crowdsecurity/crowdsec · error

cannot list shards

Error message

cannot list shards: %w

What it means

ReadFromStream enumerates shards with kinesis ListShards before spawning per-shard readers; the AWS call failed (credentials, permissions, missing/throttled stream), so stream acquisition aborts with the wrapped AWS error.

Solutions

1. Check AWS credentials, region and network connectivity
2. Verify IAM permissions for kinesis:ListShards
3. Confirm the stream name and that the stream is ACTIVE

When it happens

Trigger: Thrown at pkg/acquisition/modules/kinesis/run.go:398 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/492631186b5b463b. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/kinesis/run.go:398

		case <-s.shardReaderTomb.Dying():
			logger.Infof("shardReaderTomb is dying, exiting ReadFromShard")
			ticker.Stop()

			return nil
		}
	}
}

func (s *Source) ReadFromStream(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {
	s.logger = s.logger.WithField("stream", s.Config.StreamName)
	s.logger.Info("starting kinesis acquisition from shards")

	for {
		shards, err := s.kClient.ListShards(ctx, &kinesis.ListShardsInput{
				StreamName: aws.String(s.Config.StreamName),
			})
		if err != nil {
			return fmt.Errorf("cannot list shards: %w", err)
		}

		s.shardReaderTomb = &tomb.Tomb{}

		for _, shard := range shards.Shards {
			shardID := *shard.ShardId

			s.shardReaderTomb.Go(func() error {
				defer trace.ReportPanic()
				return s.ReadFromShard(ctx, out, shardID)
			})
		}

		select {
		case <-t.Dying():
			s.logger.Info("kinesis source is dying")
			s.shardReaderTomb.Kill(nil)
			_ = s.shardReaderTomb.Wait() // we don't care about the error as we kill the tomb ourselves

View on GitHub (pinned to 909b515798)