{"record":{"id":"152e22ca7acedee8","repo":"crowdsecurity/crowdsec","slug":"resource-part-of-stream-arn-s-does-not-start-with","errorCode":null,"errorMessage":"resource part of stream ARN %s does not start with stream/","messagePattern":"resource part of stream ARN (.+?) does not start with stream/","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/run.go","lineNumber":280,"sourceCode":"\t\t\treturn fmt.Errorf(\"cannot subscribe to shard: %w\", err)\n\t\t}\n\n\t\ts.shardReaderTomb.Go(func() error {\n\t\t\treturn s.ReadFromSubscription(r.GetStream().Reader, out, shardID, arn.Resource[7:])\n\t\t})\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) EnhancedRead(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {\n\tparsedARN, err := arn.Parse(s.Config.StreamARN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse stream ARN: %w\", err)\n\t}\n\n\tif !strings.HasPrefix(parsedARN.Resource, \"stream/\") {\n\t\treturn fmt.Errorf(\"resource part of stream ARN %s does not start with stream/\", s.Config.StreamARN)\n\t}\n\n\ts.logger = s.logger.WithField(\"stream\", parsedARN.Resource[7:])\n\ts.logger.Info(\"starting kinesis acquisition with enhanced fan-out\")\n\n\terr = s.DeregisterConsumer(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot deregister consumer: %w\", err)\n\t}\n\n\tstreamConsumer, err := s.RegisterConsumer(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot register consumer: %w\", err)\n\t}\n\n\tfor {\n\t\ts.shardReaderTomb = &tomb.Tomb{}\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/run.go#L262-L298","documentation":"The stream_arn parsed as a valid ARN, but its resource segment is not a Kinesis stream. EnhancedRead requires an ARN of the form arn:aws:kinesis:<region>:<account>:stream/<name> because it later slices Resource[7:] to recover the stream name; any other resource type (e.g. a consumer ARN, or stream/consumer/<name>) fails this prefix check.","triggerScenarios":"EnhancedRead with StreamARN set to a kinesis consumer ARN (resource 'stream-consumer/...'), a Firehose delivery stream ARN, or a truncated ARN where the resource doesn't start with 'stream/'.","commonSituations":"User copied the enhanced-consumer ARN (from aws kinesis list-stream-consumers) instead of the stream ARN; user pointed the datasource at a Firehose or Data Streams resource of another type; hand-edited ARN dropped the 'stream/' part.","solutions":["Use the Kinesis Data Stream ARN, not a consumer or Firehose ARN: arn:aws:kinesis:<region>:<acct>:stream/<name>.","Verify with aws kinesis describe-stream-summary --stream-arn <arn> that the ARN is accepted as a stream.","Check that nothing stripped 'stream/' from the configured value."],"exampleFix":"// before: consumer ARN mistakenly used\nstream_arn: arn:aws:kinesis:eu-west-1:123456789012:stream/my-stream/consumer/crowdsec:1234\n// after: stream ARN\nstream_arn: arn:aws:kinesis:eu-west-1:123456789012:stream/my-stream","handlingStrategy":"validation","validationCode":"parsed, err := arn.Parse(cfg.StreamARN)\nif err == nil && !strings.HasPrefix(parsed.Resource, \"stream/\") {\n\treturn fmt.Errorf(\"expected stream ARN, got resource %q\", parsed.Resource)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use consumer ARNs or Firehose ARNs in the stream_arn field.","Check the resource part is stream/<name> after editing config.","Document in runbooks that the field takes the Kinesis Data Stream ARN only."],"tags":["config","aws","arn","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}