{"record":{"id":"87bff5630ddcca48","repo":"crowdsecurity/crowdsec","slug":"cannot-create-kinesis-client-w","errorCode":null,"errorMessage":"cannot create kinesis client: %w","messagePattern":"cannot create kinesis client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/config.go","lineNumber":106,"sourceCode":"\tif c.StreamARN != \"\" && c.StreamName != \"\" {\n\t\treturn errors.New(\"stream_arn and stream_name are mutually exclusive\")\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {\n\ts.logger = logger\n\ts.metricsLevel = metricsLevel\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = s.newClient(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot create kinesis client: %w\", err)\n\t}\n\n\ts.shardReaderTomb = &tomb.Tomb{}\n\n\treturn nil\n}\n\nfunc (s *Source) newClient(ctx context.Context) error {\n\tvar loadOpts []func(*config.LoadOptions) error\n\tif s.Config.AwsProfile != nil && *s.Config.AwsProfile != \"\" {\n\t\tloadOpts = append(loadOpts, config.WithSharedConfigProfile(*s.Config.AwsProfile))\n\t}\n\n\tregion := s.Config.AwsRegion\n\tif region == \"\" {\n\t\tregion = \"us-east-1\"\n\t}\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/config.go#L88-L124","documentation":"Wraps any failure from Source.newClient while configuring the kinesis datasource. newClient loads the AWS SDK config (config.LoadDefaultConfig) and constructs a kinesis client; it fails when the AWS shared config/credentials cannot be loaded (bad profile, unreadable ~/.aws files, malformed env vars). The kinesis client itself is built unconditionally, so nearly all wrapped errors come from AWS config loading.","triggerScenarios":"Configure() -> s.newClient(ctx): config.LoadDefaultConfig fails due to a specified `aws_profile` missing from ~/.aws/config or credentials, malformed AWS_* env variables, or unreadable shared config files. Note the SDK defers credential errors — LoadDefaultConfig mostly fails on config-file/profile problems.","commonSituations":"aws_profile references a profile that doesn't exist; AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE pointing to missing files; malformed values for AWS_RETRY_MODE etc.; container lacking the mounted aws config directory.","solutions":["Read the wrapped error — 'failed to load aws config: %w' names the profile or file that failed","Verify the profile exists: `aws configure list-profiles` and that ~/.aws/config & ~/.aws/credentials are readable by the crowdsec process","If using env credentials, check AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_REGION are valid and well-formed","Remove `aws_profile:` if you intend to use env/instance credentials instead","Ensure aws_endpoint (if set) is a valid URL for localstack-style testing"],"exampleFix":"// before\nsource: kinesis\naws_profile: prod-old   # profile not in ~/.aws/config\n// after\nsource: kinesis\naws_profile: default","handlingStrategy":"validation","validationCode":"// before startup\nif profile := cfg.AwsProfile; profile != nil && *profile != \"\" {\n    out, err := exec.Command(\"aws\", \"configure\", \"list-profiles\").Output()\n    if err != nil || !strings.Contains(string(out), *profile) {\n        return fmt.Errorf(\"aws profile %q not found in shared config\", *profile)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, lvl); err != nil {\n    if strings.Contains(err.Error(), \"failed to load aws config\") {\n        logger.Errorf(\"check aws_profile/shared credentials files: %v\", err)\n    }\n    return fmt.Errorf(\"kinesis datasource setup failed: %w\", err)\n}","preventionTips":["Verify aws_profile exists in ~/.aws/config and credentials before deploying","Mount AWS config/credentials read-only into containers with correct ownership","Set AWS_REGION explicitly or in the yaml to avoid region fallbacks","Test with `aws kinesis list-streams --profile <p>` using the same environment"],"tags":["kinesis","aws","config","credentials","crowdsec"],"backgroundTag":"missing-credentials","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}