{"record":{"id":"edef476a0aaa16db","repo":"crowdsecurity/crowdsec","slug":"cannot-parse-stream-arn-w","errorCode":null,"errorMessage":"cannot parse stream ARN: %w","messagePattern":"cannot parse stream ARN: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/run.go","lineNumber":276,"sourceCode":"\t\t\t\tStartingPosition: &kinTypes.StartingPosition{Type: kinTypes.ShardIteratorTypeLatest},\n\t\t\t\tConsumerARN:      streamConsumer.Consumer.ConsumerARN,\n\t\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot subscribe to shard: %w\", err)\n\t\t}\n\n\t\ts.shardReaderTomb.Go(func() error {\n\t\t\treturn s.ReadFromSubscription(r.GetStream().Reader, out, shardID, arn.Resource[7:])\n\t\t})\n\t}\n\n\treturn nil\n}\n\nfunc (s *Source) EnhancedRead(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {\n\tparsedARN, err := arn.Parse(s.Config.StreamARN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse stream ARN: %w\", err)\n\t}\n\n\tif !strings.HasPrefix(parsedARN.Resource, \"stream/\") {\n\t\treturn fmt.Errorf(\"resource part of stream ARN %s does not start with stream/\", s.Config.StreamARN)\n\t}\n\n\ts.logger = s.logger.WithField(\"stream\", parsedARN.Resource[7:])\n\ts.logger.Info(\"starting kinesis acquisition with enhanced fan-out\")\n\n\terr = s.DeregisterConsumer(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot deregister consumer: %w\", err)\n\t}\n\n\tstreamConsumer, err := s.RegisterConsumer(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot register consumer: %w\", err)\n\t}","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/run.go#L258-L294","documentation":"The stream_arn configured for the kinesis datasource could not be parsed by the aws-sdk arn.Parse function. This is a local validation error thrown before any AWS call is made, meaning the configured value is not a syntactically valid Amazon Resource Name (missing arn: prefix, wrong number of ':'-separated fields, empty parts).","triggerScenarios":"EnhancedRead is entered (enhanced fan-out enabled) and s.Config.StreamARN is empty, contains spaces/quotes, uses the wrong number of colons (arn:aws:kinesis:region:acct:stream requires exactly 5 colons after 'arn:'), or a non-ARN string like just the stream name was supplied.","commonSituations":"User put the stream name instead of the full ARN in acquis.yaml; YAML indentation mangled the value; ARN pasted with extra characters or line breaks; user omitted stream_arn entirely while enabling enhanced fan-out.","solutions":["Set a complete, valid ARN: arn:aws:kinesis:<region>:<account-id>:stream/<stream-name>.","Quote the ARN in YAML if it contains special characters.","Check for copy/paste artifacts (newlines, BOM, spaces) in the config value.","If enhanced fan-out is not desired, remove the incomplete stream_arn setting and use stream_name + classic polling instead."],"exampleFix":"// before (acquis.yaml)\nstream_arn: my-stream\n// after\nstream_arn: \"arn:aws:kinesis:eu-west-1:123456789012:stream/my-stream\"","handlingStrategy":"validation","validationCode":"func validStreamARN(s string) bool {\n\treturn strings.HasPrefix(s, \"arn:aws:kinesis:\") && strings.Contains(s, \":stream/\")\n}\nif !validStreamARN(cfg.StreamARN) {\n\treturn fmt.Errorf(\"stream_arn %q is not a kinesis stream ARN\", cfg.StreamARN)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the stream ARN verbatim from the AWS console, never hand-type it.","Quote ARN values in YAML.","Use stream_name (not stream_arn) if you don't need enhanced fan-out.","Validate config with cscli before deploying."],"tags":["config","aws","arn","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}