crowdsecurity/crowdsec · error

no records found in S3 notification

Error message

no records found in S3 notification

What it means

Validation in extractBucketAndPrefixFromS3Notif: the message body unmarshalled as an S3 notification event but its Records array is empty, so there is no event record to take bucket/key from. Reached from extractBucketAndPrefix(SNSNotif) and the direct format probe; a failure here lets the format detection fall through.

Source

Thrown at pkg/acquisition/modules/s3/run.go:200

		return "", "", err
	}

	if eventBody.Detail.Bucket.Name != "" {
		return eventBody.Detail.Bucket.Name, eventBody.Detail.Object.Key, nil
	}

	return "", "", errors.New("invalid event body for event bridge format")
}

func extractBucketAndPrefixFromS3Notif(message *string) (string, string, error) {
	s3notifBody := events.S3Event{}

	if err := json.Unmarshal([]byte(*message), &s3notifBody); err != nil {
		return "", "", err
	}

	if len(s3notifBody.Records) == 0 {
		return "", "", errors.New("no records found in S3 notification")
	}

	if !strings.HasPrefix(s3notifBody.Records[0].EventName, "ObjectCreated:") {
		return "", "", fmt.Errorf("event %s is not supported", s3notifBody.Records[0].EventName)
	}

	return s3notifBody.Records[0].S3.Bucket.Name, s3notifBody.Records[0].S3.Object.Key, nil
}

func extractBucketAndPrefixFromSNSNotif(message *string) (string, string, error) {
	snsBody := SNSEvent{}

	if err := json.Unmarshal([]byte(*message), &snsBody); err != nil {
		return "", "", err
	}

	// It's just a SQS message wrapped in SNS
	return extractBucketAndPrefixFromS3Notif(&snsBody.Message)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the S3 notification configuration — it emitted an event envelope with no records
2. Confirm the queue receives ObjectCreated:* notifications (the first record's event name must start with 'Object')
3. Capture one message body and validate it against the S3 notification schema

When it happens

Trigger: Thrown at pkg/acquisition/modules/s3/run.go:200 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6a32647a092c952e. Report an issue: GitHub.