Ctrlk
Release Notes
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Logging and Permissions

Details on Log Groups and Console + Agent Permissions

Platform Services

While many services are used (ECS Fargate, App Config, CloudWatch, CloudFormation, DynamoDB, SNS, SQS, IAM) to deliver the Antivirus for Amazon S3 solution, two will be called out here. CloudWatch and IAM are leveraged for logging and permissions respectively. These are the usual questions we get from customers:

  1. How do I check the logs?

  2. What are you doing behind the scenes (permissions wise)?

We wanted to make sure you had those bases covered with the information below.

CloudWatch Log Group Overview

Log groups for the Console

Console.AgentConfig

Logs of changes to agent configuration performed through the console.

2020-08-19T23:01:08.246-06:00 2020-08-20 05:01:08.2466|INFO|AgentConfig|Updated Configured Subnets for Agents in region 'ap-northeast-1': {"region":"ap-northeast-1","vpcId":"vpc-6902080e","subnets":[{"subnetId":"subnet-1673ac3d","availabilityZone":"ap-northeast-1d","cidrBlock":"172.31.16.0/20"},{"subnetId":"subnet-bd66b2f5","availabilityZone":"ap-northeast-1a","cidrBlock":"172.31.32.0/20"}]}
2020-08-19T23:01:08.322-06:00 2020-08-20 05:01:08.3225|INFO|AgentConfig|Updated Configured Subnets for Agents in region 'eu-west-3': {"region":"eu-west-3","vpcId":"vpc-e9677880","subnets":[{"subnetId":"subnet-232b114a","availabilityZone":"eu-west-3a","cidrBlock":"172.31.0.0/20"},{"subnetId":"subnet-266a0c6b","availabilityZone":"eu-west-3c","cidrBlock":"172.31.32.0/20"}]}
2020-08-19T23:01:08.409-06:00 2020-08-20 05:01:08.4092|INFO|AgentConfig|Updated Configured Subnets for Agents in region 'us-west-1': {"region":"us-west-1","vpcId":"vpc-1c55a17a","subnets":[{"subnetId":"subnet-b8c563de","availabilityZone":"us-west-1b","cidrBlock":"172.31.16.0/20"},{"subnetId":"subnet-3c59aa66","availabilityZone":"us-west-1a","cidrBlock":"172.31.0.0/20"}]}
2020-08-19T23:01:08.490-06:00 2020-08-20 05:01:08.4899|INFO|AgentConfig|Updated Configured Subnets for Agents in region 'us-west-2': 
{
    "region": "us-west-2",
    "vpcId": "vpc-2f007457",
    "subnets": [
        {
            "subnetId": "subnet-f6f91abc",
            "availabilityZone": "us-west-2a",
            "cidrBlock": "172.31.32.0/20"
        },
        {
            "subnetId": "subnet-f0408688",
            "availabilityZone": "us-west-2b",
            "cidrBlock": "172.31.16.0/20"
        }
    ]
}
2020-08-20 05:01:08.4899|INFO|AgentConfig|Updated Configured Subnets for Agents in region 'us-west-2': {"region":"us-west-2","vpcId":"vpc-2f007457","subnets":[{"subnetId":"subnet-f6f91abc","availabilityZone":"us-west-2a","cidrBlock":"172.31.32.0/20"},{"subnetId":"subnet-f0408688","availabilityZone":"us-west-2b","cidrBlock":"172.31.16.0/20"}]}
Console.AuditLogging

Logs audit trail entries for security-relevant user actions in the Console.

2026-03-25 21:29:21.3817|INFO|AuditLogging|Event: UserSignIn
User: admin
Details: User 'admin' signed in with password
Console.Buckets

Logs of changes to bucket protection status and any errors that may occur while trying to turn on/off buckets.

2020-08-13T10:31:12.309-06:00 2020-08-13 16:31:12.3094|INFO|Buckets|Turned on protection for bucket 'css-webinar-new-files' 
2020-08-13T10:39:55.290-06:00 2020-08-13 16:39:55.2901|INFO|Buckets|Turned off protection for bucket 'css-webinar-new-files'
2020-08-13T10:47:56.726-06:00 2020-08-13 16:47:56.7262|INFO|Buckets|Turned on protection for bucket 'css-webinar-new-files'
2020-08-13T10:59:48.397-06:00 2020-08-13 16:59:48.3969|INFO|Buckets|Turned off protection for bucket 'css-webinar-new-files'
2020-08-13T11:36:53.512-06:00 2020-08-13 17:36:53.5125|INFO|Buckets|Turned on protection for bucket 'webinar-other-account-bucket'
2020-08-13T11:36:56.921-06:00 2020-08-13 17:36:56.9212|INFO|Buckets|Turned on protection for bucket 'webinar-other-account-bucket-2'
2020-08-13T12:26:51.700-06:00 2020-08-13 18:26:51.7006|INFO|Buckets|Turned on protection for bucket 'css-webinar-existing-files'
2020-08-13T12:27:18.104-06:00 2020-08-13 18:27:18.1044|INFO|Buckets|Turned on protection for bucket 'css-webinar-new-files'
2020-08-17T15:53:25.588-06:00 2020-08-17 21:53:25.5884|INFO|Buckets|Turned off protection for bucket '100kb-bucket'
2020-08-17T15:53:25.755-06:00 2020-08-17 21:53:25.7552|INFO|Buckets|Turned off protection for bucket 'demo-destination-bucket'
Console.BlobContainers

Logs Azure Blob Container discovery and management operations.

Console.EbsVolumes

Logs EBS volume scanning configuration and discovery.

Console.EfsVolumes

Logs EFS volume scanning configuration and discovery.

Console.EcsConfig

Logs of actions taken to enable or disable Agents in a region. This includes creation of clusters, task definitions, services, sns topics, sqs queues, quarantine buckets, and autoscaling policies.

Console.Error

Logs of when activities and actions intitiated by the Console encounter an error.

Console.FsxVolumes

Logs of when activities and actions intitiated by the Console encounter an error.

Console.GcpBuckets

Logs GCP bucket disvovery and management operations.

Console.Metering

Logs of when metering is submitted, and any errors that may occur during metering.

Console.Metrics

Logs of when cache for Console dashboard chart data is updated.

Console.Notifications

Logs notification configuration changes and dispatch events from the Console.

Console.RetroScan

Logs of when retro scanning starts and finishes per bucket as well as when queue entries are added.

Console.ScheduledScans

Logs scheduled AV scan job configuration and trigger events.

Console.ScheduledClassifications

Logs scheduled Classification scan job configuration and trigger events.

Console.StorageAssessment

Logs storage assessment orchestration and result processing from the Console.

Console.Subdomain

Logs of each time the console is assigned a new IP and when the subdomain is renamed.

Console.System

Logs of general Console system information and errors and the return of the entitlement verification.

Console.Updates

Logs of what updates are available and when an update is being performed.

Console.Users

Logs of all user activity including user creates/deletes, password resets, role changes.

Log groups for the Agent

Agent.ClassificationResults

Records the outcome of each individual data classification scan, split into four streams: matching, non-matching, error, and unclassifiable.

Agent.ClassificationStatistics

Logs aggregated per-bucket data classification object and byte counts, flushed on a configurable checkpoint interval.

Agent.Jobs

Logs job lifecycle events: creation, config, progress, and completion across both AV and Classification jobs.

Agent.Notifications

Logs outbound notifications sent to SNS topics, webhooks, and SecurityHub.

Agent.ScanConfig

Scan settings for the agent.

Settings include, but are not limited to:

  • Tags for the objects scanned

  • Actions taken on objects

  • Scan and skip lists

  • Bucket handling configuration

  • Classification Rules configuration for DLP

Note that the following snippet below has been shortened for brevity.

Agent.ScanResults

Scan results for clean, infected, error, or unscannable files.

Infected:

Clean:

Error:

Agent.ScanStatistics

Every-hour statistics of an agents activity for each bucket being monitored. These include the number of files scanned, the number of clean/infected/error files, and the total bytes scanned.

Agent.StorageAssessment

Every-hour statistics of an agents activity for each bucket being monitored. These include the number of files scanned, the number of clean/infected/error files, and the total bytes scanned.

Agent.SystemEvents

Logs of general Agent system information and errors.

Log groups for ECS

As of version 6.06 we enable ECS logging by default. These logs will be shown in the following log groups.

For each of these log groups you will see your seven character application ID in the title of each log group as noted below by the AppID between the ECS and type of ECS service the log is for.

ECS.AppID.API

Log groups related to the ECS API Agent Service

ECS.AppID.Console

Log groups related to the ECS Console Service

ECS.AppID.AVEvent

Log groups related to the ECS AV Event Agent Service

ECS.AppID.DCEvent

Log groups related to the ECS DC Event Agent Service

ECS.AppID.LargeFile

Log groups related to the Large File scan jobs

IAM Permissions Review

We have been able to simplify the management and delivery of the solution such that there are very few tasks the administrator is required to perform inside the AWS Console. As a result, the Console and EventAgent have a number of permissions assigned to them within their respective roles to allow them to perform the actions needed on your behalf. In all cases, we went with a least privilege model wherever possible. There are a few instances where we have assigned * when it is required. Below you will find a review of the two IAM Roles we create and assign to the Console and scanning Agents.

Please review and Contact Us if you have any questions we can clear up for you.

The permission descriptions below follow the format:

Console Roles (All Resources)
Console Permissions (Targeted Resources)
Agent Permissions (All Resources)
Agent Permissions (Targeted Resources)

Permissions Policies

Console Role

Trust Relationships

Customer Inline Policies

PoliciesCreation
ApiLb
AwsLicensing

Customer Managed Policies

Application-Resources-Policy
EC2-Management-Policy
Infrastructure-Management-Policy
Logging-And-Monitoring-Policy
Security-And-Access-Policy

AWS Managed Policies

AmazonECSInfrastructureRolePolicyForVolumes

Agent Role

Trust Relationships

Customer Inline Policies

Agent Policy

EC2 Container Role

Trust Relationships

Customer Inline Policies

EC2 Container Policy

AWS Managed Policies

AmazonEC2ContainerServiceforEC2Role

Event Bridge Role

Trust Relationships

Customer Inline Policies

Event Bridge Policy

Execution Role

Trust Relationships

AWS Managed Policies

AmazonECSTaskExecutionRolePolicy

User Pool Role

Trust Relationships

Customer Inline Policies

User Pool Policy

App Config Agent Configuration Document Role

Trust Relationships

Customer Inline Policies

App Config Agent Configuration Document Policy
PreviousArchitecture Overview
NextDeployment Details

Last updated