AWS guardduty documentation change
Summary
Updated Malware Protection for S3 quotas: increased file extraction limits and nested archive depth
Security assessment
Documents increased capacity of security feature (malware scanning) but shows no evidence of vulnerability remediation
Diff
diff --git a/guardduty/latest/ug/malware-protection-s3-quotas-guardduty.md b/guardduty/latest/ug/malware-protection-s3-quotas-guardduty.md index 92663ab5a..605fffebb 100644 --- a//guardduty/latest/ug/malware-protection-s3-quotas-guardduty.md +++ b//guardduty/latest/ug/malware-protection-s3-quotas-guardduty.md @@ -16 +16 @@ Maximum S3 object size | 100 GB | No | The maximum S3 object size that GuardD -Extracted archive bytes | 100 GB | No | The maximum amount of data that GuardDuty can extract and analyze from an archive file. GuardDuty will skip archive files extracting to more than 100 GB. +Extracted files | 100,000 | No | The maximum number of files that GuardDuty can extract and analyze in an S3 object. @@ -20,2 +20 @@ Extracted archive bytes | 100 GB | No | The maximum amount of data that Guard -Files with an extremely high compression ratio between the compressed archive size and the extracted content size may be subject to limits even if the extracted content size is below this quota. -Extracted archive files | 10,000 | No | The maximum number of files that GuardDuty can extract and analyze in an archive file. If the archive contains more than 10,000 files, then GuardDuty will have to skip the archived file. +Compound files types are potentially subject to these limits. The file types include, but are not limited to, Multipurpose Internet Mail Extensions (MIME) encoded email messages, Compiled Python (PYC) files, Compiled HTML Help (CHM) files, all installers, and OpenDocument Format (ODF) documents. @@ -25,2 +24,2 @@ Extracted archive files | 10,000 | No | The maximum number of files that Guar -Compound files types are potentially subject to these limits. The file types include, but are not limited to, Multipurpose Internet Mail Extensions (MIME) encoded email messages, Compiled Python (PYC) files, Compiled HTML Help (CHM) files, all installers, and OpenDocument Format (ODF) documents. -Maximum archive depth levels | 5 | No | The maximum levels of nested archives that GuardDuty can extract. If the archive includes files that are nested beyond this value, then GuardDuty will skip those nested files. +S3 objects with an extremely high compression ratio between the S3 object size and the extracted content size may be subject to limits even if the extracted files are below this quota. +Maximum depth levels | 100 | No | The maximum levels of nesting that GuardDuty can extract in an S3 object.