{"record":{"id":"550bcdfcfbdf7830","repo":"crowdsecurity/crowdsec","slug":"aws-region-is-not-specified-specify-it-or-aws-con","errorCode":null,"errorMessage":"aws_region is not specified, specify it or aws_config_dir","messagePattern":"aws_region is not specified, specify it or aws_config_dir","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/cloudwatch/config.go","lineNumber":171,"sourceCode":"}\n\n\nfunc (s *Source) setupAWS(ctx context.Context) error {\n\tif *s.Config.AwsConfigDir != \"\" {\n\t\t_, err := os.Stat(*s.Config.AwsConfigDir)\n\t\tif err != nil {\n\t\t\ts.logger.Errorf(\"can't read aws_config_dir '%s' got err %s\", *s.Config.AwsConfigDir, err)\n\t\t\treturn fmt.Errorf(\"can't read aws_config_dir %s got err %w \", *s.Config.AwsConfigDir, err)\n\t\t}\n\n\t\tos.Setenv(\"AWS_SDK_LOAD_CONFIG\", \"1\")\n\t\t// as aws sdk relies on $HOME, let's allow the user to override it :)\n\t\tos.Setenv(\"AWS_CONFIG_FILE\", fmt.Sprintf(\"%s/config\", *s.Config.AwsConfigDir))\n\t\tos.Setenv(\"AWS_SHARED_CREDENTIALS_FILE\", fmt.Sprintf(\"%s/credentials\", *s.Config.AwsConfigDir))\n\t} else {\n\t\tif s.Config.AwsRegion == \"\" {\n\t\t\ts.logger.Errorf(\"aws_region is not specified, specify it or aws_config_dir\")\n\t\t\treturn errors.New(\"aws_region is not specified, specify it or aws_config_dir\")\n\t\t}\n\n\t\tos.Setenv(\"AWS_REGION\", s.Config.AwsRegion)\n\t}\n\n\tif err := s.newClient(ctx); err != nil {\n\t\treturn err\n\t}\n\n\ts.streamIndexes = make(map[string]string)\n\n\ttargetStream := \"*\"\n\n\tif s.Config.StreamRegexp != nil {\n\t\tif _, err := regexp.Compile(*s.Config.StreamRegexp); err != nil {\n\t\t\treturn fmt.Errorf(\"while compiling regexp '%s': %w\", *s.Config.StreamRegexp, err)\n\t\t}\n","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/cloudwatch/config.go#L153-L189","documentation":"setupAWS() determines the AWS region either from aws_region or implicitly from an AWS config directory (aws_config_dir whose config file contains the region). If neither is provided, the SDK cannot target a region and setupAWS fails with this error after logging it.","triggerScenarios":"Configure() -> setupAWS() runs with AwsConfigDir nil and s.Config.AwsRegion == \"\" — no region in the datasource config and no aws_config_dir to read one from.","commonSituations":"CloudWatch datasource config without aws_region on a machine with no default AWS profile; container images lacking ~/.aws/config; relying on env AWS_REGION that this code path overrides/ignores.","solutions":["Add aws_region: <region> to the cloudwatch datasource config","Or set aws_config_dir to a directory containing a valid AWS config/credentials with the region","As a system-level fix, ensure ~/.aws/config defines a default region (note the code sets AWS_CONFIG_FILE when aws_config_dir is used)"],"exampleFix":"// before\nsource: cloudwatch\ngroup_name: /my/group\n// after\nsource: cloudwatch\ngroup_name: /my/group\naws_region: eu-west-1","handlingStrategy":"validation","validationCode":"if awsCfg.AwsRegion == \"\" && awsCfg.AwsConfigDir == nil {\n    return errors.New(\"set aws_region or aws_config_dir\")\n}","typeGuard":null,"tryCatchPattern":"if err := src.Configure(ctx, yaml, logger, lvl); err != nil {\n    if strings.Contains(err.Error(), \"aws_region is not specified\") { /* add aws_region or aws_config_dir */ }\n    return err\n}","preventionTips":["Always set aws_region explicitly in cloudwatch datasource configs","In containers, mount or generate an aws config dir with a default region","Verify with `aws configure get region` that a default region exists"],"tags":["cloudwatch","aws","region","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}