Allow virus definition process to be used without scanning

[bibliotechy]

First off, thanks for all the work on this. Incredibly useful!

I'd like to suggest that the part of the construct that defines and updates the virus definitions should be separable from the part that triggers and runs the scans.

One of our use cases does not trigger scans on object creation in a bucket, but on other events. For example, we want to be able to re-scan objects in a bucket in the future to leverage new virus definitions.

Whatever the trigger of the scan, the updating of virus definitions would remain the same. We'd like to be able to define a single virus definition update process and single definitions bucket and use it with various scanning use cases.

[dontirun]

Thanks for the feedback!

I'd like to understand the ask a bit more. By separable do you mean

1. A less strict bucket policy so that other resources, not in the VPC, can access the bucket?
2. The definitions update section portion is launched without the scanning function?

[bibliotechy]

I'm definitely thinking about number 2.

While the scan function and trigger defined in this construct makes a lot of sense for many use cases, it doesn't fit one of our current use cases. Right now, in order to be able to use the definitions update parts (which do still work for our use case), I need to fork this construct and replace scan function and trigger.

It'd be nice if under the hood of cdk-serverless-clamscan, there were two separate pieces, like a Definitions Update Stack and a Scan Stack (that takes in the Definitions location as a parameter), which the construct then ties together nicely as it currently does. That way I could use the Definitions Update Stack along with my own custom Scan Stack without having to fork or duplicate the work you have already done.

Additionally, we actually have several use cases for triggering scans, and it would be nice to be able to re-use definitions across the all of them instead of having to run a separate definitions update process for each use case.

[dontirun]

I'd like to brainstorm a proper way to implement this without losing the secure defaults around the virus definitions bucket.
It may make sense to expose the definitions bucket, but I'm not sure if it makes sense to remove the Virus Scanning portion from the construct.

Happy to discuss further