{"record":{"id":"ec75622059a6ae05","repo":"crowdsecurity/crowdsec","slug":"can-t-read-aws-config-dir-s-got-err-w","errorCode":null,"errorMessage":"can't read aws_config_dir %s got err %w ","messagePattern":"can't read aws_config_dir (.+?) got err %w ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/cloudwatch/config.go","lineNumber":161,"sourceCode":"\ts.logger.Tracef(\"describelogstreams_limit set to %d\", *s.Config.DescribeLogStreamsLimit)\n\ts.logger.Tracef(\"poll_new_stream_interval set to %v\", *s.Config.PollNewStreamInterval)\n\ts.logger.Tracef(\"max_stream_age set to %v\", *s.Config.MaxStreamAge)\n\ts.logger.Tracef(\"poll_stream_interval set to %v\", *s.Config.PollStreamInterval)\n\ts.logger.Tracef(\"stream_read_timeout set to %v\", *s.Config.StreamReadTimeout)\n\ts.logger.Tracef(\"getlogeventspages_limit set to %v\", *s.Config.GetLogEventsPagesLimit)\n\ts.logger.Tracef(\"aws_api_timeout set to %v\", *s.Config.AwsApiCallTimeout)\n\ts.logger.Tracef(\"aws_config_dir set to %s\", *s.Config.AwsConfigDir)\n\n\treturn s.setupAWS(ctx)\n}\n\n\nfunc (s *Source) setupAWS(ctx context.Context) error {\n\tif *s.Config.AwsConfigDir != \"\" {\n\t\t_, err := os.Stat(*s.Config.AwsConfigDir)\n\t\tif err != nil {\n\t\t\ts.logger.Errorf(\"can't read aws_config_dir '%s' got err %s\", *s.Config.AwsConfigDir, err)\n\t\t\treturn fmt.Errorf(\"can't read aws_config_dir %s got err %w \", *s.Config.AwsConfigDir, err)\n\t\t}\n\n\t\tos.Setenv(\"AWS_SDK_LOAD_CONFIG\", \"1\")\n\t\t// as aws sdk relies on $HOME, let's allow the user to override it :)\n\t\tos.Setenv(\"AWS_CONFIG_FILE\", fmt.Sprintf(\"%s/config\", *s.Config.AwsConfigDir))\n\t\tos.Setenv(\"AWS_SHARED_CREDENTIALS_FILE\", fmt.Sprintf(\"%s/credentials\", *s.Config.AwsConfigDir))\n\t} else {\n\t\tif s.Config.AwsRegion == \"\" {\n\t\t\ts.logger.Errorf(\"aws_region is not specified, specify it or aws_config_dir\")\n\t\t\treturn errors.New(\"aws_region is not specified, specify it or aws_config_dir\")\n\t\t}\n\n\t\tos.Setenv(\"AWS_REGION\", s.Config.AwsRegion)\n\t}\n\n\tif err := s.newClient(ctx); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/cloudwatch/config.go#L143-L179","documentation":"The cloudwatch acquisition source validates that the optional aws_config_dir exists and is stat-able before wiring AWS SDK env vars (AWS_SDK_LOAD_CONFIG, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE). If os.Stat fails (missing directory, typo, permission issue), setupAWS returns this wrapped error.","triggerScenarios":"Configure/ConfigureByDSN creating a cloudwatch source with aws_config_dir set to a path that does not exist or is unreadable; os.Stat fails with ENOENT/EACCES and the error is wrapped into this message.","commonSituations":"Typo in the aws_config_dir path, pointing at a file instead of a directory tree, permissions restricted for the crowdsec service user, or the directory living inside a container image that wasn't mounted.","solutions":["Create the directory or fix the path in the acquisition config (aws_config_dir).","Ensure the crowdsec process user has read/execute permission on the directory.","If no custom AWS config is needed, drop aws_config_dir from the source config so defaults are used.","Mount the AWS config directory into the container when running under Docker/Kubernetes."],"exampleFix":"// before (acquis.yaml)\nsource: cloudwatch\naws_config_dir: /etc/crowdsec/awscfg  # does not exist\n// after\nsudo mkdir -p /etc/crowdsec/awscfg && cp ~/.aws/{config,credentials} /etc/crowdsec/awscfg/","handlingStrategy":"validation","validationCode":"if *cfg.AwsConfigDir != \"\" {\n    if info, err := os.Stat(*cfg.AwsConfigDir); err != nil || !info.IsDir() {\n        return fmt.Errorf(\"aws_config_dir %q missing or not a directory\", *cfg.AwsConfigDir)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := src.Configure(ctx, cfg); err != nil {\n    return fmt.Errorf(\"cloudwatch source setup failed: %w\", err)\n}","preventionTips":["Create and chmod the aws_config_dir as part of deployment automation","Mount AWS credentials directories explicitly in containers","Verify the directory exists as the user crowdsec runs as","Omit aws_config_dir when relying on default AWS credential chain"],"tags":["aws","cloudwatch","configuration","filesystem"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}