CypherScan Agent integration

Amazon S3

Turn S3 ObjectCreated events into autonomous CypherScan Agent observations. The connector runs as an AWS Lambda inside your AWS account and only needs permission to read the protected objects.

Create API key Open Agent

Setup

STEP 1

Create an API key

Create a CypherScan API key from your dashboard and keep it private.

STEP 2

Prepare AWS

Install and authenticate the AWS CLI and AWS SAM CLI in the account that owns the bucket.

STEP 3

Build the connector

From integrations/aws-s3, run sam validate and sam build.

STEP 4

Deploy the stack

Run sam deploy --guided and provide your bucket, optional prefix, CypherScan URL, and API key.

STEP 5

Connect S3 events

Allow your bucket to invoke the Lambda and configure an s3:ObjectCreated notification targeting it.

STEP 6

Validate

Upload a clean object and confirm the new S3 asset and observation in CypherScan Agent.

Build and deploy

cd integrations/aws-s3
sam validate
sam build
sam deploy --guided

Connect ObjectCreated

After deployment, allow the S3 bucket to invoke the Lambda and add an ObjectCreated notification targeting that function. Use the same prefix in the notification filter if you configured BucketPrefix.

aws lambda add-permission   --function-name YOUR_FUNCTION_NAME   --statement-id AllowS3Invoke   --action lambda:InvokeFunction   --principal s3.amazonaws.com   --source-arn arn:aws:s3:::YOUR_BUCKET   --source-account YOUR_AWS_ACCOUNT_ID

S3 notification event:
s3:ObjectCreated:*

Expected result

A successful object event creates or updates an S3_BUCKET asset and records its security observation. Qualifying changes can then flow through Controller verification, attention decisions, alerts, and Agent activity.

Never commit your CypherScan API key to a repository or expose it in browser-side code.