{"record":{"id":"16638e6d811fc6cc","repo":"crowdsecurity/crowdsec","slug":"invalid-event-body-for-event-bridge-format","errorCode":null,"errorMessage":"invalid event body for event bridge format","messagePattern":"invalid event body for event bridge format","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/s3/run.go","lineNumber":189,"sourceCode":"\t\t\tif newObject {\n\t\t\t\tlastObjectDate = *bucketObjects[len(bucketObjects)-1].LastModified\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunc extractBucketAndPrefixFromEventBridge(message *string) (string, string, error) {\n\teventBody := S3Event{}\n\n\tif err := json.Unmarshal([]byte(*message), &eventBody); err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\tif eventBody.Detail.Bucket.Name != \"\" {\n\t\treturn eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil\n\t}\n\n\treturn \"\", \"\", errors.New(\"invalid event body for event bridge format\")\n}\n\nfunc extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {\n\ts3notifBody := events.S3Event{}\n\n\tif err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\tif len(s3notifBody.Records) == 0 {\n\t\treturn \"\", \"\", errors.New(\"no records found in S3 notification\")\n\t}\n\n\tif !strings.HasPrefix(s3notifBody.Records[0].EventName, \"ObjectCreated:\") {\n\t\treturn \"\", \"\", fmt.Errorf(\"event %s is not supported\", s3notifBody.Records[0].EventName)\n\t}\n\n\treturn s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/s3/run.go#L171-L207","documentation":"Validation in extractBucketAndPrefixFromEventBridge: the SQS message body parsed as JSON but does not look like an AWS EventBridge event — the detail.bucket.name field is empty, so no bucket (and thus no object key) can be extracted. The caller tries this format first and falls through to other formats when it fails.","triggerScenarios":"Thrown at pkg/acquisition/modules/s3/run.go:189 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the SQS subscription is wired to EventBridge (or S3) notifications and not some other producer","Inspect the raw message body: valid EventBridge events carry detail.bucket.name and detail.object.key","If the messages are plain S3 notifications, the caller will detect that automatically — this error alone is not fatal"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}