{"record":{"id":"da6f4abb57f84388","repo":"crowdsecurity/crowdsec","slug":"failed-to-get-object-s-s-w","errorCode":null,"errorMessage":"failed to get object %s/%s: %w","messagePattern":"failed to get object (.+?)/(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/s3/run.go","lineNumber":353,"sourceCode":"\t}\n}\n\nfunc (s *Source) readFile(bucket string, key string) error {\n\t// TODO: Handle SSE-C\n\tvar scanner *bufio.Scanner\n\n\tlogger := s.logger.WithFields(log.Fields{\n\t\t\"method\": \"readFile\",\n\t\t\"bucket\": bucket,\n\t\t\"key\":    key,\n\t})\n\n\toutput, err := s.s3Client.GetObject(s.ctx, &s3.GetObjectInput{\n\t\tBucket: aws.String(bucket),\n\t\tKey:    aws.String(key),\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get object %s/%s: %w\", bucket, key, err)\n\t}\n\tdefer output.Body.Close()\n\n\tif strings.HasSuffix(key, \".gz\") {\n\t\t// This *might* be a gzipped file, but sometimes the SDK will decompress the data for us (it's not clear when it happens, only had the issue with cloudtrail logs)\n\t\theader := make([]byte, 2)\n\n\t\t_, err := output.Body.Read(header)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read header of object %s/%s: %w\", bucket, key, err)\n\t\t}\n\n\t\tif header[0] == 0x1f && header[1] == 0x8b {\n\t\t\tgz, err := gzip.NewReader(io.MultiReader(bytes.NewReader(header), output.Body))\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create gzip reader for object %s/%s: %w\", bucket, key, err)\n\t\t\t}\n\t\t\tscanner = bufio.NewScanner(gz)","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/s3/run.go#L335-L371","documentation":"readFile calls s3Client.GetObject for the given bucket/key and wraps any SDK failure in this error. It means the object could not be fetched from S3 (network, permissions, missing object, bad credentials).","triggerScenarios":"GetObject returns an error: object deleted between notification and read, missing s3:GetObject permission, wrong region, expired credentials, or connectivity problems.","commonSituations":"Notifications arriving for objects already lifecycle-deleted; IAM policies lacking s3:GetObject on the prefix; cross-account buckets; misconfigured region causing 301 errors.","solutions":["Verify the bucket/key still exists (aws s3 api get-object or console).","Grant the credentials' IAM principal s3:GetObject on bucket/prefix.","Check the configured region/endpoint matches the bucket.","Confirm credentials are valid and not expired (env vars, instance role, profile)."],"exampleFix":"// before: policy without read access\n// after: add to the IAM policy\n{\"Effect\": \"Allow\", \"Action\": [\"s3:GetObject\"], \"Resource\": [\"arn:aws:s3:::my-bucket/*\"]}","handlingStrategy":"retry","validationCode":"// pre-check with a head request\n_, err := client.HeadObject(ctx, &s3.HeadObjectInput{Bucket: aws.String(b), Key: aws.String(k)})\nif err != nil { /* object missing or not readable */ }","typeGuard":null,"tryCatchPattern":"if err := readFile(bucket, key); err != nil {\n    if errors.Is(err, context.DeadlineExceeded) || isRetryable(err) {\n        // requeue with backoff\n    } else {\n        log.Errorf(\"permanent failure reading %s/%s: %v\", bucket, key, err)\n    }\n}","preventionTips":["Grant s3:GetObject on the exact bucket/prefix in the IAM policy.","Match the client region/endpoint to the bucket.","Use credential sources that auto-renew (instance roles, web identity).","Prefer notification-driven reads so objects exist before reading."],"tags":["aws","s3","network","permissions"],"backgroundTag":"resource-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}