Skip to content

Commit 41674ff

Browse files
hupe1980hupe1980
committed
Misc
1 parent ba89247 commit 41674ff

File tree

8 files changed

+28
-20
lines changed

8 files changed

+28
-20
lines changed

‎examples/s3-antivurs-example/src/s3-antivirus-stack.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ export class S3AntivirusStack extends Stack {
1515
removalPolicy: RemovalPolicy.DESTROY,
1616
});
1717

18-
const topic = new Topic(this, 'Topic', {});
18+
const topic = new Topic(this, 'Topic');
1919
topic.addSubscription(new EmailSubscription(process.env.DEVSECOPS_TEAM_EMAIL as string));
2020

2121
const scanner = new Scanner(this, 'Scanner', {

‎packages/cdk-s3-antivirus/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ export class S3AntivirusStack extends Stack {
4242
removalPolicy: RemovalPolicy.DESTROY,
4343
});
4444

45-
const topic = new Topic(this, 'Topic', {});
45+
const topic = new Topic(this, 'Topic');
4646
topic.addSubscription(new EmailSubscription(process.env.DEVSECOPS_TEAM_EMAIL as string));
4747

4848
const scanner = new Scanner(this, 'Scanner', {

‎packages/cdk-s3-antivirus/lambda-file-sizes.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
[{"timestamp":1622414583614,"files":[{"filename":"scan/index.js","previous":80402,"size":80409,"diff":7},{"filename":"update/index.js","previous":80108,"size":80116,"diff":8}]},{"timestamp":1622413457296,"files":[{"filename":"scan/index.js","previous":80399,"size":80402,"diff":3},{"filename":"update/index.js","previous":80105,"size":80108,"diff":3}]},{"timestamp":1622412958546,"files":[{"filename":"scan/index.js","previous":80391,"size":80399,"diff":8},{"filename":"update/index.js","previous":80098,"size":80105,"diff":7}]},{"timestamp":1622412248030,"files":[{"filename":"scan/index.js","previous":80407,"size":80391,"diff":-16},{"filename":"update/index.js","previous":80114,"size":80098,"diff":-16}]},{"timestamp":1622411844731,"files":[{"filename":"scan/index.js","previous":80407,"size":80407,"diff":0},{"filename":"update/index.js","previous":80099,"size":80114,"diff":15}]},{"timestamp":1622401380707,"files":[{"filename":"scan/index.js","previous":80395,"size":80407,"diff":12},{"filename":"update/index.js","previous":80087,"size":80099,"diff":12}]},{"timestamp":1622400877967,"files":[{"filename":"scan/index.js","previous":34900,"size":80395,"diff":45495},{"filename":"update/index.js","previous":34571,"size":80087,"diff":45516}]},{"timestamp":1622396775879,"files":[{"filename":"scan/index.js","previous":34893,"size":34900,"diff":7},{"filename":"update/index.js","previous":34563,"size":34571,"diff":8}]},{"timestamp":1622396681245,"files":[{"filename":"scan/index.js","previous":34893,"size":34893,"diff":0},{"filename":"update/index.js","previous":34854,"size":34563,"diff":-291}]},{"timestamp":1622396649924,"files":[{"filename":"scan/index.js","previous":34893,"size":34893,"diff":0},{"filename":"update/index.js","previous":34853,"size":34854,"diff":1}]},{"timestamp":1622366115062,"files":[{"filename":"scan/index.js","previous":34891,"size":34893,"diff":2},{"filename":"update/index.js","previous":34852,"size":34853,"diff":1}]},{"timestamp":1622363715555,"files":[{"filename":"clamscan/index.js","previous":1084,"size":0,"diff":-1084},{"filename":"freshclam/index.js","previous":1090,"size":0,"diff":-1090},{"filename":"scan/index.js","previous":0,"size":34891,"diff":34891},{"filename":"update/index.js","previous":0,"size":34852,"diff":34852}]},{"timestamp":1622288885756,"files":[{"filename":"clamscan/index.js","previous":0,"size":1084,"diff":1084},{"filename":"freshclam/index.js","previous":0,"size":1090,"diff":1090}]}]
1+
[{"timestamp":1622437372220,"files":[{"filename":"scan/index.js","previous":80409,"size":80411,"diff":2},{"filename":"update/index.js","previous":80116,"size":80116,"diff":0}]},{"timestamp":1622414583614,"files":[{"filename":"scan/index.js","previous":80402,"size":80409,"diff":7},{"filename":"update/index.js","previous":80108,"size":80116,"diff":8}]},{"timestamp":1622413457296,"files":[{"filename":"scan/index.js","previous":80399,"size":80402,"diff":3},{"filename":"update/index.js","previous":80105,"size":80108,"diff":3}]},{"timestamp":1622412958546,"files":[{"filename":"scan/index.js","previous":80391,"size":80399,"diff":8},{"filename":"update/index.js","previous":80098,"size":80105,"diff":7}]},{"timestamp":1622412248030,"files":[{"filename":"scan/index.js","previous":80407,"size":80391,"diff":-16},{"filename":"update/index.js","previous":80114,"size":80098,"diff":-16}]},{"timestamp":1622411844731,"files":[{"filename":"scan/index.js","previous":80407,"size":80407,"diff":0},{"filename":"update/index.js","previous":80099,"size":80114,"diff":15}]},{"timestamp":1622401380707,"files":[{"filename":"scan/index.js","previous":80395,"size":80407,"diff":12},{"filename":"update/index.js","previous":80087,"size":80099,"diff":12}]},{"timestamp":1622400877967,"files":[{"filename":"scan/index.js","previous":34900,"size":80395,"diff":45495},{"filename":"update/index.js","previous":34571,"size":80087,"diff":45516}]},{"timestamp":1622396775879,"files":[{"filename":"scan/index.js","previous":34893,"size":34900,"diff":7},{"filename":"update/index.js","previous":34563,"size":34571,"diff":8}]},{"timestamp":1622396681245,"files":[{"filename":"scan/index.js","previous":34893,"size":34893,"diff":0},{"filename":"update/index.js","previous":34854,"size":34563,"diff":-291}]},{"timestamp":1622396649924,"files":[{"filename":"scan/index.js","previous":34893,"size":34893,"diff":0},{"filename":"update/index.js","previous":34853,"size":34854,"diff":1}]},{"timestamp":1622366115062,"files":[{"filename":"scan/index.js","previous":34891,"size":34893,"diff":2},{"filename":"update/index.js","previous":34852,"size":34853,"diff":1}]},{"timestamp":1622363715555,"files":[{"filename":"clamscan/index.js","previous":1084,"size":0,"diff":-1084},{"filename":"freshclam/index.js","previous":1090,"size":0,"diff":-1090},{"filename":"scan/index.js","previous":0,"size":34891,"diff":34891},{"filename":"update/index.js","previous":0,"size":34852,"diff":34852}]},{"timestamp":1622288885756,"files":[{"filename":"clamscan/index.js","previous":0,"size":1084,"diff":1084},{"filename":"freshclam/index.js","previous":0,"size":1090,"diff":1090}]}]

‎packages/cdk-s3-antivirus/package.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@
1919
"keywords": [
2020
"aws",
2121
"cdk",
22-
"elasticsearch",
23-
"cognito",
24-
"kinana",
22+
"clamav",
23+
"antivirus",
24+
"s3",
2525
"@cloudcomponents"
2626
],
2727
"main": "lib/index.js",

‎packages/cdk-s3-antivirus/src/lambdas/scan/index.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import { AntiVirus, ScanResult } from '../shared/anti-virus';
55

66
const antiVirus = new AntiVirus({
77
definitionsPath: path.join(process.env.EFS_MOUNT_PATH as string, process.env.EFS_DEFINITIONS_PATH as string),
8+
scanStatusTagName: process.env.SCAN_STATUS_TAG_NAME as string,
89
});
910

1011
export const handler = async (event: S3CreateEvent, context: Context): Promise<ScanResult> => {
@@ -15,5 +16,6 @@ export const handler = async (event: S3CreateEvent, context: Context): Promise<S
1516
const downloadPath = path.join(process.env.EFS_MOUNT_PATH as string, context.awsRequestId);
1617

1718
await antiVirus.updateDefinitions([`PrivateMirror ${mirror}`]);
19+
1820
return antiVirus.scan(bucket, key, downloadPath);
1921
};

‎packages/cdk-s3-antivirus/src/lambdas/shared/anti-virus.ts

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,15 @@ const FRESHCLAM_CONF = '/tmp/freshclam.conf';
99
const REG_EXP = new RegExp('\\w+.c[vl]d');
1010

1111
export interface ScanResult {
12-
bucket: string;
13-
key: string;
14-
status: ScanStatus;
15-
message: string;
12+
readonly bucket: string;
13+
readonly key: string;
14+
readonly status: ScanStatus;
15+
readonly message: string;
1616
}
1717

1818
export interface AntiVirusOptions {
19-
definitionsPath: string;
19+
readonly definitionsPath: string;
20+
readonly scanStatusTagName: string;
2021
}
2122

2223
export class AntiVirus {
@@ -40,11 +41,7 @@ export class AntiVirus {
4041
args.push(os.userInfo().username);
4142
args.push(`--datadir=${this.options.definitionsPath}`);
4243

43-
const result = await execa('/opt/clamav/freshclam', args);
44-
45-
if (result.exitCode != 0) {
46-
throw new Error(`freshclam exited with unexpected exit code: ${result.exitCode}`);
47-
}
44+
await execa('/opt/clamav/freshclam', args);
4845
}
4946

5047
public async scan(bucket: string, key: string, scanPath: string): Promise<ScanResult> {
@@ -129,7 +126,7 @@ export class AntiVirus {
129126
Tagging: {
130127
TagSet: [
131128
{
132-
Key: 'cc:scan-status',
129+
Key: this.options.scanStatusTagName,
133130
Value: status,
134131
},
135132
],

‎packages/cdk-s3-antivirus/src/lambdas/update/index.ts

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import { AntiVirus } from '../shared/anti-virus';
44

55
const antiVirus = new AntiVirus({
66
definitionsPath: '/tmp',
7+
scanStatusTagName: process.env.SCAN_STATUS_TAG_NAME as string,
78
});
89

910
export const handler = async (_event: ScheduledEvent, _context: Context): Promise<void> => {
@@ -12,6 +13,4 @@ export const handler = async (_event: ScheduledEvent, _context: Context): Promis
1213
await antiVirus.downloadDefinitions(bucket);
1314
await antiVirus.updateDefinitions([`DNSDatabaseInfo current.cvd.clamav.net`, `DatabaseMirror database.clamav.net`, `CompressLocalDatabase yes`]);
1415
await antiVirus.uploadDefinitions(bucket);
15-
16-
return;
1716
};

‎packages/cdk-s3-antivirus/src/scanner.ts

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,23 @@ export interface ScannerProps {
1717
readonly onResult?: IDestination;
1818
readonly onError?: IDestination;
1919
readonly updateSchedule?: Schedule;
20+
/**
21+
* @default cc:scan-status
22+
*/
23+
readonly scanStatusTagName?: string;
2024
}
2125

2226
export class Scanner extends Construct {
2327
public readonly scanFunction: IFunction;
2428
public readonly updateFunction: IFunction;
2529
public readonly sandbox: Sandbox;
30+
public readonly scanStatusTagName: string;
2631

2732
constructor(scope: Construct, id: string, props: ScannerProps = {}) {
2833
super(scope, id);
2934

35+
this.scanStatusTagName = props.scanStatusTagName ?? 'cc:scna-status';
36+
3037
this.sandbox = new Sandbox(this, 'Sandbox');
3138

3239
const layer = new ClamavLayer(this, 'ClamavLayer');
@@ -44,6 +51,7 @@ export class Scanner extends Construct {
4451
timeout: Duration.minutes(15),
4552
memorySize: 10240,
4653
environment: {
54+
SCAN_STATUS_TAG_NAME: this.scanStatusTagName,
4755
EFS_MOUNT_PATH: '/mnt/lambda',
4856
EFS_DEFINITIONS_PATH: 'virus_database/',
4957
DEFINITIONS_URL: this.sandbox.definitionBucket.virtualHostedUrlForObject(),
@@ -58,9 +66,11 @@ export class Scanner extends Construct {
5866
code: Code.fromAsset(path.join(__dirname, 'lambdas', 'update')),
5967
handler: 'index.handler',
6068
runtime: Runtime.NODEJS_12_X,
69+
onFailure: props.onError,
6170
timeout: Duration.minutes(5),
6271
memorySize: 1024,
6372
environment: {
73+
SCAN_STATUS_TAG_NAME: this.scanStatusTagName,
6474
DEFINITIONS_BUCKET: this.sandbox.definitionBucket.bucketName,
6575
},
6676
layers: [layer],
@@ -126,7 +136,7 @@ export class Scanner extends Construct {
126136
notPrincipals: [this.scanFunction.role, scanAssumedPrincipal],
127137
conditions: {
128138
StringEquals: {
129-
's3:ExistingObjectTag/cc:scan-status': ['IN PROGRESS', 'INFECTED', 'ERROR'],
139+
[`s3:ExistingObjectTag/${this.scanStatusTagName}`]: ['IN PROGRESS', 'INFECTED', 'ERROR'],
130140
},
131141
},
132142
}),

0 commit comments

Comments
 (0)