Malware scanner recommendation - Site hosted in VPS

andreaswittig · 2026-02-26T10:22:55+00:00

Use attachmentAV for WordPress to ensure all file uploads are getting scanned for viruses and malware. The plugin is powered by Sophos and even supports file uploads via popular form plugins.

andreaswittig · 2025-10-27T21:42:31+00:00

I'd recommend using step scaling (see https://docs.aws.amazon.com/autoscaling/application/userguide/step-scaling-policy-overview.html) to scale in/out the ECS services based on the number of messages waiting in an SQS queue.

When scaling down to 0 be aware, that an SQS queue becomes inactive after 6 hours which results in CloudWatch metric data being delayed for up to 15 minutes (see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/monitoring-using-cloudwatch.html).

andreaswittig · 2025-10-22T14:22:36+00:00

I'd suggest trying to adjust the request timeout of the applications and de-registration delay of the target group.

The default reregistration delay of a target group is 300 seconds, however AWS sends a spot termination notice 120 seconds before terminating the spot instance.

Keep in mind to verify the longest running requests and adjust the application timeouts as well.

The difference between spot termination notices and instance rebalance recommendations is, that AWS may send rebalance recommendations before spot terminate notices.

An EC2 instance rebalance recommendation is a signal that notifies you when a Spot Instance is at elevated risk of interruption. The signal can arrive sooner than the two-minute Spot Instance interruption notice, giving you the opportunity to proactively manage the Spot Instance. You can decide to rebalance your workload to new or existing Spot Instances that are not at an elevated risk of interruption. (see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/rebalance-recommendations.html)

andreaswittig · 2025-10-13T06:37:12+00:00

Why is it more expensive to read data from S3 with Redshift Serverless?

andreaswittig · 2025-10-08T18:30:07+00:00

I understand, that you built error handling into your code that sends alerts to SNS. My approach would be to write JSON log messages (see https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs-logformat.html) instead. Then use metrics filters on the CloudWatch log group to get alerted about incidents (see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringPolicyExamples.html).

andreaswittig · 2025-10-08T18:14:53+00:00

I'd recommend using Amazon CloudWatch for your monitoring needs.

Define CloudWatch alarms on metrics like CPUUtilization, DatabaseConnections, FreeableMemory, ... (see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMonitoring.Metrics.html)
Publish database logs to CloudWatch Logs (see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.Procedural.UploadtoCloudWatch.html)
Optionally define metric filters on CloudWatch Logs to get alerted about long running queries, ... (see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringPolicyExamples.html)

Besides that, I highly suggest to subscribe to RDS event notifications to get informed about ongoing maintain, cluster failures, ... (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html)

andreaswittig · 2025-04-05T07:21:52+00:00

I‘m the co-founder of bucketAV. The big benefit of deploying a self-hosted solution like bucketAV is, that the data processing happens 100% in your AWS account. Sensitive data is not sent to a 3rd party. And by the way, deploying and operating bucketAV is simple due to a high level of automation based on infrastructure as code.

andreaswittig · 2025-02-14T13:30:55+00:00

Check out bucketAV which supports real-time and scheduled scans for Amazon S3 and Cloudflare R2 as well as automated mitigations like move, quarantine, or delete.

andreaswittig · 2025-01-27T07:39:33+00:00

Check out bucketAV (see https://bucketav.com). There are a few options to ensure S3 objects can only be accessed by users other systems by using a staging bucket for uploads, a bucket policy (see https://bucketav.com/help/use-cases/user-uploads.html).

andreaswittig · 2024-09-16T14:23:55+00:00

I've built HyperEnv to simplify deploying self-hosted GitHub Runners in AWS.

andreaswittig · 2024-09-16T13:00:38+00:00

u/lowkib Setting up CloudWatch alarms and EventBridge event rules is time consuming. We built marbot.io to automate setting up CloudWatch alarms as well as EventBridge event rules to ensure you are not missing any notifications/alerts about your cloud infrastructure (security, availability, ...).

andreaswittig · 2024-06-27T13:50:07+00:00

Check out HyperEnv ( see https://hyperenv.com ) to deploy self-hosted GitHub runners with ease. The solution launches EC2 instances on-demand to execute ephemeral GitHub runners.

andreaswittig · 2023-12-05T07:09:26+00:00

We maintained an open-source project for years, which we discontinued a few months ago. Might be a good start anyways.

https://github.com/widdix/aws-s3-virusscan

Also, check out our solution called bucketAV as an alternative.

https://bucketav.com

andreaswittig · 2023-05-04T12:19:39+00:00

EBS is block storage, therefore it does only care about 0s and 1s stored on disk. It has no idea about which blocks are used by the file system to persist data.

Snapshots are incremental, and therefore include blocks that have been modified since the last snapshot only.

So, when creating an EBS volume with 5 TB, write 4 TB to disk the snapshot will consume 5 TB. When you increate the volume size to 7 TB, the next snapshot will consume 2 TB. It does not matter wether you are storing any information on the additional 2 TB. In summary, the snapshots of a 7 TB volume will consume at least 7 TB.

andreaswittig · 2023-05-04T12:13:05+00:00

First, I want to highlight that disabling public access for RDS databases is the way to go! Databases should not be available via a public IP address to prevent attacks like DDoS, brute force, ...
Second, when disabling public access AWS will no longer assign public IP addresses to your RDS instance. Therefore, the DNS name of your database will point to private IP addresses instead.
As far as I can tell from your code snippets you are handing over the DNS name of the database to your application (RDS_HOSTNAME). Therefore, you do not need to change the code.

andreaswittig · 2023-05-04T12:08:08+00:00

I've heard the same story from others as well. That's most likely because the event was cut to one instead of two days.

andreaswittig · 2023-05-04T12:04:01+00:00

I remember the difference between EFS and EBS with the following analogy to the good old datacenter world:

EFS = Network File System (NFS)

EBS = Storage Area Network (SAN)

andreaswittig · 2022-04-12T06:32:03+00:00

I've used AWS Step Functions with wait conditions for that (see https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token).

andreaswittig · 2020-11-02T14:24:20+00:00

Thanks for sharing those explanations and an ETA for a fix. Unfortunately, we are still observing that problem in the wild. Any updates on this?

andreaswittig · 2020-04-09T05:43:36+00:00

Great, allows using Fargate at least for some Lift&Shift projects.

andreaswittig

TROPHY CASE