizing an EventBridge rule and a Lambda function and publishes CloudWatch Metrics to the 'serverless-clamscan' namespace.

Important O&M: When ClamAV publishes updates to the scanner you will see “Your ClamAV installation is OUTDATED” in your scan results. While the construct creates a system to keep the database definitions up to date, you must update the scanner to detect all the latest Viruses.

Update the docker images of the Lambda functions with the latest version of ClamAV by re-running cdk deploy.

Successful Scan Event format

{
    "source": "serverless-clamscan",
    "input_bucket": <input_bucket_name>,
    "input_key": <object_key>,
    "status": <"CLEAN"|"INFECTED"|"N/A">,
    "message": <scan_summary>,
  }

Note: The Virus Definitions bucket policy will likely cause a deletion error if you choose to delete the stack associated in the construct. However since the bucket itself gets deleted, you can delete the stack again to resolve the error.

import cdk_serverless_clamscan

cdk_serverless_clamscan.ServerlessClamscan(
  scope: Construct,
  id: str,
  accept_responsibility_for_using_imported_bucket: bool = None,
  buckets: typing.List[IBucket] = None,
  defs_bucket_access_logs_config: ServerlessClamscanLoggingProps = None,
  efs_encryption: bool = None,
  efs_performance_mode: PerformanceMode = None,
  on_error: IDestination = None,
  on_result: IDestination = None,
  reserved_concurrency: typing.Union[int, float] = None,
  scan_function_memory_size: typing.Union[int, float] = None
)

• Type: Construct

The parent creating construct (usually this).

• Type: str

The construct's name.

• Type: bool

Allows the use of imported buckets.

When using imported buckets the user is responsible for adding the required policy statement to the bucket policy: getPolicyStatementForBucket() can be used to retrieve the policy statement required by the solution.

• Type: typing.List[IBucket]

An optional list of S3 buckets to configure for ClamAV Virus Scanning;

buckets can be added later by calling addSourceBucket.

• Type: ServerlessClamscanLoggingProps

Whether or not to enable Access Logging for the Virus Definitions bucket, you can specify an existing bucket and prefix (Default: Creates a new S3 Bucket for access logs).

• Type: bool

Whether or not to enable encryption on EFS filesystem (Default: enabled).

• Type: PerformanceMode

Set the performance mode of the EFS file system (Default: GENERAL_PURPOSE).

• Type: IDestination

The Lambda Destination for files that fail to scan and are marked 'ERROR' or stuck 'IN PROGRESS' due to a Lambda timeout (Default: Creates and publishes to a new SQS queue if unspecified).

• Type: IDestination

The Lambda Destination for files marked 'CLEAN' or 'INFECTED' based on the ClamAV Virus scan or 'N/A' for scans triggered by S3 folder creation events marked (Default: Creates and publishes to a new Event Bridge Bus if unspecified).

• Type: typing.Union[int, float]

Optionally set a reserved concurrency for the virus scanning Lambda.

https://docs.aws.amazon.com/lambda/latest/operatorguide/reserved-concurrency.html

• Type: typing.Union[int, float]

Optionally set the memory allocation for the scan function.

Note that low memory allocations may cause errors. (Default: 10240).

https://docs.aws.amazon.com/lambda/latest/operatorguide/computing-power.html

def to_string() -> str

Returns a string representation of this construct.

def add_source_bucket(
  bucket: IBucket
) -> None

Sets the specified S3 Bucket as a s3:ObjectCreate* for the ClamAV function.

Grants the ClamAV function permissions to get and tag objects. Adds a bucket policy to disallow GetObject operations on files that are tagged 'IN PROGRESS', 'INFECTED', or 'ERROR'.

• Type: IBucket

The bucket to add the scanning bucket policy and s3:ObjectCreate* trigger to.

def get_policy_statement_for_bucket(
  bucket: IBucket
) -> PolicyStatement

Returns the statement that should be added to the bucket policy in order to prevent objects to be accessed when they are not clean or there have been scanning errors: this policy should be added manually if external buckets are passed to addSourceBucket().

• Type: IBucket

The bucket which you need to protect with the policy.

import cdk_serverless_clamscan

cdk_serverless_clamscan.ServerlessClamscan.is_construct(
  x: typing.Any
)

Checks if x is a construct.

Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

• Type: typing.Any

Any object.

node: Node

• Type: Node

The tree node.

error_dest: IDestination

• Type: IDestination

The Lambda Destination for failed on erred scans [ERROR, IN PROGRESS (If error is due to Lambda timeout)].

result_dest: IDestination

• Type: IDestination

The Lambda Destination for completed ClamAV scans [CLEAN, INFECTED].

scan_assumed_principal: ArnPrincipal

• Type: ArnPrincipal

clean_rule: Rule

• Type: Rule

Conditional: An Event Bridge Rule for files that are marked 'CLEAN' by ClamAV if a success destination was not specified.

defs_access_logs_bucket: IBucket

• Type: IBucket

Conditional: The Bucket for access logs for the virus definitions bucket if logging is enabled (defsBucketAccessLogsConfig).

error_dead_letter_queue: Queue

• Type: Queue

Conditional: The SQS Dead Letter Queue for the errorQueue if a failure (onError) destination was not specified.

error_queue: Queue

• Type: Queue

Conditional: The SQS Queue for erred scans if a failure (onError) destination was not specified.

infected_rule: Rule

• Type: Rule

Conditional: An Event Bridge Rule for files that are marked 'INFECTED' by ClamAV if a success destination was not specified.

result_bus: EventBus

• Type: EventBus

Conditional: The Event Bridge Bus for completed ClamAV scans if a success (onResult) destination was not specified.

use_imported_buckets: bool

• Type: bool

Conditional: When true, the user accepted the responsibility for using imported buckets.