Skip to content

Commit b37ceed

Browse files
IevIeievgeniia ieromenkoJustin Kontny
authored
Adding GuardDuty Malware Protection for S3 to protect Bedrock knowledge base (#290)
* adding sra_guardduty_malware_protection_for_s3 solution * updated README * adding tags and rules * optionally enable s3 server access logging * added solution to main readme * moved solution under guardduty directory and updated documentation * updated readme --------- Co-authored-by: ievgeniia ieromenko <[email protected]> Co-authored-by: Justin Kontny <[email protected]>
1 parent 8cdafbf commit b37ceed

8 files changed

+668
-1
lines changed

‎CHANGELOG.md

+22-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2025-03-20](#2025-03-20)
7+
- [2025-03-04](#2025-03-04)
8+
- [2025-02-13](#2025-02-13)
69
- [2025-02-04](#2025-02-04)
710
- [2025-01-21](#2025-01-21)
811
- [2025-01-08](#2025-01-08)
@@ -61,11 +64,29 @@ All notable changes to this project will be documented in this file.
6164

6265
---
6366

67+
## 2025-03-20
68+
69+
### Added<!-- omit in toc -->
70+
71+
- Added [SRA Amazon GuardDuty Malware Protection for S3](aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3) solution for GenAI deep-dive Bedrock capability two security controls.
72+
73+
## 2025-03-04
74+
75+
### Updated<!-- omit in toc -->
76+
77+
- Updated [Security Lake Organization](aws_sra_examples/solutions/security_lake/security_lake_org) solution with resource management service-linked role.
78+
79+
## 2025-02-13
80+
81+
### Added<!-- omit in toc -->
82+
83+
- Added [SRA Bedrock Guardrails Solution](aws_sra_examples/solutions/genai/bedrock_guardrails) solution to deploy the sra-bedrock-org solution for GenAI deep-dive Bedrock capability one security controls.
84+
6485
## 2025-02-04
6586

6687
### Added<!-- omit in toc -->
6788

68-
- Added [Bedrock](aws_sra_examples/solutions/genai/bedrock_org) solution to deploy the sra-bedrock-org solution for GenAI deep-dive Bedrock capability one security controls. See https://github.com/aws-samples/aws-security-reference-architecture-examples (sra-1u3sd7f8n)
89+
- Added [Bedrock](aws_sra_examples/solutions/genai/bedrock_org) solution to deploy the sra-bedrock-org solution for GenAI deep-dive Bedrock capability one security controls.
6990

7091
### Updated<!-- omit in toc -->
7192

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@ Please follow the instructions for SRA Terraform deployments in the [SRA Terrafo
151151
| [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) | Configures the EC2 default EBS encryption to use the default KMS key within all provided regions. | | |
152152
| [Firewall Manager](aws_sra_examples/solutions/firewall_manager/firewall_manager_org) | Demonstrates configuring a security group policy and WAF policies for all accounts within an organization. | | |
153153
| [GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org) | Configures GuardDuty within a delegated admin account for all accounts within an organization. | | |
154+
| [Guardduty Malware Protection S3](aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3) | Creates an Amazon GuardDuty Malware Protection Plan for a new or existing S3 bucket. | | This solution operates independently and does not require the deployment of the [SRA Prerequisites Solution](aws_sra_examples/solutions/common/common_prerequisites). |
154155
| [IAM Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer) | Configures an organization analyzer within a delegated admin account and account level analyzer within each account. | | <ul><li>[Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)</li></ul> |
155156
| [IAM Account Password Policy](aws_sra_examples/solutions/iam/iam_password_policy) | Sets the account password policy for users to align with common compliance standards. | | |
156157
| [Inspector](aws_sra_examples/solutions/inspector/inspector_org) | Configure Inspector within a delegated admin account for all accounts and governed regions within the organization. | | |

‎aws_sra_examples/solutions/genai/README.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Generative AI Solutions for AWS SRA
2+
3+
## Table of Contents
4+
- [Introduction](#introduction)
5+
- [Solutions](#solutions)
6+
- [References](#references)
7+
8+
---
9+
10+
## Introduction
11+
12+
This directory contains security solutions for implementing generative AI capabilities in alignment with AWS Security Reference Architecture (SRA) recommendations. The solutions focus on securing Amazon Bedrock implementations and related generative AI workloads.
13+
14+
## Solutions
15+
16+
- [SRA Bedrock Organizations Solution](./bedrock_org/)
17+
This solution provides an automated framework for deploying Bedrock organizational security controls.
18+
19+
- [SRA Bedrock Guardrails Solution](./bedrock_guardrails/)
20+
This solution provides an automated framework for deploying Bedrock guardrails across multiple AWS accounts and regions in an organization.
21+
22+
- [SRA Amazon GuardDuty Malware Protection for S3](./../../solutions/guardduty/guardduty_malware_protection_for_s3)
23+
This solution deploys Amazon GuardDuty Malware Protection for S3. A key use case for this solution is in the preparation of knowledge bases for Retrieval Augmented Generation (RAG) with Amazon Bedrock.
24+
25+
## References
26+
- [AWS SRA Generative AI Deep-Dive](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/gen-ai-sra.html)

‎aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3/README.md

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# SRA Amazon GuardDuty Malware Protection for S3
2+
3+
## Table of Contents
4+
- [Introduction](#introduction)
5+
- [Deployed Resource Details](#deployed-resource-details)
6+
- [Implementation Instructions](#implementation-instructions)
7+
- [References](#references)
8+
9+
---
10+
11+
## Introduction
12+
13+
This solution deploys Amazon GuardDuty Malware Protection for S3 using AWS CloudFormation. It creates a protection plan to enable automated scanning of new objects in S3 buckets for malware and sends notifications of scan results. GuardDuty Malware Protection for S3 can detect malicious content in files before they are processed or used by other systems, enhancing the security of data stored in S3.
14+
A key use case for this solution is in the preparation of knowledge bases for Retrieval Augmented Generation (RAG) with Amazon Bedrock. The malware protection capabilities help enhance the security controls for documents and files used in Amazon Bedrock knowledge base construction, contributing to the overall security posture of AI-powered applications.
15+
16+
### Features
17+
18+
- Creates or uses existing S3 bucket for malware protection
19+
- Creates a new KMS key for encrypting the S3 bucket (when creating a new bucket)
20+
- Creates a KMS key alias for easy management
21+
- Provides an option to enable S3 server access logging during bucket creation
22+
- Configures GuardDuty Malware Protection Plan
23+
- Sets up EventBridge rules for scan result notifications
24+
- Implements SNS notifications for alerts
25+
- Includes DLQ for failed event processing
26+
- Configures necessary IAM roles and permissions
27+
28+
29+
---
30+
31+
## Deployed Resource Details
32+
33+
![Architecture Diagram](./documentation/sra-guardduty-malware-protection-for-s3.png)
34+
35+
This section provides a detailed explanation of the resources shown in the architecture diagram:
36+
37+
### 1.0 Bedrock Account<!-- omit in toc -->
38+
39+
#### 1.1 AWS CloudFormation<!-- omit in toc -->
40+
- Used to define and deploy resources in the solution.
41+
42+
#### 1.2 Protected S3 Bucket<!-- omit in toc -->
43+
- GuardDuty scans each uploaded object.
44+
- Can be newly created or an existing bucket.
45+
46+
#### 1.3 KMS Key<!-- omit in toc -->
47+
- Encrypts objects in the S3 bucket when creating a new bucket.
48+
49+
#### 1.4 EventBridge Rule Role<!-- omit in toc -->
50+
- IAM role for EventBridge rule execution.
51+
52+
#### 1.5 EventBridge Rule<!-- omit in toc -->
53+
- Triggers notifications based on GuardDuty Malware Protection scan results.
54+
55+
#### 1.6 SNS Notification Topic<!-- omit in toc -->
56+
- Sends alerts about malware scan results.
57+
58+
#### 1.7 Dead-Letter Queue (DLQ)<!-- omit in toc -->
59+
- Handles failed event processing from EventBridge.
60+
61+
#### 1.8 GuardDuty S3 Malware Protection Role<!-- omit in toc -->
62+
- IAM role for GuardDuty to perform malware scans on S3 objects.
63+
64+
#### 1.9 Amazon GuardDuty Malware Protection for S3<!-- omit in toc -->
65+
- Scans new S3 objects for malicious content.
66+
- Enables tagging for scanned S3 objects.
67+
68+
---
69+
70+
## Implementation Instructions
71+
72+
### Prerequisites<!-- omit in toc -->
73+
74+
- CloudFormation template deployment permissions in the target AWS account
75+
76+
#### Notes:
77+
- This solution operates independently and does not require the deployment of the [SRA Prerequisites Solution](../../common/common_prerequisites).
78+
79+
### Solution Deployment<!-- omit in toc -->
80+
81+
You can deploy this solution using the AWS Console or AWS CLI.
82+
83+
### Deploying via AWS Management Console<!-- omit in toc -->
84+
1. In the `target account`, open the [CloudFormation Console](https://console.aws.amazon.com/cloudformation).
85+
2. Create a new stack by uploading the `sra-guardduty-s3-protection-plan-main.yaml` template located in the `./templates` directory.
86+
3. Provide the required parameters to configure GuardDuty Malware Protection for S3.
87+
4. Review and confirm the stack creation.
88+
89+
### Deploying via AWS CLI
90+
1. Run the following command to deploy the stack:
91+
#### Notes:
92+
- Update parameter values with your specific settings.
93+
- When deploying with an existing bucket, add the following parameters to your CloudFormation deployment command:
94+
```bash
95+
ParameterKey=pExistingBucketName,ParameterValue="bucket-name" \
96+
ParameterKey=pExistingBucketKmsKey,ParameterValue="kms-key-arn"
97+
```
98+
- This example assumes the CloudFormation template file is saved in the templates directory. Adjust the --template-body path if necessary.
99+
- Ensure the --capabilities CAPABILITY_NAMED_IAM flag is included to allow CloudFormation to create the necessary IAM resources.
100+
101+
```bash
102+
aws cloudformation create-stack \
103+
--stack-name SraGuardDutyMalwareProtectionForS3 \
104+
--template-body file://aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3/templates/sra-guardduty-malware-protection-for-s3-main.yaml \
105+
--region us-east-2 \
106+
--parameters \
107+
ParameterKey=pCreateNewBucket,ParameterValue="true" \
108+
ParameterKey=pUseExistingBucket,ParameterValue="false" \
109+
ParameterKey=pSRASolutionName,ParameterValue=sra-guardduty-malware-protection-for-s3 \
110+
ParameterKey=pKmsKeyAlias,ParameterValue=sra-guardduty-malware-protection-for-s3-key \
111+
ParameterKey=pS3MalwareProtectedBucketNamePrefix,ParameterValue=sra-protected-bucket \
112+
ParameterKey=pEventRuleRoleName,ParameterValue=sra-guardduty-malware-protection-for-s3-events \
113+
ParameterKey=pSRAAlarmEmail,[email protected] \
114+
--capabilities CAPABILITY_NAMED_IAM
115+
```
116+
117+
2. Monitor the stack creation progress in the AWS CloudFormation Console or via CLI commands.
118+
119+
### Post-Deployment
120+
Once the stack is deployed successfully:
121+
- Verify Resource Creation
122+
```bash
123+
aws guardduty list-malware-protection-plans
124+
```
125+
126+
- An email will be sent to confirm the SNS topic subscription. Click the confirmation link to receive malware detection alerts.
127+
- To verify the alerting functionality of GuardDuty Malware Protection for S3 solution, the European Institute for Computer Anti-Virus Research (EICAR) test file can be used. This standardized test file triggers antivirus detection without being actual malware. The EICAR test file should be uploaded to the protected S3 bucket. After upload, verify that the object has been tagged with the scan results, and confirm that an email alert about the detected threat was received. This process provides a safe way to validate that the malware protection setup is functioning as expected.
128+
129+
---
130+
131+
## References
132+
- [AWS SRA Generative AI Deep-Dive](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/gen-ai-sra.html)
133+
- [Capability 2. Providing secure access, usage, and implementation to generative AI RAG techniques](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/gen-ai-rag.html)
134+
- [GuardDuty Malware Protection for S3](https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3.html)
135+
- [AWS CloudFormation Documentation](https://docs.aws.amazon.com/cloudformation/index.html)
136+
- [AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
137+

‎aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3/documentation/sra-guardduty-malware-protection-for-s3.png

81.5 KB
Loading

‎aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3/documentation/sra-guardduty-malware-protection-for-s3.pptx

287 KB
Binary file not shown.

‎aws_sra_examples/solutions/guardduty/guardduty_malware_protection_for_s3/documentation/~$sra-guardduty-malware-protection-for-s3.pptx

165 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)