{"record":{"id":"88919b3ac111d6c6","repo":"crowdsecurity/crowdsec","slug":"sqs-message-format-not-supported","errorCode":null,"errorMessage":"SQS message format not supported","messagePattern":"SQS message format not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/s3/run.go","lineNumber":260,"sourceCode":"\t\tbucket, key, err := extractBucketAndPrefixFromEventBridge(message)\n\t\tif err == nil {\n\t\t\ts.Config.SQSFormat = SQSFormatEventBridge\n\t\t\treturn bucket, key, nil\n\t\t}\n\n\t\tbucket, key, err = extractBucketAndPrefixFromS3Notif(message)\n\t\tif err == nil {\n\t\t\ts.Config.SQSFormat = SQSFormatS3Notification\n\t\t\treturn bucket, key, nil\n\t\t}\n\n\t\tbucket, key, err = extractBucketAndPrefixFromSNSNotif(message)\n\t\tif err == nil {\n\t\t\ts.Config.SQSFormat = SQSFormatSNS\n\t\t\treturn bucket, key, nil\n\t\t}\n\n\t\treturn \"\", \"\", errors.New(\"SQS message format not supported\")\n\t}\n}\n\nfunc (s *Source) sqsPoll() error {\n\tlogger := s.logger.WithField(\"method\", \"sqsPoll\")\n\n\tfor {\n\t\tselect {\n\t\tcase <-s.t.Dying():\n\t\t\tlogger.Infof(\"Shutting down SQS poller\")\n\t\t\ts.cancel()\n\t\t\treturn nil\n\t\tdefault:\n\t\t\tlogger.Trace(\"Polling SQS queue\")\n\n\t\t\tout, err := s.sqsClient.ReceiveMessage(s.ctx, &sqs.ReceiveMessageInput{\n\t\t\t\tQueueUrl:            aws.String(s.Config.SQSName),\n\t\t\t\tMaxNumberOfMessages: 10,","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/s3/run.go#L242-L278","documentation":"Terminal failure in extractBucketAndPrefix (called by sqsPoll): the SQS message matched none of the three supported envelope formats — EventBridge, raw S3 notification, or SNS-wrapped S3 notification — each attempt returning an error. This is a fallback chain exhausted: the message on the queue is in an unrecognized format and cannot be mapped to a bucket/object to fetch.","triggerScenarios":"Thrown at pkg/acquisition/modules/s3/run.go:260 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Dump the offending SQS message body and compare it with the three supported schemas","Route only S3/EventBridge/SNS S3-notifications to this queue; other producers are unsupported","After a format is first detected, SQSFormat pins it so later messages parse directly — fix the producer so the first message is well-formed"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}