Scanning of files in a customer account of a cloud service for cybersecurity
A cloud computing infrastructure hosts a web service with customer accounts. In a customer account, files of the customer account are listed in an index. Files indicated in the index are arranged in groups, with files in each group being scanned using scanning serverless functions in the customer account. The files in the customer account include a compressed tar archive of a software container. Member files of a compressed tar archive in a customer account are randomly-accessed by way of locators that indicate a tar offset, a logical offset, and a decompressor state for a corresponding member file. A member file is accessed by seeking to the tar offset in the compressed tar archive, restoring a decompressor to the decompressor state, decompressing the compressed tar archive using the decompressor, and moving to the logical offset in the decompressed data in memory.
1 . A cloud computing infrastructure that is accessible over the Internet, the cloud computing infrastructure comprising a memory and at least one processor, the memory storing instructions that when executed by the at least one processor cause the cloud computing infrastructure to:
host a cloud service;
provide a plurality of scanning serverless functions in a customer account of the cloud service, the plurality of scanning serverless functions being stateless and ephemeral;
identify a plurality of files of the customer account;
store a listing of the plurality of files of the customer account in a first storage of the customer account;
group the plurality of files indicated in the listing into a plurality of groups; and
in the customer account, for each group of the plurality of groups, scan files that belong to the group for cybersecurity using scanning serverless functions of the plurality of scanning serverless functions.
2 . The cloud computing infrastructure of claim 1 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the cloud computing infrastructure to:
in the customer account, create a snapshot of a second storage of the customer account that stores the plurality of files, the snapshot being a point-in-time copy of the second storage; and
in the customer account, parse the snapshot to identify the plurality of files.
3 . The cloud computing infrastructure of claim 2 , wherein the first storage is an object-level storage provided as a service by the cloud service, and the second storage is a block-level storage provided as a service by the cloud service.
4 . The cloud computing infrastructure of claim 1 , wherein files that belong to each group of the plurality of groups are scanned in sequence, and scanning of files in a group of the plurality of groups is performed in parallel with scanning of files in another group of the plurality of groups.
5 . The cloud computing infrastructure of claim 1 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the cloud computing infrastructure to send a report from the customer account to a cybersecurity account in the cloud service, the report indicating a result of scanning the plurality of files using the plurality of scanning serverless functions.
6 . A method of scanning a plurality of files of a customer account of a cloud service for cybersecurity, the method comprising:
providing a plurality of scanning serverless functions in the customer account, the plurality of scanning serverless functions being stateless and ephemeral;
identifying the plurality of files of the customer account;
storing a listing of the plurality of files of the customer account in a first storage of the customer account;
grouping the plurality of files indicated in the listing into a plurality of groups; and
for each group of the plurality of groups, scanning files that belong to the group for cybersecurity using scanning serverless functions of the plurality of scanning serverless functions.
7 . The method of claim 6 , further comprising:
creating a snapshot of a second storage of the customer account that stores the plurality of files, the snapshot being a point-in-time copy of the second storage; and
parsing the snapshot to identify the plurality of files.
8 . The method of claim 7 , wherein the first storage is an object-level storage provided as a service by the cloud service, and the second storage is a block-level storage provided as a service by the cloud service.
9 . The method of claim 6 , wherein files that belong to each group of the plurality of groups are scanned in sequence, and scanning of files in a group of the plurality of groups is performed in parallel with scanning of files in another group of the plurality of groups.
10 . The method of claim 6 , further comprising:
sending a report from the customer account to a cybersecurity account in the cloud service, the report indicating a result of scanning the plurality of files using the plurality of scanning serverless functions.