{"record":{"id":"bcb3a275b131ac60","repo":"crowdsecurity/crowdsec","slug":"cannot-deregister-stream-consumer-w","errorCode":null,"errorMessage":"cannot deregister stream consumer: %w","messagePattern":"cannot deregister stream consumer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/run.go","lineNumber":106,"sourceCode":"\t}\n\n\treturn fmt.Errorf(\"consumer %s is not deregistered after %d tries\", consumerName, maxTries)\n}\n\nfunc (s *Source) DeregisterConsumer(ctx context.Context) error {\n\ts.logger.Debugf(\"Deregistering consumer %s if it exists\", s.Config.ConsumerName)\n\t_, err := s.kClient.DeregisterStreamConsumer(ctx, &kinesis.DeregisterStreamConsumerInput{\n\t\t\tConsumerName: aws.String(s.Config.ConsumerName),\n\t\t\tStreamARN:    aws.String(s.Config.StreamARN),\n\t\t})\n\n\tvar resourceNotFoundErr *kinTypes.ResourceNotFoundException\n\tif errors.As(err, &resourceNotFoundErr) {\n\t\treturn nil\n\t}\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot deregister stream consumer: %w\", err)\n\t}\n\n\terr = s.WaitForConsumerDeregistration(ctx, s.Config.ConsumerName, s.Config.StreamARN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot wait for consumer deregistration: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) WaitForConsumerRegistration(ctx context.Context, consumerARN string) error {\n\tmaxTries := s.Config.MaxRetries\n\tfor i := range maxTries {\n\t\tdescribeOutput, err := s.kClient.DescribeStreamConsumer(ctx, &kinesis.DescribeStreamConsumerInput{\n\t\t\t\tConsumerARN: aws.String(consumerARN),\n\t\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot describe stream consumer: %w\", err)","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/run.go#L88-L124","documentation":"Returned by DeregisterConsumer when the DeregisterStreamConsumer API call fails with an error that is not a ResourceNotFoundException (that case is treated as already-deregistered and returns nil). Wraps the raw SDK error from EnhancedRead's consumer cleanup path.","triggerScenarios":"EnhancedRead calls DeregisterConsumer at startup/shutdown and DeregisterStreamConsumer returns e.g. InvalidArgumentException (malformed StreamARN/ConsumerName), AccessDeniedException, or a network error.","commonSituations":"IAM policy missing kinesis:DeregisterStreamConsumer; stream ARN typo or wrong region; consumer name longer than 128 characters or containing invalid characters.","solutions":["Inspect the wrapped cause and check the consumer name and stream ARN in the acquisition config for typos and region correctness.","Add `kinesis:DeregisterStreamConsumer` to the IAM policy of the credentials in use.","If the error is InvalidArgumentException, ensure consumer_name is 1-128 chars of alphanumerics plus ._- and stream_arn is a full valid ARN.","Retry on transient network errors; deregistration is idempotent thanks to the ResourceNotFound short-circuit."],"exampleFix":"// before\n{\"stream_arn\": \"my-stream\"}\n// after\n{\"stream_arn\": \"arn:aws:kinesis:us-east-1:123456789012:stream/my-stream\"}","handlingStrategy":"try-catch","validationCode":"// Pre-flight: consumer name constraints and ARN shape\nvar re = regexp.MustCompile(`^[a-zA-Z0-9_.-]{1,128}$`)\nif !re.MatchString(consumerName) { return errors.New(\"invalid consumer_name\") }\nif !strings.HasPrefix(streamARN, \"arn:aws:kinesis:\") { return errors.New(\"invalid stream_arn\") }","typeGuard":"var nf *kinTypes.ResourceNotFoundException\nif errors.As(err, &nf) { return nil }\nvar invalid *kinTypes.InvalidArgumentException\nif errors.As(err, &invalid) { /* fix config: bad ARN or name */ }","tryCatchPattern":"_, err := client.DeregisterStreamConsumer(ctx, in)\nif err != nil {\n    var nf *kinTypes.ResourceNotFoundException\n    if errors.As(err, &nf) { return nil }\n    return fmt.Errorf(\"cannot deregister stream consumer: %w\", err)\n}","preventionTips":["Include DeregisterStreamConsumer in the IAM policy alongside register/describe.","Copy stream_arn directly from `aws kinesis list-streams`/describe output rather than hand-typing.","Keep consumer names short and slug-safe."],"tags":["aws","kinesis","permissions"],"backgroundTag":"api-error-response","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}