Skip to main content

Using iScan for Cloud and Local Resources

© 2024 Elastio Software, Inc. All Rights Reserved.

Using iScan for Cloud and Local Resources

Elastio
Updated

Content

Elastio Integrity Scan

The Elastio Integrity Scan (iScan) capability provides comprehensive scanning options for cloud and local resources, ensuring data integrity and detecting ransomware or malware infections. 

Available through the elastio iscan command within the Elastio CLI, it supports a wide range of scan targets, including AWS EBS volumes and snapshots, EC2 instances, AMIs, AWS Backup Recovery Points, EFS, and S3 buckets. 

For AWS snapshots, Elastio automatically assigns tags to indicate the scan results: elastio:iscan:clean for clean snapshots and elastio:iscan:infected for infected ones. 

The tool also supports partial scans of S3 buckets and local paths, as well as Azure VMs, managed disks, snapshots, and data protection recovery points. 

Note: For large S3 buckets exceeding 10 million objects, users are encouraged to contact Elastio support to optimize performance. This robust scanning capability ensures efficient management and recovery of clean data across diverse environments.

elastio iscan

Note: Specific configurations, such as NTFS support on Amazon Linux 2 and EFS mount point availability, may be required for successful scans. The ntfs-3g should be present.  

To install it run:

sudo yum install ntfs-3g

AWS EBS Volumes

elastio iscan --ebs-volume-id <aws-eba-volume-id>

AWS EBS Snapshots

For AWS snapshot scans, Elastio automatically assigns specific tags to indicate the scan results:

  • elastio:iscan:clean: This tag is propagated to the snapshot if the scan determines it to be clean and free of any ransomware or malware.
  • elastio:iscan:infected: This tag is assigned to the snapshot if the scan detects ransomware or malware infection.

These tags allow users to quickly identify the status of their snapshots and facilitate efficient management of clean and infected data for recovery or further investigation.

elastio iscan --ebs-snapshot <aws-ebs-snapshot-id>

AWS EC2 instances

elastio iscan --ec2-instance-id <aws-ec2-instance-id>

AWS AMIs

elastio iscan --ami <aws-ami-id>

AWS EFS

⚠️ Please, note: EFS mount points should be available in all availability zones, where Elastio vault is installed, for the scan to work correctly. Those can be configured at the time of EFS creation or by adding it at a later time. See example list of mount points below:

elastio iscan --efs-id <aws-efs-id>

AWS S3 Buckets

⚠️ Important! ⚠️ S3 object count, when exceeding certain limits, can negatively impact Elastio S3 scan performance. We do not recommend using the S3 scanning feature on buckets with more than 10 million objects. If you need to scan more than 10M objects in a bucket, please contact Elastio support for assistance.

elastio iscan --s3-bucket <aws-s3-bucket-name

Partial AWS S3 bucket scan

elastio iscan --s3-bucket <aws-s3-bucket-name> --s3-prefixes <bucket-folder>
elastio iscan --s3-bucket <aws-s3-bucket-name> --s3-keys <bucket-file-path>
elastio iscan --s3-bucket <aws-s3-bucket-name> --s3-glob <bucket-file>*

AWS Backup Recovery Points

elastio iscan --aws-rp <aws-backup-rp-arn>

Azure VMs

elastio iscan --azure-vm-id <azure-vm-id>

Azure Managed Disks

elastio iscan --azure-managed-disk-id <azure-managed-disk-id>

Azure managed disk snapshot

elastio iscan --azure-managed-disk-snap-id <azure-managed-disk-snapshot-id>

Azure data protection recovery point

elastio iscan --azure-data-protection-rp-id <azure-data-protection-rp-id>

Local Path ( Local files and file systems )

elastio iscan --path <local-path>

 

Related articles