S3_scan_object

S3_scan_object

Trigger ClamAV scans of newly created S3 objects and updates the object with the scan results. The S3 events are sent to an SQS queue where they are processed by the Scan Files API.

⚠️ Notes

• To use the default values for the following variables, your account must be part of our AWS organization:
  • scan_files_role_arn
  • s3_scan_object_role_arn
• You can build your own Lambda Docker image using the code in cds-snc/scan-files/module/s3-scan-object.

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_policy.scan_files	resource
aws_iam_role.scan_files	resource
aws_iam_role_policy_attachment.scan_files	resource
aws_kms_alias.s3_scan_object_queue	resource
aws_kms_key.s3_scan_object_queue	resource
aws_s3_bucket_notification.s3_scan_object	resource
aws_s3_bucket_policy.upload_bucket	resource
aws_sqs_queue.s3_scan_object	resource
aws_sqs_queue_policy.s3_scan_object	resource
aws_caller_identity.current	data source
aws_iam_policy_document.limit_tagging	data source
aws_iam_policy_document.s3_scan_object	data source
aws_iam_policy_document.s3_scan_object_queue	data source
aws_iam_policy_document.scan_files	data source
aws_iam_policy_document.scan_files_assume_role	data source
aws_iam_policy_document.scan_files_download	data source
aws_iam_policy_document.upload_bucket	data source
aws_iam_role.scan_files	data source

Inputs

Name	Description	Type	Default	Required
billing_tag_key	(Optional, default 'CostCentre') The name of the billing tag	string	"CostCentre"	no
billing_tag_value	(Required) The value of the billing tag	string	n/a	yes
s3_scan_object_role_arn	(Optional, default S3 Scan Object role) S3 scan object lambda execution role ARN	string	"arn:aws:iam::806545929748:role/s3-scan-object"	no
s3_upload_bucket_names	(Required) Names of the existing S3 upload bucket to scan objects in.	list(string)	n/a	yes
s3_upload_bucket_policy_create	(Optional, defaut 'true') Create the S3 upload bucket policy to allow Scan Files access.	bool	true	no
scan_files_assume_role_create	(Optional, default 'true') Create the IAM role that Scan Files assumes. Defaults to true. If this is set to false, it is assumed that the role already exists in the account.	bool	true	no
scan_files_role_arn	(Optional, default Scan Files API role) Scan Files lambda execution role ARN	string	"arn:aws:iam::806545929748:role/scan-files-api"	no

Outputs

Name	Description
scan_files_assume_role_arn	ARN of the role assumed by the Scan Files API