Question

A media company allows external partners to upload files directly to an S3 bucket that feeds a downstream processing pipeline. The security team wants an automated, managed solution that scans newly uploaded objects for malware and prevents the pipeline from processing infected files, with minimal custom code and no need to manage scanning infrastructure. Which approach best satisfies these requirements?

Accepted Answer

Enable GuardDuty Malware Protection for S3 on the bucket, and use the object tags it applies (scan status) combined with an S3 bucket policy or EventBridge-triggered logic to block or route infected objects away from the pipeline.

Answer

Deploy a fleet of EC2 instances running an open-source antivirus engine, triggered by S3 event notifications, and have the instances delete infected objects.

Answer

Enable Amazon Macie on the bucket to classify uploaded objects and automatically quarantine any object flagged as malware.

Answer

Turn on S3 Object Lock in governance mode so that infected objects cannot be modified or read by the downstream pipeline.