crowdsecurity/crowdsec · error

invalid event body for event bridge format

Error message

invalid event body for event bridge format

What it means

Validation in extractBucketAndPrefixFromEventBridge: the SQS message body parsed as JSON but does not look like an AWS EventBridge event — the detail.bucket.name field is empty, so no bucket (and thus no object key) can be extracted. The caller tries this format first and falls through to other formats when it fails.

Source

Thrown at pkg/acquisition/modules/s3/run.go:189

			if newObject {
				lastObjectDate = *bucketObjects[len(bucketObjects)-1].LastModified
			}
		}
	}
}

func extractBucketAndPrefixFromEventBridge(message *string) (string, string, error) {
	eventBody := S3Event{}

	if err := json.Unmarshal([]byte(*message), &eventBody); err != nil {
		return "", "", err
	}

	if eventBody.Detail.Bucket.Name != "" {
		return eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil
	}

	return "", "", errors.New("invalid event body for event bridge format")
}

func extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {
	s3notifBody := events.S3Event{}

	if err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {
		return "", "", err
	}

	if len(s3notifBody.Records) == 0 {
		return "", "", errors.New("no records found in S3 notification")
	}

	if !strings.HasPrefix(s3notifBody.Records[0].EventName, "ObjectCreated:") {
		return "", "", fmt.Errorf("event %s is not supported", s3notifBody.Records[0].EventName)
	}

	return s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the SQS subscription is wired to EventBridge (or S3) notifications and not some other producer
2. Inspect the raw message body: valid EventBridge events carry detail.bucket.name and detail.object.key
3. If the messages are plain S3 notifications, the caller will detect that automatically — this error alone is not fatal

When it happens

Trigger: Thrown at pkg/acquisition/modules/s3/run.go:189 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/16638e6d811fc6cc. Report an issue: GitHub.