What causes "invalid sqs_format %s, must be empty, %s, %s or %s" in crowdsecurity/crowdsec?

Set sqs_format to exactly one of: event_bridge, s3_notification, sns (strings shown in the error)

invalid sqs_format %s, must be empty, %s, %s or %s

Error message

invalid sqs_format %s, must be empty, %s, %s or %s

What it means

When set, sqs_format must equal one of the module's format constants (event_bridge, s3_notification, sns); empty is allowed for auto-detection. Any other value fails this validation in UnmarshalConfig.

Source

Thrown at pkg/acquisition/modules/s3/config.go:147

	if s.Config.PollingMethod != PollMethodList && s.Config.PollingMethod != PollMethodSQS {
		return fmt.Errorf("invalid polling method %s", s.Config.PollingMethod)
	}

	if s.Config.BucketName != "" && s.Config.SQSName != "" {
		return errors.New("bucket_name and sqs_name are mutually exclusive")
	}

	if s.Config.PollingMethod == PollMethodSQS && s.Config.SQSName == "" {
		return errors.New("sqs_name is required when using sqs polling method")
	}

	if s.Config.BucketName == "" && s.Config.PollingMethod == PollMethodList {
		return errors.New("bucket_name is required")
	}

	if s.Config.SQSFormat != "" && s.Config.SQSFormat != SQSFormatEventBridge && s.Config.SQSFormat != SQSFormatS3Notification && s.Config.SQSFormat != SQSFormatSNS {
		return fmt.Errorf("invalid sqs_format %s, must be empty, %s, %s or %s", s.Config.SQSFormat, SQSFormatEventBridge, SQSFormatS3Notification, SQSFormatSNS)
	}

	return nil
}

func (s *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, _ metrics.AcquisitionMetricsLevel) error {
	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	if s.Config.SQSName != "" {
		s.logger = logger.WithFields(log.Fields{
			"queue": s.Config.SQSName,
		})
	} else {
		s.logger = logger.WithFields(log.Fields{
			"bucket": s.Config.BucketName,

View on GitHub (pinned to 909b515798)

Solutions

Set sqs_format to exactly one of: event_bridge, s3_notification, sns (strings shown in the error)
Or remove sqs_format entirely (empty) to let the source auto-detect the message format
Match the format to how your bucket actually publishes: EventBridge rule, direct S3 notification, or S3 notification via SNS

Example fix

// before
sqs_format: cloudwatch
// after
sqs_format: s3_notification

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"event_bridge": true, "s3_notification": true, "sns": true}
if f != "" && !allowed[f] {
    return fmt.Errorf("sqs_format must be empty, event_bridge, s3_notification or sns, got %q", f)
}

Prevention

Omit sqs_format to rely on auto-detection unless detection misfires
Match sqs_format to the actual bucket event publishing mechanism
Copy the exact strings from the error message or docs

When it happens

Trigger: Configuring an SQS-polled S3 source with sqs_format holding an unsupported string such as 'cloudwatch', 'EventBridge' (wrong case/spacing), or a legacy name.

Common situations: Confusing AWS console terminology ('EventBridge pump') with the expected enum string; typos; using format names from older module versions that predate SNS support.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8a2164ba80f611b7. Report an issue: GitHub.