Skip to content

AWS Backups Malware Scanning Threat analysis & containment Methodology

0

Following are questions related to AWS Backups malware scanning threat detection and elimination procedures.

  1. Where can the user find the historical scanned results performed on EBS/EC2/S3 snapshots/recovery-points?
  2. How does the quarantine process works for flagged resources with threats identified?
  3. Would the AWS Backup Automatic Restore testing selects or eliminates the flagged snapshots during the next schedule?

asked a month ago76 views

1 Answer
0

Hello.

Where can the user find the historical scanned results performed on EBS/EC2/S3 snapshots/recovery-points?

You can check this in the AWS Backup console under "Malware protection" → "Malware scan jobs" screen.
I think you can also access this information using the ListScanJobs/DescribeScanJob API.
https://docs.aws.amazon.com/aws-backup/latest/devguide/malware-protection.html

How does the quarantine process works for flagged resources with threats identified?

AWS Backup / GuardDuty does not have a native "automatic quarantine" feature.
The service's responsibility is to scan and return THREATS_FOUND/NO_THREATS_FOUND; I believe that subsequent isolation and restriction should be handled by a custom architecture using EventBridge and Lambda.
https://aws.amazon.com/jp/blogs/storage/scan-backups-for-malware-with-amazon-guardduty-malware-protection-for-aws-backup/

Would the AWS Backup Automatic Restore testing selects or eliminates the flagged snapshots during the next schedule?

I don't think it will be excluded because there are no filters based on malware scan results or tags.

EXPERT

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.