AWS Builder Center

Builder Center

Automated File Quarantine Guard: Event-Driven Cloud Security with S3, Lambda, and SNS

Automated File Quarantine Guard: Event-Driven Cloud Security with S3, Lambda, and SNS

Learn how to build an event-driven file inspector on AWS using S3, Lambda, and SNS. This beginner-friendly guide walks through automatically quarantining unauthorized file uploads with zero server management and zero idle costs.

How I Built an Event-Driven File Quarantine Guard on AWS using S3, Lambda, and SNS

When building modern cloud applications, allowing users or services to upload files directly into your storage can introduce risks: corrupted files, bad extensions, or unauthorized sizes. Instead of running a 24/7 EC2 server to monitor incoming files, you can build a lightweight, event-driven pipeline that inspects every upload the millisecond it arrives.
Here is how I built a zero-cost Automated File Quarantine Guard using serverless AWS services.

🏗️ Architecture Overview

The pipeline uses three core AWS services working in tandem:
  1. Amazon S3 (intake-bucket): Landing zone for incoming file uploads.
  2. AWS Lambda (file-inspector): Triggered automatically by S3 ObjectCreated events. It parses file headers, checks extensions, and verifies size thresholds.
  3. Amazon S3 (safe-vault) / Amazon SNS: If the file passes validation, Lambda routes it to the clean vault. If it fails, Lambda quarantines the file and triggers an SNS notification alert.
1
2
3
4
5
6
7
8
9
10
11
[ File Upload ] ➡️ [ S3 Intake Bucket ] ⚡ (S3 Event Trigger)
│
▼
[ AWS Lambda Function ]
│
┌─────────────┴─────────────┐
▼ ▼
[ Pass Validation ] [ Fail Validation ]
│ │
▼ ▼
[ S3 Safe Vault ] [ SNS Email Alert ]

🛠️ Step-by-Step Implementation

Step 1: Create S3 Buckets

Create two S3 buckets in the same region:
  • my-app-intake-vault
  • my-app-clean-vault

Step 2: Configure SNS Topic for Alerts

  1. Open the Amazon SNS console and create a Standard Topic named QuarantineAlerts.
  2. Create an Email Subscription to receive alerts when invalid files are uploaded. Confirm the subscription from your inbox.

Step 3: Write the Serverless Inspector (Python 3.12)

Create an AWS Lambda function named inspect_file with the Python 3.12 runtime. Attach an execution role with s3:GetObject, s3:PutObject, and sns:Publish permissions.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
import json
import urllib.parse
import boto3

s3 = boto3.client('s3')
sns = boto3.client('sns')

TARGET_BUCKET = 'my-app-clean-vault'
SNS_TOPIC_ARN = 'arn:aws:sns:us-east-1:123456789012:QuarantineAlerts'
ALLOWED_EXTENSIONS = ('.pdf', '.png', '.jpeg', '.jpg')
MAX_SIZE_BYTES = 5 * 1024 * 1024 # 5 MB limit

def lambda_handler(event, context):
# Parse bucket and key from S3 Event
source_bucket = event['Records'][0]['s3']['bucket']['name']
key = urllib.parse.unquote_plus(event['Records'][0]['s3']['object']['key'], encoding='utf-8')
file_size = event['Records'][0]['s3']['object']['size']

# 1. Validation Checks
is_valid_ext = key.lower().endswith(ALLOWED_EXTENSIONS)
is_valid_size = file_size <= MAX_SIZE_BYTES

if is_valid_ext and is_valid_size:
# Move to Clean Vault
copy_source = {'Bucket': source_bucket, 'Key': key}
s3.copy_object(CopySource=copy_source, Bucket=TARGET_BUCKET, Key=key)
s3.delete_object(Bucket=source_bucket, Key=key)

return {
'statusCode': 200,
'body': json.dumps(f'Successfully validated and moved {key}')
}
else:
# Send Quarantine Notification
reason = "Disallowed File Extension" if not is_valid_ext else "Exceeded 5MB Size Limit"
message = f"SECURITY ALERT: File '{key}' failed quarantine check.\nReason: {reason}\nSize: {file_size} bytes"

sns.publish(
TopicArn=SNS_TOPIC_ARN,
Subject="File Quarantine Alert",
Message=message
)

return {
'statusCode': 400,
'body': json.dumps(f'Quarantined {key}: {reason}')
}

Step 4: Set Up the S3 Event Trigger

In the S3 console for my-app-intake-vault, go to Properties ➡️ Event Notifications ➡️ Create Event Notification:
  • Event Types: All object create events (s3:ObjectCreated:*)
  • Destination: Lambda Function (inspect_file)

🧪 Testing the Quarantine Guard

  1. Valid Upload Test: Upload a document.pdf under 5MB to my-app-intake-vault. The file is automatically inspected and moved to my-app-clean-vault.
  2. Invalid Extension Test: Upload an executable.exe file. The Lambda function rejects it and triggers an immediate SNS notification email.
  3. Over-sized File Test: Upload a 10MB JPEG. The Lambda flags the file size violation instantly.

💡 Key Takeaways

  • Serverless Cost Efficiency: You run zero background servers. AWS only bills for the milliseconds Lambda spends inspecting the file during execution.
  • Decoupled Architecture: Using S3 events and SNS notifications ensures components are loosely coupled and easy to scale or update independently.
  • Built-in Security: Input validation happens before files enter your production environment or database layer.
# aws-lambda# amazon-s3# amazon-sns
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article