{"record":{"id":"6a32647a092c952e","repo":"crowdsecurity/crowdsec","slug":"no-records-found-in-s3-notification","errorCode":null,"errorMessage":"no records found in S3 notification","messagePattern":"no records found in S3 notification","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/s3/run.go","lineNumber":200,"sourceCode":"\t\treturn \"\", \"\", err\n\t}\n\n\tif eventBody.Detail.Bucket.Name != \"\" {\n\t\treturn eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil\n\t}\n\n\treturn \"\", \"\", errors.New(\"invalid event body for event bridge format\")\n}\n\nfunc extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {\n\ts3notifBody := events.S3Event{}\n\n\tif err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\tif len(s3notifBody.Records) == 0 {\n\t\treturn \"\", \"\", errors.New(\"no records found in S3 notification\")\n\t}\n\n\tif !strings.HasPrefix(s3notifBody.Records[0].EventName, \"ObjectCreated:\") {\n\t\treturn \"\", \"\", fmt.Errorf(\"event %s is not supported\", s3notifBody.Records[0].EventName)\n\t}\n\n\treturn s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil\n}\n\nfunc extractBucketAndPrefixFromSNSNotif(message *string) (string, string, error) {\n\tsnsBody := SNSEvent{}\n\n\tif err := json.Unmarshal([]byte(*message), &snsBody); err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\t// It's just a SQS message wrapped in SNS\n\treturn extractBucketAndPrefixFromS3Notif(&snsBody.Message)","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/s3/run.go#L182-L218","documentation":"Validation in extractBucketAndPrefixFromS3Notif: the message body unmarshalled as an S3 notification event but its Records array is empty, so there is no event record to take bucket/key from. Reached from extractBucketAndPrefix(SNSNotif) and the direct format probe; a failure here lets the format detection fall through.","triggerScenarios":"Thrown at pkg/acquisition/modules/s3/run.go:200 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the S3 notification configuration — it emitted an event envelope with no records","Confirm the queue receives ObjectCreated:* notifications (the first record's event name must start with 'Object')","Capture one message body and validate it against the S3 notification schema"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}