crowdsecurity/crowdsec · warning

event %s is not supported

Error message

event %s is not supported

What it means

extractBucketAndPrefixFromS3Notif parses S3 event notification payloads. Only ObjectCreated:* events are supported; any other EventName in the first record is rejected. This propagates up through SNS notifications and direct S3 notification handling.

Source

Thrown at pkg/acquisition/modules/s3/run.go:204

		return eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil
	}

	return "", "", errors.New("invalid event body for event bridge format")
}

func extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {
	s3notifBody := events.S3Event{}

	if err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {
		return "", "", err
	}

	if len(s3notifBody.Records) == 0 {
		return "", "", errors.New("no records found in S3 notification")
	}

	if !strings.HasPrefix(s3notifBody.Records[0].EventName, "ObjectCreated:") {
		return "", "", fmt.Errorf("event %s is not supported", s3notifBody.Records[0].EventName)
	}

	return s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil
}

func extractBucketAndPrefixFromSNSNotif(message *string) (string, string, error) {
	snsBody := SNSEvent{}

	if err := json.Unmarshal([]byte(*message), &snsBody); err != nil {
		return "", "", err
	}

	// It's just a SQS message wrapped in SNS
	return extractBucketAndPrefixFromS3Notif(&snsBody.Message)
}

func (s *Source) extractBucketAndPrefix(message *string) (string, string, error) {
	switch s.Config.SQSFormat {

View on GitHub (pinned to 909b515798)

Solutions

1. Configure the S3 bucket notification (or SNS subscription filter) to deliver only ObjectCreated:* events, e.g. filter suffix/prefix and event type s3:ObjectCreated:*.
2. Ignore or route ObjectRemoved/lifecycle events to a different consumer.
3. If deletion tracking is needed, it is unsupported by this source — process those events elsewhere.

Example fix

// before: bucket notification config sends s3:ObjectRemoved:* too
// after: restrict the notification configuration to
{"Events": ["s3:ObjectCreated:*"]}

var n struct{ Records []struct{ EventName string } `json:"Records"` }
if json.Unmarshal([]byte(body), &n) == nil && len(n.Records) > 0 && !strings.HasPrefix(n.Records[0].EventName, "ObjectCreated:") {
    return fmt.Errorf("skipping unsupported event %s", n.Records[0].EventName)
}

if _, _, err := extractBucketAndPrefix(body); err != nil {
    log.Warnf("ignoring unsupported S3 notification: %v", err)
    return // skip, do not treat as fatal
}

When it happens

Trigger: An S3 notification (direct or via SNS) whose Records[0].EventName is e.g. ObjectRemoved:Delete, LifecycleExpiration, or Replication events is fed to the source.

Common situations: Pointing the S3 source at a queue/topic that also receives ObjectRemoved deletion markers or lifecycle events; testing notifications of the wrong type; versioning enabled so delete events flow in.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• invalid DSN %s for S3 source, must start with s3://
• unknown level %s: %w
• invalid value for 'max_buffer_size': %w
• unknown parameter %s
• invalid DSN %s for S3 source

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b6938063b577f630. Report an issue: GitHub.