Questions on the features

[sumort]

Hi a bit of a newbie here. I just had a few questions about this project if thats okay:

1. Is it possible to delete the files that are infected instead of just tagging them?
2. Is it possible to receive notifications after a file is marked infected? I tried to configure an SNS topic as a destination but it didnt seem to return anything for the SNS topic to use.

Any info on this would be super helpful. Thank you in advance!

[dontirun]

Which destination are you using? If configure the OnResult property you could have something like a lambda function that deletes the infected file

[sumort]

Hi apologies on the late revert but yeah I tried this. But there are a few issues:

1. OnFailure event only triggers events with error i think .OnSuccess can fire notifications (I used SNS) for both CLEAN and INFECTED files, so I dont really want to get CLEAN files deleted. Is it possible to make it so that INFECTED files trigger an OnFailure event on Lambda?

2. I tried to use SNS to trigger OnSuccess events (mainly for INFECTED files) just to test the function I created to delete the s3 objects in JS. Ideally, we would like a way to have email notifs + delete the file after its been labelled as infected but the event i get is formatted like this

{
    "Records": [
        {
            "EventSource": "aws:sns",
            "EventVersion": "1.0",
            "EventSubscriptionArn": "arn:aws:sns:us-east-1:XXXXXXXXXXXXXXXXXXXXXXXXXXX",
            "Sns": {
                "Type": "Notification",
                "MessageId": "5bffbf4e-6d54-5eeb-831b-XXXXXXXXXXXXXXXX",
                "TopicArn": "arn:aws:sns:us-east-1:XXXXXXXXXXXXXX:xxxxBucketAVTopic",
                "Subject": null,
                "Message": "{\"version\":\"1.0\",\"timestamp\":\"2022-09-02T17:15:30.847Z\",\"requestContext\":{\"requestId\":\"XXXXXXXXXXXXXXXXXXXXXXXXX\",\"functionArn\":\"arn:aws:lambda:us-east-1:XXXXXXXXXXXXXX:function:xxxx-ClamavServerlessStack-rClamscanServerlessClams-XXXXXXXXXXX:$LATEST\",\"condition\":\"Success\",\"approximateInvokeCount\":1},\"requestPayload\":{\"Records\":[{\"eventVersion\":\"2.1\",\"eventSource\":\"aws:s3\",\"awsRegion\":\"us-east-1\",\"eventTime\":\"2022-09-02T17:15:04.160Z\",\"eventName\":\"ObjectCreated:Put\",\"userIdentity\":{\"principalId\":\"AWS:XXXXXXXXXXXXXXXXXXXX\"},\"requestParameters\":{\"sourceIPAddress\":\"XXXXXXXXXXXXXXXXX\"},\"responseElements\":{\"x-amz-request-id\":\"4J4H39ZJ75A061FG\",\"x-amz-id-2\":\"oRC3pF5ZEXWXXXXXXXXXXzfv2royS5PkIXXXXXXXXXXXXXXXXX4gHjC65Fh0LHzDtaVdeou25PXDtjQkr37Vy\"},\"s3\":{\"s3SchemaVersion\":\"1.0\",\"configurationId\":\"arn:aws:cloudformation:us-east-1:XXXXXXXXXXXXXX:stack/xxxx-ClamavServerlessStack/XXXXXXXXXXXX-286e-11ed-bdb2-XXXXXXXXXXX--XXXXXXXXXXXX\",\"bucket\":{\"name\":\"test-bucket-clamav\",\"ownerIdentity\":{\"principalId\":\"XXXXXXXXXXXX\"},\"arn\":\"arn:aws:s3:::test-bucket-clamav\"},\"object\":{\"key\":\"test.txt\",\"size\":68,\"eTag\":\"44d88612fea8a8f36de82e1278abb02f\",\"versionId\":\"Jnctl2LoSyd4Mbbmv94EEleX_Fy8Xxh9\",\"sequencer\":\"0063123A181CDB2BE6\"}}}]},\"responseContext\":{\"statusCode\":200,\"executedVersion\":\"$LATEST\"},\"responsePayload\":{\"source\": \"serverless-clamscan\", \"input_bucket\": \"test-bucket-clamav\", \"input_key\": \"test.txt\", \"status\": \"INFECTED\", \"message\": \"Scanning /mnt/lambda/5824ac1d-417c-4132-aa1c-xxxxxxxxxxxxxxx/test.txt\\n/mnt/lambda/5824ac1d-417c-4132-aa1c-xxxxxxxxxxxxxxx/test.txt: Win.Test.EICAR_HDB-1 FOUND\\n\\n----------- SCAN SUMMARY -----------\\nKnown viruses: 8632242\\nEngine version: 0.103.7\\nScanned directories: 1\\nScanned files: 1\\nInfected files: 1\\nData scanned: 0.00 MB\\nData read: 0.00 MB (ratio 0.00:1)\\nTime: 24.121 sec (0 m 24 s)\\nStart Date: 2022:09:02 17:15:06\\nEnd Date:   2022:09:02 17:15:30\\n\"}}",
                "Timestamp": "2022-09-02T17:15:30.899Z",
                "SignatureVersion": "1",
                "Signature": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
                "SigningCertUrl": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-XXXXXXXXXXXXXXXXXXXXXXXXXXXX.pem",
                "UnsubscribeUrl": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-1:XXXXXXXXXXXXXXXXXXXXX:xxxxBucketAVTopic:XXXXXXXXXXXXXXXXXXXXXXXXX",
                "MessageAttributes": {}
            }
        }
    ]
}

Which is making the function fail as its not proper JSON. I am a bit new to NodeJs in Lambda so im not sure if there is a way to format the message in JSON. Is there a way you can recommend here as well?

Thank youuu

[dontirun]

If you're using NodeJs you can use the Javascript JSON.parse() method on the Message attribute

[dontirun]

OnFailure event only triggers events with error i think .OnSuccess can fire notifications (I used SNS) for both CLEAN and INFECTED files, so I dont really want to get CLEAN files deleted. Is it possible to make it so that INFECTED files trigger an OnFailure event on Lambda?

No, the OnFailure parameter is for only when the Lambda function encounters an error. If you parse the Message attribute into JSON there is a nested status attribute which you can use to identify if it is CLEAN or INFECTED

[sumort]

Thanks I will try this. Also, is there a way to auto delete the images that are built upon cdk deploy? I dont think they get deleted along with the stack, not sure if I missed something.

[dontirun]

Unfortunately I am unaware of any way to auto delete the old assets that are created with a CDK deploy