crowdsecurity/crowdsec · error

aws_region is not specified, specify it or aws_config_dir

Error message

aws_region is not specified, specify it or aws_config_dir

What it means

setupAWS() determines the AWS region either from aws_region or implicitly from an AWS config directory (aws_config_dir whose config file contains the region). If neither is provided, the SDK cannot target a region and setupAWS fails with this error after logging it.

Source

Thrown at pkg/acquisition/modules/cloudwatch/config.go:171

}


func (s *Source) setupAWS(ctx context.Context) error {
	if *s.Config.AwsConfigDir != "" {
		_, err := os.Stat(*s.Config.AwsConfigDir)
		if err != nil {
			s.logger.Errorf("can't read aws_config_dir '%s' got err %s", *s.Config.AwsConfigDir, err)
			return fmt.Errorf("can't read aws_config_dir %s got err %w ", *s.Config.AwsConfigDir, err)
		}

		os.Setenv("AWS_SDK_LOAD_CONFIG", "1")
		// as aws sdk relies on $HOME, let's allow the user to override it :)
		os.Setenv("AWS_CONFIG_FILE", fmt.Sprintf("%s/config", *s.Config.AwsConfigDir))
		os.Setenv("AWS_SHARED_CREDENTIALS_FILE", fmt.Sprintf("%s/credentials", *s.Config.AwsConfigDir))
	} else {
		if s.Config.AwsRegion == "" {
			s.logger.Errorf("aws_region is not specified, specify it or aws_config_dir")
			return errors.New("aws_region is not specified, specify it or aws_config_dir")
		}

		os.Setenv("AWS_REGION", s.Config.AwsRegion)
	}

	if err := s.newClient(ctx); err != nil {
		return err
	}

	s.streamIndexes = make(map[string]string)

	targetStream := "*"

	if s.Config.StreamRegexp != nil {
		if _, err := regexp.Compile(*s.Config.StreamRegexp); err != nil {
			return fmt.Errorf("while compiling regexp '%s': %w", *s.Config.StreamRegexp, err)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Add aws_region: <region> to the cloudwatch datasource config
2. Or set aws_config_dir to a directory containing a valid AWS config/credentials with the region
3. As a system-level fix, ensure ~/.aws/config defines a default region (note the code sets AWS_CONFIG_FILE when aws_config_dir is used)

Example fix

// before
source: cloudwatch
group_name: /my/group
// after
source: cloudwatch
group_name: /my/group
aws_region: eu-west-1

if awsCfg.AwsRegion == "" && awsCfg.AwsConfigDir == nil {
    return errors.New("set aws_region or aws_config_dir")
}

if err := src.Configure(ctx, yaml, logger, lvl); err != nil {
    if strings.Contains(err.Error(), "aws_region is not specified") { /* add aws_region or aws_config_dir */ }
    return err
}

When it happens

Trigger: Configure() -> setupAWS() runs with AwsConfigDir nil and s.Config.AwsRegion == "" — no region in the datasource config and no aws_config_dir to read one from.

Common situations: CloudWatch datasource config without aws_region on a machine with no default AWS profile; container images lacking ~/.aws/config; relying on env AWS_REGION that this code path overrides/ignores.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• group_name is mandatory for CloudwatchSource
• can't read aws_config_dir %s got err %w
• while compiling regexp '%s': %w
• query is mandatory (at least start_date and end_date or back
• cloudwatch path must contain group and stream : /my/group/na

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/550bcdfcfbdf7830. Report an issue: GitHub.