crowdsecurity/crowdsec · warning

event is not supported

Error message

event %s is not supported

What it means

extractBucketAndPrefixFromS3Notif parses S3 event notification payloads. Only ObjectCreated:* events are supported; any other EventName in the first record is rejected. This propagates up through SNS notifications and direct S3 notification handling.

Solutions

1. Configure the S3 bucket notification (or SNS subscription filter) to deliver only ObjectCreated:* events, e.g. filter suffix/prefix and event type s3:ObjectCreated:*.
2. Ignore or route ObjectRemoved/lifecycle events to a different consumer.
3. If deletion tracking is needed, it is unsupported by this source — process those events elsewhere.

Example fix

// before: bucket notification config sends s3:ObjectRemoved:* too
// after: restrict the notification configuration to
{"Events": ["s3:ObjectCreated:*"]}

var n struct{ Records []struct{ EventName string } `json:"Records"` }
if json.Unmarshal([]byte(body), &n) == nil && len(n.Records) > 0 && !strings.HasPrefix(n.Records[0].EventName, "ObjectCreated:") {
    return fmt.Errorf("skipping unsupported event %s", n.Records[0].EventName)
}

if _, _, err := extractBucketAndPrefix(body); err != nil {
    log.Warnf("ignoring unsupported S3 notification: %v", err)
    return // skip, do not treat as fatal
}

When it happens

Trigger: An S3 notification (direct or via SNS) whose Records[0].EventName is e.g. ObjectRemoved:Delete, LifecycleExpiration, or Replication events is fed to the source.

Common situations: Pointing the S3 source at a queue/topic that also receives ObjectRemoved deletion markers or lifecycle events; testing notifications of the wrong type; versioning enabled so delete events flow in.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• invalid DSN for S3 source
• invalid DSN for S3 source, must start with s3://
• invalid value for 'max_buffer_size
• unknown level
• unknown parameter

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b6938063b577f630. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/s3/run.go:204

		return eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil
	}

	return "", "", errors.New("invalid event body for event bridge format")
}

func extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {
	s3notifBody := events.S3Event{}

	if err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {
		return "", "", err
	}

	if len(s3notifBody.Records) == 0 {
		return "", "", errors.New("no records found in S3 notification")
	}

	if !strings.HasPrefix(s3notifBody.Records[0].EventName, "ObjectCreated:") {
		return "", "", fmt.Errorf("event %s is not supported", s3notifBody.Records[0].EventName)
	}

	return s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil
}

func extractBucketAndPrefixFromSNSNotif(message *string) (string, string, error) {
	snsBody := SNSEvent{}

	if err := json.Unmarshal([]byte(*message), &snsBody); err != nil {
		return "", "", err
	}

	// It's just a SQS message wrapped in SNS
	return extractBucketAndPrefixFromS3Notif(&snsBody.Message)
}

func (s *Source) extractBucketAndPrefix(message *string) (string, string, error) {
	switch s.Config.SQSFormat {

View on GitHub (pinned to 909b515798)