Proactive Notifications

Antivirus for Amazon S3
Classification for Amazon S3
Proactive Notifications
Proactive Notifications Dashboard
The Dashboard is a great resource to monitor your environment while you are using the console. For all the times you are not in front of the console, it is critically important you are made aware of any system notifications such as problem file scan results. Scan Results which could identify infected or unscannable files is the most critical, but other system messages may be important enough for you to follow as well. The other types of information we notify on is: public / private status of buckets, newly discovered buckets, protection turned on / off for buckets, availability of system updates, trial expiration and low prepaid data counts. With this in mind, a Notifications SNS Topic is provided where Antivirus for Amazon S3 publishes these useful messages. You can simply subscribe to the Topic with the protocol (HTTP, HTTPS, Email, Email-JSON, Amazon SQS, AWS Lambda, Platform Application Endpoint, SMS) of your choice.
All notification messages we generate will have a Notification Type attribute as well as possible secondary attributes. These attributes along with their values can be leveraged for filtering the messages down. Along with the notification type attribute, there are other message attributes such as scanResult, bucket and account. AWS SNS subscription filtering works in an and fashion with additional attributes. Or functionality is supported within attribute values, but as soon as you have more than one attribute those behave as and. This is critical to be aware of as you may add combinations that will never occur and therefore never receive the messages you are expecting.
We have made our wizard so you cannot make these unusable combinations. The filtering that is allowed:
notificationType - on its own this is the highest level (generic) filter
You can get all scan results but just setting this attribute to scanResult, but you may truly not want all scan results, just infected
Possible values - [scanResult, largeFileScan, bucketsDiscovered, bucketProtection, bucketCrawling, bucketsPublicAccess, bucketAutoProtectionFailed, updatesAvailable, lowPrepaidData, trialExpiring]
scanResult - allows you to filter by the result itself
You can filter by one or more values - [Clean, Infected, Unscannable, Error, InfectedAllowed]
bucket - filter by a particular bucket name
Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams
account - filter by account number
For multi-account environments this allows you to filter at the account level
Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams
Message Types
All possible message information:
Key Name
Description
notificationType
You can get all scan results but just setting this attribute to scanResult, but you may truly not want all scan results, just infected
Possible values:

scanResult
largeFileScan
bucketsDiscovered
bucketProtection
bucketCrawling
bucketsPublicAccess
bucketAutoProtectionFailed
updatesAvailable
lowPrepaidData
trialExpiring
scanResult
Secondary attribute to allow filtering by the scan result itself
Possible values:

Infected
Error
Unscannable
Clean
InfectedAllowed
bucket
Secondary attribute to provide filtering by bucket name. Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams. You can provide more than 1 bucket name if desired in a comma separate list.

Possible values: your_bucket_name(s)
accountID
For multi-account environments this allows you to filter at the account level. Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams. Can be used with scanResult, bucketsDiscovered, bucketProtection, bucketCrawling, bucketPublicAccess
Proper Combinations
Proper combinations can be:
notificationType,
notificationType['scanResult'] + scanResult['infected', 'clean', 'unscannable', 'error', 'infectedAllowed`],
notificationType + scanResult + bucket[' < bucket-name(s) >'],
notificationType + scanResult + account['< account-number(s) >'],
notificationType['scanResult'] + bucket['< bucket-name(s) >'],
notificationType[any but updatesAvailable|lowPrepaidData|trialExpiring] + account['< account-number(s) >'],
Example
You may want your Support/IR team to be informed of infected files only so you setup a subscription that filters down to classsificatonResult = Matching and gets sent to their emails or distribution list.
While classsificaton results of error and unclassifiable may get filtered down and sent to your infrastructure team since both of those results typically relate to access issues (either KMS related or cross account permissions).
You may want yet another subscription that either captures all classificatonResult messages or just the clean ones so you capture your own audit log of those files. So the endpoint could be an email not responded to or an application that gathers all this data.
Here is a sample message so you can see the format that gets sent. More samples for the other notification types below.
{
    "Type" : "Notification",
    "MessageId" : "45927ed5-6884-542e-96c6-27777317db99",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "AV-for-S3: Infected object found",
    "Message" : "{\"guid\":\"a59f0da2-0fdd-4667-b272-618d79cd520d\",\"dateScanned\":\"2021-08-26T22:44:34.5595461Z\",\"bucketName\":\"css-protect-versioning\",\"key\":\"infected_bill.pdf\",\"versionId\":\"ohjRhn8aiPIjVTU1T6xOKWoJBR8i0v0w\",\"result\":1,\"scanResults\":[{\"result\":\"Infected\",\"virusName\":[\"Win.Ransomware.WannaCry-6313787-0\"],\"message\":[],\"dateScanned\":\"2021-08-26T22:44:34.5595461Z\",\"engine\":\"ClamAV\",\"engineVersion\":\"0.103.3\",\"virusDbVersion\":\"26275\",\"scanType\":\"GoFwd\"},{\"result\":\"Infected\",\"virusName\":[\"Troj/PDFJs-AIA\"],\"message\":[\"infected_bill.pdf\"],\"dateScanned\":\"2021-08-26T22:44:33.3838187Z\",\"engine\":\"Sophos\",\"engineVersion\":\"3.82.1\",\"virusDbVersion\":\"5.86\",\"scanType\":\"GoFwd\"}],\"actionTaken\":\"Move\",\"virusUploadedBy\":\"AWS:AIDA2T7AZ3IMGHBWXMN4W\",\"fileExists\":true,\"movedTo\":\"cloudstoragesecquarantine-pxlhbmh-<account-number>-us-east-1\",\"region\":\"us-east-1\",\"accountId\":\"<account-number>\",\"allowOnceExemptionAdded\":false,\"permanentlyAllowed\":false}",
    "Timestamp" : "2021-08-26T22:44:35.049Z",
    "SignatureVersion" : "1",
    "Signature" : "or+H3m1RpSvHe3GlccGjnckSj13iz+mFYaEMjwKWuE3uFhytHUkc6cIxk4E3lI7GwtOmuxTCQgc9ms7c/yp+487Chh0IM3nLGCD7WWNaW3W/8BnpFg1wkWQoSAPIh4EuhYLEWMzqF1ldENp6SNGZpG60vYyS/vNx9GnA5nrRDwLfQ76HDlRq/PQpbnzBPleaW61TOsRRhKpVpNZ1dKTRECqCtP9Tgno12XURZ8Li4PQP/w3IJ6EPZOKrva7A2vaaOe4hRyx4lWSagHtigqZ9RMIsTBOFXrCwG3iXopUhnylDgtaeODyepXTUEMHzw931hRMmcjGT+h1epJ10mraA8Q==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "bucket" : {"Type":"String","Value":"css-protect-versioning"},
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"scanResult"},
        "scanResult" : {"Type":"String","Value":"Infected"}
    }
}
Follow the steps below to set up your Topic Subscription utilizing an AWS provided protocol like email.
Create Subscription - Email Example
Subscribing to the real-time notifications sent out via our Notifications SNS Topic has been simplified by the wizard provided. You can still manually set this up if desired, read below these instructions. Creating through the form still requires you to confirm the subscription.
1.Click the Add Subscription button
2.The Add Proactive Notifications Subscription popup will appear 
3.Specify the Notification Type of choice - for our example we will choose ScanResu
Note: After selecting the Notification Type you will be presented other fields to populate. At a minimum, you must specify a Protocol and Endpoint. The other fields can be populated as described above.
4.Choose Email as the protocol and enter your email address
Note: If you left it as seen here, every scan result (clean, infected, unscannable, error and infectedAllowed) would be sent to your email. Generally, you may want to limit down to infected and unscannable to limit the number of emails received. This is up to your requirements, so do as you see fit. As described above, you can filter the results by result, bucket or account and proper combinations of those.
5.Specify Scan Results values to limit emails sent

6.Click the Add Subscription button 
7.You will now see a new entry in the table list showing as Pending under status 
8.Check your email so you can confirm the subscription 
9.Open the email and click the Confirm subscription link
10.This action will open a browser window showing subscription confirmation
11.Refresh the page list by clicking the little Refresh button and you will see your new subscription confirmed 
You are all set now! Feel free to create more as needed for the different notifications needed.
Warning
AWS does not allow the same email address to be used for multiple subscriptions to the same topic. So you can leverage multiple addresses or you can use the "+" option most modern email providers (Gmail, O365, Exchange) support.
For example, instead of using [email protected] as I did in the example steps I could do the following:
[email protected] for all scan results
[email protected] for system upgrade updates
[email protected] for notifications regarding new buckets or public buckets found
etc.
If you'd like to perform these steps manually or see what is going on behind the scenes on the AWS side, expand the section below and read on. If the GUI was enough for you, then skip it.
Manual Setup - Email
1.Login to the AWS console and navigate to the region where the console is deployed
If you are unsure of which region the console is deployed in, you can view the Console Settings page to find it. 
​
​
2.Navigate to the Simple Notification Service (SNS) service
You can search for the service or find it under Application Integration
​
​
You'll land at the SNS Dashboard. You may have different numbers of existing Topics and Subscriptions
​
​
3.Click on Topics as indicated above and then click on the Notifications Topic
The Topic will be named CloudStorageSecNotifications-<appID>. You can find your appID in the Console Settings as the value after the - of the Service Name.
Note: I have more than one deployment in my account so I see more than one standard topic and more than one notifications topic.
​
​
You will land on the details page for the Topic
​
​
4.Click the Create Subscription button to be taken to the Create Subscription page 
​
​
5.Pick a Protocol of your choice
We'll use Email for this example
​
​
6.Pick a Protocol of your choice
We'll use Email for this example
​
​
Note:  You will have to confirm your subscription as AWS indicates. Go to the email address you specified and click the link within it after you finish creating the subscription.
7.Setup a Filter Policy (optional)
You can be done at this point, but without a filter policy you will get notified of every scan result. Look back above for scenarios where filtering makes sense
{
    "notificationType" : ["scanResult"],
    "scanResult" : ["Infected", "Error", "Unscannable", "Clean"],
    "bucket" : ["your_bucket_name(s)"],
    "key": [{"prefix": "folder_name/path(s) "}]
}
​✏
 Note
You can copy and paste that JSON directly into the filter and it will work. Remember to pick which scan results you are filtering on and remove the others from the list.
Copy the JSON and paste it into the filter policy JSON editor as seen below and edit as you see fit
​
​
You can read more about SNS Topic Subscription attribute matching in the AWS Documentation on the subject.
8.Click the Create Subscription button and you are done!
Technically, you will now need to go confirm your subscription. 
​
​
​
Managing an existing subscription is easy. Simply click the action button (
) to either Edit or Delete the subscription. Editing will allow you to make changes as are permitted to the subscription. Deleting will remove the subscription.
Manage Subscription
Sample Email Protocol Messages
Once you have confirmed your subscription as objects get scanned you will see in your Inbox as follows. 
And here are the details of an infected email message received. 
Slack Integration Setup
It is a simple process (that may sound more complicated than it is) that took under 10 minutes to setup. Simply follow the process laid out in the AWS blogpost talking about how to leverage webhooks seen here: AWS SNS + Slack / Teams / Chime setup​
What it looks like in Slack. You can modify the format with Slack Message Layouts. 
Sample Messages - JSON
Scan Result - Clean
{
    "Type" : "Notification",
    "MessageId" : "bd433133-294e-52d9-9503-689132de2d6e",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "AV-for-S3: Clean object found",
    "Message" : "{\"guid\":\"5fe98fc2-685c-4f64-b9a0-8eedea8f42a4\",\"dateScanned\":\"2021-08-26T22:44:32.6856159Z\",\"bucketName\":\"css-protect-versioning\",\"key\":\"PCI Mandate Compliance Report Template_1586376538835.pdf\",\"versionId\":\"k751iw8YoEIGtZReV8JIsopfkjsFZ_Kf\",\"result\":0,\"scanResults\":[{\"result\":\"Clean\",\"virusName\":[],\"message\":[],\"dateScanned\":\"2021-08-26T22:44:32.6856159Z\",\"engine\":\"ClamAV\",\"engineVersion\":\"0.103.3\",\"virusDbVersion\":\"26275\",\"scanType\":\"GoFwd\"},{\"result\":\"Clean\",\"virusName\":[],\"message\":[],\"dateScanned\":\"2021-08-26T22:44:32.6158696Z\",\"engine\":\"Sophos\",\"engineVersion\":\"3.82.1\",\"virusDbVersion\":\"5.86\",\"scanType\":\"GoFwd\"}],\"actionTaken\":\"None\",\"virusUploadedBy\":\"\",\"fileExists\":true,\"movedTo\":\"\",\"region\":\"us-east-1\",\"accountId\":\"<account-number>\",\"allowOnceExemptionAdded\":false,\"permanentlyAllowed\":false}",
    "Timestamp" : "2021-08-26T22:44:32.986Z",
    "SignatureVersion" : "1",
    "Signature" : "vy0J32/9v0w813bdr7soNpn76V3f/AUw5uWwtgNK3k0wP9i7Usa/7atx1aeaLIcWYLe/LEJMfkYnXQTkq/5mjf0N8FJ9jXn9fkdUAGHf5iIovNKluf8xPDs6jrUo7rxg9Leskk2+EeNEi9wtQvXCtWeDEL20QA+1KsqcsQNGKPvUxF/m04BTr/jDO7YHK4FAHOc1DfY546dUA+z+t0DUYvSJqLHsUXQqHEqNpL7WHlzSvxIV+F1T0M525FbcZPZp3iLw5Qc3LlFZp/Yhy3V+2q6+JCJipzgLPGdN45EhwAYpvM5jNvqgjheKdiJkBONFByw1Hn4fIfIqc6olQr7u+w==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "bucket" : {"Type":"String","Value":"css-protect-versioning"},
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"scanResult"},
        "scanResult" : {"Type":"String","Value":"Clean"}
    }
}
Scan Result - Infected
{
    "Type" : "Notification",
    "MessageId" : "45927ed5-6884-542e-96c6-27777317db99",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "AV-for-S3: Infected object found",
    "Message" : "{\"guid\":\"a59f0da2-0fdd-4667-b272-618d79cd520d\",\"dateScanned\":\"2021-08-26T22:44:34.5595461Z\",\"bucketName\":\"css-protect-versioning\",\"key\":\"infected_bill.pdf\",\"versionId\":\"ohjRhn8aiPIjVTU1T6xOKWoJBR8i0v0w\",\"result\":1,\"scanResults\":[{\"result\":\"Infected\",\"virusName\":[\"Win.Ransomware.WannaCry-6313787-0\"],\"message\":[],\"dateScanned\":\"2021-08-26T22:44:34.5595461Z\",\"engine\":\"ClamAV\",\"engineVersion\":\"0.103.3\",\"virusDbVersion\":\"26275\",\"scanType\":\"GoFwd\"},{\"result\":\"Infected\",\"virusName\":[\"Troj/PDFJs-AIA\"],\"message\":[\"infected_bill.pdf\"],\"dateScanned\":\"2021-08-26T22:44:33.3838187Z\",\"engine\":\"Sophos\",\"engineVersion\":\"3.82.1\",\"virusDbVersion\":\"5.86\",\"scanType\":\"GoFwd\"}],\"actionTaken\":\"Move\",\"virusUploadedBy\":\"AWS:AIDA2T7AZ3IMGHBWXMN4W\",\"fileExists\":true,\"movedTo\":\"cloudstoragesecquarantine-pxlhbmh-<account-number>-us-east-1\",\"region\":\"us-east-1\",\"accountId\":\"<account-number>\",\"allowOnceExemptionAdded\":false,\"permanentlyAllowed\":false}",
    "Timestamp" : "2021-08-26T22:44:35.049Z",
    "SignatureVersion" : "1",
    "Signature" : "or+H3m1RpSvHe3GlccGjnckSj13iz+mFYaEMjwKWuE3uFhytHUkc6cIxk4E3lI7GwtOmuxTCQgc9ms7c/yp+487Chh0IM3nLGCD7WWNaW3W/8BnpFg1wkWQoSAPIh4EuhYLEWMzqF1ldENp6SNGZpG60vYyS/vNx9GnA5nrRDwLfQ76HDlRq/PQpbnzBPleaW61TOsRRhKpVpNZ1dKTRECqCtP9Tgno12XURZ8Li4PQP/w3IJ6EPZOKrva7A2vaaOe4hRyx4lWSagHtigqZ9RMIsTBOFXrCwG3iXopUhnylDgtaeODyepXTUEMHzw931hRMmcjGT+h1epJ10mraA8Q==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "bucket" : {"Type":"String","Value":"css-protect-versioning"},
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"scanResult"},
        "scanResult" : {"Type":"String","Value":"Infected"}
    }
}
Scan Result - Infected with Mixed Result
{
    "Type" : "Notification",
    "MessageId" : "52e1b014-a19d-5d32-8717-e9b6ba0d2df0",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "AV-for-S3: Infected object found",
    "Message" : "{\"guid\":\"9c2d3aca-7d9a-4d85-98bb-0954227c851b\",\"dateScanned\":\"2021-08-26T22:44:32.1855327Z\",\"bucketName\":\"css-protect-versioning\",\"key\":\"halock-av.pdf\",\"versionId\":\"cpThl8wDuSj2Ie4_CU0bR_x1ULCIXVhf\",\"result\":1,\"scanResults\":[{\"result\":\"Clean\",\"virusName\":[],\"message\":[],\"dateScanned\":\"2021-08-26T22:44:32.1855327Z\",\"engine\":\"ClamAV\",\"engineVersion\":\"0.103.3\",\"virusDbVersion\":\"26275\",\"scanType\":\"GoFwd\"},{\"result\":\"Infected\",\"virusName\":[\"EICAR-AV-Test\",\"EICAR-AV-Test\"],\"message\":[\"halock-av.pdf\",\"halock-av.pdf\"],\"dateScanned\":\"2021-08-26T22:44:32.1874844Z\",\"engine\":\"Sophos\",\"engineVersion\":\"3.82.1\",\"virusDbVersion\":\"5.86\",\"scanType\":\"GoFwd\"}],\"actionTaken\":\"Move\",\"virusUploadedBy\":\"AWS:AIDA2T7AZ3IMGHBWXMN4W\",\"fileExists\":true,\"movedTo\":\"cloudstoragesecquarantine-pxlhbmh-<account-number>-us-east-1\",\"region\":\"us-east-1\",\"accountId\":\"<account-number>\",\"allowOnceExemptionAdded\":false,\"permanentlyAllowed\":false}",
    "Timestamp" : "2021-08-26T22:44:32.905Z",
    "SignatureVersion" : "1",
    "Signature" : "SNSOWiex1hSWk6ooFjp3TI9OnO2S3LGSDRbUHqR6mzXptAcgiSIpdzKe9hbJZvttx0cNUBP3qajUWpuTPI2Toy0vPYo800HSnXBkW9pI7CIuTW8uVw+dN4OgsJJLN+Fh8LAY2uz1gsrofi7DMMRge9tyaerPIofyLCPTdEghQNpHWomfYF/fI5KLvIEetP5ROqlvL9rmzgvWY8AADKGGy+tki/4itzCfQBjBP5WpsyWWW0kQvw+TCXxZzogc+2h9YzBHKddQCdCUiMZNyiH/mJ+RjWJgfsZYws0MjkUgIb27Nv571TCQNpym3Z8d8ChTv7tb1jepkf5oBWuLph4uqA==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "bucket" : {"Type":"String","Value":"css-protect-versioning"},
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"scanResult"},
        "scanResult" : {"Type":"String","Value":"Infected"}
    }
}
New Bucket Found
{
    "Type" : "Notification",
    "MessageId" : "32373388-32b3-5303-a28e-6b3394954bc4",
    "TopicArn" : "arn:aws:sns:us-east-1:<account-number>:CloudStorageSecNotificationsTopic-y6uajej",
    "Subject" : "Discovered 1 new Buckets in Account 'Primary'",
    "Message" : "The following bucket(s) were discovered and are likely unprotected: css-webinar-new-bucket",
    "Timestamp" : "2021-03-05T03:22:14.713Z",
    "SignatureVersion" : "1",
    "Signature" : "UWQDpcdt82PEQw5B95rCh74gau0Nie8PITkDowLveGflTn7/LshJQ/854jL3gNKY9gpHVWh1deSWxHduI773gQdi4AbRMkJ68tum6PDg7/eYjcCS85RiJ4EeK7HH2xEsEdjTBFsXIs9W5rnXcnOB8wweYZ0IdaKrG4npYng0Qhnr6APFwq5uM4RoSOrwBhhS9iF6gHK++Ir8UNotq52K3RRIHBndYMXQIJL9t0vtcHpf3aAYgcjg+/+3PcjOH/fY974i1TD0h/EabmmKgxAnsggQ4rhGEintKrm/6vV1zFfGM+ehlRwRA5WG5KssyBYY2RxMLHbWCpfeakefmU0gjA==",
    "SigningCertURL" : "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-1:<account-number>:CloudStorageSecNotificationsTopic-y6uajej:1c22fb20-0d29-42a9-b7dd-1964d77dd99d",
    "MessageAttributes" : {
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"bucketsDiscovered"}
    }
}
Public Bucket Found
{
    "Type" : "Notification",
    "MessageId" : "861b8ed9-116c-5eef-b906-d662b742f907",
    "TopicArn" : "arn:aws:sns:us-east-1:<account-number>:CloudStorageSecNotificationsTopic-y6uajej",
    "Subject" : "Discovered PUBLIC bucket 'css-demo-eu-north-1' in account 'Primary'",
    "Message" : "The console has discovered bucket 'css-demo-eu-north-1' with public access. ",
    "Timestamp" : "2021-03-05T03:22:22.053Z",
    "SignatureVersion" : "1",
    "Signature" : "b1pYOKS3FJKl3DSelsVoL6ORzcDoPUfuMu72MIrK05sbGZB6eP5xkeZc3QScLSkAMjAzUum5bQAYtq30CbOxgrl9uClvKhvrOwst9Ia0fJ0sCXE4gj59Etnx3j7jrx3x1mR87UhiOjvqNTDJvcJyMKcALCpyf4JUPs7GNzmA5TjMh2xRSsntPuATdMlSlgIi5ApBr4tZUZBAUfxfSI9eGPt9oi44ix0rB8ghlbMNo1ZA5L9ynuC4fyMbPjritTNF7o8hQzQyC4397GC5kBuAn4kdiGMTRLy+UIO/SBGr8iKsb6+3PiUN1g6qyooWilIeAKQ8eJMjo8OVlvLU0+LzVg==",
    "SigningCertURL" : "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-1:<account-number>:CloudStorageSecNotificationsTopic-y6uajej:1c22fb20-0d29-42a9-b7dd-1964d77dd99d",
    "MessageAttributes" : {
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"bucketsPublicAccess"}
    }
}
Bucket Protection Turned Off
{
    "Type" : "Notification",
    "MessageId" : "2c547302-6e33-563d-b986-2aa07c26762a",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "Protection turned OFF for 1 buckets in account 'Primary'",
    "Message" : "Protection has been turned OFF for the following buckets: css-apsoutheast1-01",
    "Timestamp" : "2021-08-26T22:04:05.844Z",
    "SignatureVersion" : "1",
    "Signature" : "eF0dA/AGVgMp+S85UugidY+9FZ0UryqCGluWRHTtLEHXWM2L+o8AXO+2ipV5u0Jykd9fKEs0SAapDoNAM08X01aakpATR/Bg+1xglY1YGiB4xhhtD64gAGikfYxPDk3BbPS5qamfssXyu8YqJHRpn3xjc+VoYaJajOB1UAm3r0wkcjmapVzEVdvQF8fMx/hfA4sne3IJC5Szm/6g5KTQZ7RYHgrv3O1wB4GPAfNHM061Z5RbdSnKvjuUM8umEfcwOVa40fHIVz68Y1f8lNdPxDWUuY7fQwed8sx8DdRj3iqi1tSbLwYG72JDAiUPDTwEQDPldrQGac17M7aFlms0qA==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "accountId" : {"Type":"String","Value":"<account-number>"},
        "notificationType" : {"Type":"String","Value":"bucketProtection"}
    }
}
Product Upgrade Available
{
    "Type" : "Notification",
    "MessageId" : "7b11beaf-0ca6-5c7c-b7d1-e73fbad71b86",
    "TopicArn" : "arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh",
    "Subject" : "Antivirus for Amazon S3 - Update(s) are available",
    "Message" : "Update(s) are available for the Antivirus of Amazon S3 product. Visit the console to apply them from the updates menu in the upper right of the page.",
    "Timestamp" : "2021-08-13T18:04:33.826Z",
    "SignatureVersion" : "1",
    "Signature" : "urNgfMcXt76qCsFrSMMhzeXQ3rEA6I3FYWBw+kOeDLgOdGW1vFcFFgii9XIytsdgI71fnCqkOdPe+sBcx1CpnDmdpG5F8oS6S5+bSVgnwp4f3srpghdR34gSMl8xeWZjqWCjcQd4zlcv7HcT4Jg1l1xDB3xD5KPUBhkEzwuvcQIVtpbXXhOJPbVjbUAMUqaI/lkq0x55Mh2D5ALN+1s9loQOC5R1/z/WFE043S037sQjea72rIs1zRouUUo1u+n4Jqo+GHARX51fJcDArcsEAA5INnxxVB5H6xoMAsYYv2LinpLIYRN8Vk/xlL7lfZXH2bYMsX/dJhlZ8crO1axZDA==",
    "SigningCertURL" : "https://sns.eu-west-1.amazonaws.com/SimpleNotificationService-010a507c1833636cd94bdb98bd93083a.pem",
    "UnsubscribeURL" : "https://sns.eu-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:eu-west-1:<account-number>:CloudStorageSecNotificationsTopic-pxlhbmh:32f7008b-bf69-48c0-84fd-872b708f0037",
    "MessageAttributes" : {
        "notificationType" : {"Type":"String","Value":"updatesAvailable"}
    }
}
Proactive Notifications
Proactive Notifications Dashboard
The Dashboard is a great resource to monitor your environment while you are using the console. For all the times you are not in front of the console, it is critically important you are made aware of any system notifications such as matching classification results. Classification Results which could identify classified data is the most critical, but other system messages may be important enough for you to follow as well. The other types of information we notify on is: public / private status of buckets, newly discovered buckets, protection turned on / off for buckets, availability of system updates, trial expiration and low prepaid data counts. With this in mind, a Notifications SNS Topic is provided where Classification for Amazon S3 publishes these useful messages. You can simply subscribe to the Topic with the protocol (HTTP, HTTPS, Email, Email-JSON, Amazon SQS, AWS Lambda, Platform Application Endpoint, SMS) of your choice.
All notification messages we generate will have a Notification Type attribute as well as possible secondary attributes. These attributes along with their values can be leveraged for filtering the messages down. Along with the notification type attribute, there are other message attributes such as classificationResult, bucket and account. AWS SNS subscription filtering works in an and fashion with additional attributes. Or functionality is supported within attribute values, but as soon as you have more than one attribute those behave as and. This is critical to be aware of as you may add combinations that will never occur and therefore never receive the messages you are expecting.
We have made our wizard so you cannot make these unusable combinations. The filtering that is allowed:
NotificationType - on its own this is the highest level (generic) filter
You can get all classsification results by just setting this attribute to ClassificationResult, but you may truly not want all classification results, just matching
Possible values - [ClassificationResult, BucketsDiscovered, BucketsPublicAccess, LowPrepaidData, TrialExpiring, UpdatesAvailable]
ClassificationResult - allows you to filter by the result itself
You can filter by one or more values - [Matching, NonMatching, Unclassifiable, Error]
Buckets - filter by a particular bucket name
Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams
Accounts - filter by account number
For multi-account environments this allows you to filter at the account level
Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams
Message Types
All possible message information:
Key Name
Description
NotificationType
You can get all classification results but just setting this attribute to ClassificationResult, but you may truly not want all classification results, just matching
Possible values:

BucketsDiscovered
BucketProtection
BucketsPublicAccess
BucketAutoProtectionFailed
LowPrepaidData
TrialExpiring
UpdatesAvailable
ClassificationResult
Secondary attribute to allow filtering by the scan result itself
Possible values:

Matching
NonMatching
Unclassifiable
Error
Buckets
Secondary attribute to provide filtering by bucket name. Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams. You can provide more than 1 bucket name if desired in a comma separate list.

Possible values: your_bucket_name(s)
Accounts
For multi-account environments this allows you to filter at the account level. Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams. Can be used with ClassificationResults, BucketsDiscovered, BucketProtection, BucketCrawling, BucketPublicAccess
Proper Combinations
Proper combinations can be:
notificationType,
notificationType['classficationResult'] + classificationResult['Matching', 'NonMatching', 'Unclassifiable', 'Error'],
notificationType + classificationResult + bucket[' < bucket-name(s) >'],
notificationType + classificationResult + account['< account-number(s) >'],
notificationType['classificationResult'] + bucket['< bucket-name(s) >'],
notificationType[any but updatesAvailable|lowPrepaidData|trialExpiring] + account['< account-number(s) >'],
Example
You may want your Support/IR team to be informed of infected files only so you setup a subscription that filters down to classsificatonResult = Matching and gets sent to their emails or distribution list.
While scan results of error and unscannable may get filtered down and sent to your infrastructure team since both of those results typically relate to access issues (either KMS related or cross account permissions).
You may want yet another subscription that either captures all scanResult messages or just the clean ones so you capture your own audit log of those files. So the endpoint could be an email not responded to or an application that gathers all this data.
Here is a sample message so you can see the format that gets sent. More samples for the other notification types below.
2022-05-20 16:08:50.7409|INFO|MatchingClassificationResults|{
    "date": "2022-05-20",
    "guid": "60ea309d-b0f5-4b14-a0a2-76ff49bd210f",
    "dateTime": "2022-05-20T16:08:50.716198Z",
    "accountId": "351727022968",
    "region": "us-east-1",
    "container": "class-trigger-bucket-3",
    "objectPath": "Employee List.xlsx",
    "innerFilePath": null,
    "textMatchingSet": [
        {
            "cclName": "SocialsecuritynumbersUSA",
            "score": 1,
            "triggered": true,
            "matchesCount": 1
        }
    ],
    "error": null,
    "resultType": 1
}
Follow the steps below to set up your Topic Subscription utilizing an AWS provided protocol like email.
Create Subscription - Email Example
1.Click the Add Subscription button
2.The Add Proactive Notifications Subscription popup will appear 
3.Specify the Notification Type of choice - for our example we will choose ClassificationResult
Note: After selecting the Notification Type you will be presented other fields to populate. At a minimum, you must specify a Protocol and Endpoint. The other fields can be populated as described above.
4.Choose Email as the protocol and enter your email address

Note: If you left it as seen here, every scan result (clean, infected, unscannable, error and infectedAllowed) would be sent to your email. Generally, you may want to limit down to infected and unscannable to limit the number of emails received. This is up to your requirements, so do as you see fit. As described above, you can filter the results by result, bucket or account and proper combinations of those.
5.Specify Classification Results values to limit emails sent
​
6.Click the Add Subscription button 
7.You will now see a new entry in the table list showing as Pending under status 
8.Check your email so you can confirm the subscription 
9.Open the email and click the Confirm subscription link

This action will open a browser window showing subscription confirmation 
10.Refresh the page list by clicking the little Refresh button and you will see your new subscription confirmed 
You are all set now! Feel free to create more as needed for the different notifications needed.
Warning
AWS does not allow the same email address to be used for multiple subscriptions to the same topic. So you can leverage multiple addresses or you can use the "+" option most modern email providers (Gmail, O365, Exchange) support.
For example, instead of using [email protected] as I did in the example steps I could do the following:
[email protected] for all scan results
[email protected] for system upgrade updates
[email protected] for notifications regarding new buckets or public buckets found
etc.
If you'd like to perform these steps manually or see what is going on behind the scenes on the AWS side, expand the section below and read on. If the GUI was enough for you, then skip it.
Manual Setup - Email
1.Login to the AWS console and navigate to the region where the console is deployed
If you are unsure of which region the console is deployed in, you can view the Console Settings page to find it.

2.Navigate to the Simple Notification Service (SNS) service
You can search for the service or find it under Application Integration
 
You'll land at the SNS Dashboard. You may have different numbers of existing Topics and Subscriptions
3.Click on Topics as indicated above and then click on the Notifications Topic
The Topic will be named CloudStorageSecNotifications-<appID>. You can find your appID in the Console Settings as the value after the - of the Service Name.
Note: I have more than one deployment in my account so I see more than one standard topic and more than one notifications topic.
You will land on the details page for the Topic
4.Click the Create Subscription button to be taken to the Create Subscription page 
5.Pick a Protocol of your choice
We'll use Email for this example

6.Pick a Protocol of your choice
We'll use Email for this example

Note:  You will have to confirm your subscription as AWS indicates. Go to the email address you specified and click the link within it after you finish creating the subscription.
7.Setup a Filter Policy (optional)
You can be done at this point, but without a filter policy you will get notified of every scan result. Look back above for scenarios where filtering makes sense

{
    "notificationType" : ["classificationResult"],
    "classificationResult" : ["Matching", "Error", "Unclassifiable", "NonMatching"],
    "bucket" : ["your_bucket_name(s)"]
}
​
8.  Click the Create Subscription button and you are done!
Technically, you will now need to go confirm your subscription.  
​✏
 Note
You can copy and paste that JSON directly into the filter and it will work. Remember to pick which scan results you are filtering on and remove the others from the list.
Copy the JSON and paste it into the filter policy JSON editor as seen below and edit as you see fit
Manage Subscription
Managing an existing subscription is easy. Simply click the action button (
) to either Edit or Delete the subscription. Editing will allow you to make changes as are permitted to the subscription. Deleting will remove the subscription.


Sample Email Protocol Messages
Once you have confirmed your subscription as objects get scanned you will see in your Inbox as follows:
Notifications Email Inbox
And here are the details of an email message notification about discovering content in an object that is Matching one searched for by the chosen Classification rules. 
​
Slack Integration Setup
It is a simple process (that may sound more complicated than it is) that took under 10 minutes to setup. Simply follow the process laid out in the AWS blogpost talking about how to leverage webhooks seen here: AWS SNS + Slack / Teams / Chime setup​
What it looks like in Slack. You can modify the format with Slack Message Layouts. 
Sample Messages - JSON
{ 
    "date": "2022-05-20",
    "guid": "60ea309d-b0f5-4b14-a0a2-76ff49bd210f",
    "dateTime": "2022-05-20T16:08:50.716198Z",
    "accountId": "351727022968",
    "region": "us-east-1",
    "container": "class-trigger-bucket-3", 
    "objectPath": "Employee List.xlsx",
    "innerFilePath": null, 
    "textMatchingSet": 
        [ 
            { 
                 "cclName": "SocialsecuritynumbersUSA",
                 "score": 1,
                 "triggered": true, 
                 "matchesCount": 1 
             }
        ],
    "error": null, 
    "resultType": 1 
       }
​
​
​
Key Name	Description
notificationType	You can get all scan results but just setting this attribute to `scanResult`, but you may truly not want all scan results, just `infected` Possible values: scanResult largeFileScan bucketsDiscovered bucketProtection bucketCrawling bucketsPublicAccess bucketAutoProtectionFailed updatesAvailable lowPrepaidData trialExpiring
scanResult	Secondary attribute to allow filtering by the scan result itself Possible values: Infected Error Unscannable Clean InfectedAllowed
bucket	Secondary attribute to provide filtering by bucket name. Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams. You can provide more than 1 bucket name if desired in a comma separate list. Possible values: `your_bucket_name(s)`
accountID	For multi-account environments this allows you to filter at the account level. Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams. Can be used with scanResult, bucketsDiscovered, bucketProtection, bucketCrawling, bucketPublicAccess
Key Name	Description
NotificationType	You can get all classification results but just setting this attribute to `ClassificationResult`, but you may truly not want all classification results, just `matching` Possible values: BucketsDiscovered BucketProtection BucketsPublicAccess BucketAutoProtectionFailed LowPrepaidData TrialExpiring UpdatesAvailable
ClassificationResult	Secondary attribute to allow filtering by the scan result itself Possible values: Matching NonMatching Unclassifiable Error
Buckets	Secondary attribute to provide filtering by bucket name. Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams. You can provide more than 1 bucket name if desired in a comma separate list. Possible values: `your_bucket_name(s)`
Accounts	For multi-account environments this allows you to filter at the account level. Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams. Can be used with ClassificationResults, BucketsDiscovered, BucketProtection, BucketCrawling, BucketPublicAccess