Low cost, easy to configure with 10/10 support

• By Brian Q.
• on 10/25/2023

We have been using BucketAV for several months. While reviewing possible solutions for S3 AV scanners, a few key factors drew our attention to BucketAV:
- well documented installation instructructions
- choice of ClamAV or Sophos
- overall AWS overhead costs - based on usage
- integration within AWS, not a separate UI

Before I go into more detail, BucketAV has AAA support. We had questions ranging from multiple AWS accounts, on-demand and scheduled scanning, EC2 autoscaling and file upload queuing. The developers were always quick to respond and resolve my issues quickly, following up if they had not received a response.

We chose the ClamAV option as it suited our needs.
The installation instructions were very clear. The process of purchasing BucketAV from the AWS Marketplace to having a running default installation was minutes, not hours or days.

After installing BucketAV, modifying the parameters is done through an AWS CloudFront template. It is a very simple process to deploy change. The deployments are quick, so any changes can be tested and reverted within minutes or other tweaks added.

There are also add-ons available for scheduled scanning and reporting, also handled by CloudFront templates.

At the end of our installation and configuration our environments have:
- BucketAV scanning for all environments
- all environments are using spot instances
- on demand EC2s for all environments but production
- varying EC2 autoscaling based on the environment
- scanning one S3 bucket per environment
- immediate notification if a suspicious file is found
- on-demand full scan available
CloudWatch dashboard - this is part of the default BucketAV installation
Scheduled Scanning
- different schedules for different environments
Weekly/Monthly reports based on the Scheduled scanning

TL;DR: End user support 10/10, ease of installation, very customizable, easy to scale, low overhead cost, well integrated with AWS, ClamAV core.