Cribl: Some S3 destinations are experiencing issues
Timeline of updates
- identified
The issue has been identified and a fix is being implemented.
- identified
The following issues with the Amazon S3 Destination are currently being investigated: S3 buckets with 'Object Lock' enabled will fail and S3 Destinations configured without a region set may experience issues.
- identified
We are currently and testing the fix to the S3 destination issues with object locks enabled and when region is not specified.
- monitoring
A fix has been implemented and we are monitoring the results.
- monitoring
We have identified the root cause for both "S3 buckets object lock" and "region is not specified" errors. Both issues were mitigated for Cloud workers. Please check S3 destination statuses for Hybrid Worker Groups and Edge Nodes, that have been upgraded for 4.13.1, to verify whether S3 destinations are impacted by this issue.
- monitoring
We have identified the root cause for both "S3 buckets object lock" and "region is not specified" errors. Both issues were mitigated for Cloud workers. Please check S3 destination statuses for Hybrid Worker Groups and Edge Nodes, that have been upgraded for 4.13.1, to verify whether S3 destinations are impacted by this issue.
- monitoring
Customers who use AWS SQS sources may experience S3 bucket ingestion issues for buckets that are located in a different geographic region than the SQS queue. This issue has been mitigated for Cloud Workers. We do not recommend upgrading Hybrid Workers to 4.13.1 at this time.
- monitoring
We will perform a critical upgrade to Cribl Cloud organizations between 09:00 and 12:00 UTC on Friday, August 15th, 2025. An email has been sent to Cribl Cloud users with full details. If you have not yet enabled auto-upgrade on your Hybrid Workers, please manually upgrade them to 4.13.2 once your organization has been upgraded.
- resolved
This incident has been resolved.
Changes Rewindex caught on this incident
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).