Architecture of Serverless ClamScan - To Include Quarantine Bucket and Clean Bucket

[chaiguowei]

Hi,
I am new to this entire cdk-serverless-clamscan solution, managed to set it up in one of my Sandbox AWS account last week.
I have a few questions that I need further clarification or feedback:

#1: Do we have a deployment for this solution to include (1) Clean Bucket and (2) Quarantine Bucket?

• For instance, once the Lambda ClamAV is triggered and completed the scanning, all the uninfected files will be moved from the Scanned Bucket to the (1) Clean Bucket: Accessible for usage
• All the infected files will be moved from the Scanned Bucket to the (2) Quarantine Bucket: Isolate/Quarantine, not accessible for usage

#2: Do we have a clear illustration of the IAM permission/policy that is required for the IAM User/Role that is used to deploy the solution?