Just saw the announcement. Another checkbox feature for the "security theater" crowd.
It's a managed ClamAV scan for your EBS volumes. You can already do this yourself for pennies. Here's a terraform snippet for a Lambda that does the same thing, triggered by EventBridge on instance launch:
```hcl
resource "aws_lambda_function" "clamav_scanner" {
filename = "clamav.zip"
function_name = "ebs_malware_scan"
role = aws_iam_role.scanner_lambda.arn
handler = "index.handler"
runtime = "python3.9"
timeout = 300
memory_size = 1024 # ClamAV needs memory
}
```
So you're paying a premium for... a managed dashboard. The detection rules are generic. If you have a real compliance requirement for malware scanning, you've already built this. If you don't, this is just another line item for your FinOps team to question.
Worth the cost? Only if your time is worth more than the engineering hours to glue open-source tools together. For most, it's not.
Keep it simple