API Agent is an in-tenant service that scans files during upload to AWS storage services. It operates entirely within a customer's AWS account using native services such as Cognito, DynamoDB, SNS, and CloudWatch, and it can block malicious or non-compliant content before the files are written to S3. The agent supports both synchronous (real-time) scanning for immediate verdicts and asynchronous (background) scanning for high-throughput pipelines, storing scan states in DynamoDB and publishing results via SNS.
The service employs multiple antivirus engines for malware detection and performs sensitive data classification to identify PII and regulated information at ingestion. Scan logs are written to CloudWatch, enabling integration with monitoring, SIEM, and alerting workflows, while the in-tenant design satisfies data residency, privacy, and zero-trust requirements.
