{"record":{"id":"48f5483de5a5522c","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-aws-config-w-48f548","errorCode":null,"errorMessage":"failed to load aws config: %w","messagePattern":"failed to load aws config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/config.go","lineNumber":133,"sourceCode":"\tvar loadOpts []func(*config.LoadOptions) error\n\tif s.Config.AwsProfile != nil && *s.Config.AwsProfile != \"\" {\n\t\tloadOpts = append(loadOpts, config.WithSharedConfigProfile(*s.Config.AwsProfile))\n\t}\n\n\tregion := s.Config.AwsRegion\n\tif region == \"\" {\n\t\tregion = \"us-east-1\"\n\t}\n\n\tloadOpts = append(loadOpts, config.WithRegion(region))\n\n\tif c := defaultCreds(); c != nil {\n\t\tloadOpts = append(loadOpts, config.WithCredentialsProvider(c))\n\t}\n\n\tcfg, err := config.LoadDefaultConfig(ctx, loadOpts...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load aws config: %w\", err)\n\t}\n\n\tvar clientOpts []func(*kinesis.Options)\n\tif s.Config.AwsEndpoint != \"\" {\n\t\tclientOpts = append(clientOpts, func(o *kinesis.Options) {\n\t\t\to.BaseEndpoint = aws.String(s.Config.AwsEndpoint)\n\t\t})\n\t}\n\n\ts.kClient = kinesis.NewFromConfig(cfg, clientOpts...)\n\n\treturn nil\n}\n","sourceCodeStart":115,"sourceCodeEnd":147,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/config.go#L115-L147","documentation":"Wraps any failure from the AWS SDK v2 `config.LoadDefaultConfig` when the kinesis source builds its client in `newClient`. The SDK resolves region, credentials and shared config (profile files, env vars, IMDS) at this point; a failure here means the AWS configuration chain itself could not be assembled, before any Kinesis API call is made. The source aborts configuration and CrowdSec will not start this acquisition.","triggerScenarios":"Calling Source.Configure with an `aws_profile` that has no matching section in ~/.aws/config or ~/.aws/credentials; a malformed shared credentials/config file; or a credentials provider (e.g. a custom one injected via defaultCreds) that fails to load. Note the SDK normally defers credential fetch to first API call, so this mostly fires on config-file/profile parse errors.","commonSituations":"Typo in `aws_profile` name in the acquisition YAML; corrupted or wrong-permission ~/.aws/credentials; missing shared config file referenced by AWS_CONFIG_FILE; running in a container where the mounted AWS config is absent.","solutions":["Verify the `aws_profile` value in the kinesis acquisition YAML matches a section in ~/.aws/config and ~/.aws/credentials (run `aws configure list --profile <name>`).","Check AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE env vars point to existing, readable files, and that the files parse as valid INI.","If no profile is set, run `aws configure` or set AWS_REGION and credentials env vars so LoadDefaultConfig has a valid default chain.","If overriding credentials via defaultCreds, confirm the returned provider can be constructed without error."],"exampleFix":"// before\nprofile: \"prod-rea\"\n// after (profile exists in ~/.aws/config)\nprofile: \"prod-reader\"","handlingStrategy":"validation","validationCode":"// Go, before starting acquisition\nif _, err := os.Stat(filepath.Join(mustHome(), \".aws\", \"credentials\")); err != nil {\n    return fmt.Errorf(\"AWS shared credentials file missing: %w\", err)\n}\nif profile != \"\" {\n    cfg, err := ini.Load(sharedConfigPath())\n    if err != nil || !cfg.HasSection(\"profile \" + profile) && !cfg.HasSection(profile) {\n        return fmt.Errorf(\"aws profile %q not found in shared config\", profile)\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := config.LoadDefaultConfig(ctx, loadOpts...)\nif err != nil {\n    var cfgErr *aws.ConfigError\n    if errors.As(err, &cfgErr) {\n        logger.Fatalf(\"bad AWS config: %v\", cfgErr)\n    }\n    return fmt.Errorf(\"failed to load aws config: %w\", err)\n}","preventionTips":["Validate the aws_profile value against `aws configure list-profiles` before deploying.","Mount/readable-check ~/.aws files in containers; never rely on IMDS in air-gapped environments.","Set AWS_REGION explicitly instead of depending on defaults."],"tags":["aws","kinesis","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}