{"record":{"id":"f9727bd2dd2f7a3a","repo":"crowdsecurity/crowdsec","slug":"cannot-describe-stream-consumer-w","errorCode":null,"errorMessage":"cannot describe stream consumer: %w","messagePattern":"cannot describe stream consumer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kinesis/run.go","lineNumber":84,"sourceCode":"\treturn subscriptionRecord.LogEvents, nil\n}\n\nfunc (s *Source) WaitForConsumerDeregistration(ctx context.Context, consumerName string, streamARN string) error {\n\tmaxTries := s.Config.MaxRetries\n\tfor i := range maxTries {\n\t\t_, err := s.kClient.DescribeStreamConsumer(ctx, &kinesis.DescribeStreamConsumerInput{\n\t\t\t\tConsumerName: aws.String(consumerName),\n\t\t\t\tStreamARN:    aws.String(streamARN),\n\t\t\t})\n\n\t\tvar resourceNotFoundErr *kinTypes.ResourceNotFoundException\n\t\tif errors.As(err, &resourceNotFoundErr) {\n\t\t\treturn nil\n\t\t}\n\n\t\tif err != nil {\n\t\t\ts.logger.Errorf(\"Error while waiting for consumer deregistration: %s\", err)\n\t\t\treturn fmt.Errorf(\"cannot describe stream consumer: %w\", err)\n\t\t}\n\n\t\ttime.Sleep(time.Millisecond * 200 * time.Duration(i+1))\n\t}\n\n\treturn fmt.Errorf(\"consumer %s is not deregistered after %d tries\", consumerName, maxTries)\n}\n\nfunc (s *Source) DeregisterConsumer(ctx context.Context) error {\n\ts.logger.Debugf(\"Deregistering consumer %s if it exists\", s.Config.ConsumerName)\n\t_, err := s.kClient.DeregisterStreamConsumer(ctx, &kinesis.DeregisterStreamConsumerInput{\n\t\t\tConsumerName: aws.String(s.Config.ConsumerName),\n\t\t\tStreamARN:    aws.String(s.Config.StreamARN),\n\t\t})\n\n\tvar resourceNotFoundErr *kinTypes.ResourceNotFoundException\n\tif errors.As(err, &resourceNotFoundErr) {\n\t\treturn nil","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kinesis/run.go#L66-L102","documentation":"Returned by WaitForConsumerDeregistration when a DescribeStreamConsumer call fails with a non-ResourceNotFound error while polling for a consumer to leave DELETING state. After DeregisterStreamConsumer, the source polls the consumer; a describe failure other than ResourceNotFound aborts the wait with this wrapped error.","triggerScenarios":"Calling DeregisterConsumer (e.g. during source shutdown in EnhancedRead teardown) and the DescribeStreamConsumer API returns an unexpected error: throttling, invalid ARN format, network failure, or expired credentials.","commonSituations":"AWS throttling (LimitExceededException) during shutdown bursts; IAM role lacking kinesis:DescribeStreamConsumer; stale StreamARN after the stream was deleted/recreated.","solutions":["Check the wrapped cause: if throttled, reduce polling frequency or increase Config.MaxRetries with backoff.","Grant the IAM principal `kinesis:DescribeStreamConsumer` and `kinesis:DeregisterStreamConsumer` on the stream/consumer ARN.","Verify `stream_arn` in the acquisition config still refers to an existing stream.","Check network/proxy reachability to the Kinesis endpoint."],"exampleFix":"// before\n{\"stream_arn\": \"arn:aws:kinesis:us-east-1:123:stream/old-stream\"}\n// after\n{\"stream_arn\": \"arn:aws:kinesis:us-east-1:123:stream/current-stream\"}","handlingStrategy":"try-catch","validationCode":"// Ensure IAM actions exist before running\n// kinesis:DescribeStreamConsumer on stream/consumer ARNs\naws iam simulate-principal-policy --policy-source-arn <role> --action-names kinesis:DescribeStreamConsumer","typeGuard":"var nf *kinTypes.ResourceNotFoundException\nif errors.As(err, &nf) { return nil } // consumer already gone — treat as success","tryCatchPattern":"_, err := s.kClient.DescribeStreamConsumer(ctx, input)\nvar nf *kinTypes.ResourceNotFoundException\nif errors.As(err, &nf) { return nil }\nvar tle *kinTypes.LimitExceededException\nif errors.As(err, &tle) { /* retry with backoff */ }","preventionTips":["Grant kinesis:DescribeStreamConsumer to the acquisition IAM role.","Set generous max_retries and rely on the built-in backoff.","Validate stream_arn format and region at config-load time."],"tags":["aws","kinesis","api-error"],"backgroundTag":"api-error-response","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}