crowdsecurity/crowdsec · error

cannot list shards: %w

Error message

cannot list shards: %w

What it means

ReadFromStream enumerates shards with kinesis ListShards before spawning per-shard readers; the AWS call failed (credentials, permissions, missing/throttled stream), so stream acquisition aborts with the wrapped AWS error.

Source

Thrown at pkg/acquisition/modules/kinesis/run.go:398

		case <-s.shardReaderTomb.Dying():
			logger.Infof("shardReaderTomb is dying, exiting ReadFromShard")
			ticker.Stop()

			return nil
		}
	}
}

func (s *Source) ReadFromStream(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {
	s.logger = s.logger.WithField("stream", s.Config.StreamName)
	s.logger.Info("starting kinesis acquisition from shards")

	for {
		shards, err := s.kClient.ListShards(ctx, &kinesis.ListShardsInput{
				StreamName: aws.String(s.Config.StreamName),
			})
		if err != nil {
			return fmt.Errorf("cannot list shards: %w", err)
		}

		s.shardReaderTomb = &tomb.Tomb{}

		for _, shard := range shards.Shards {
			shardID := *shard.ShardId

			s.shardReaderTomb.Go(func() error {
				defer trace.ReportPanic()
				return s.ReadFromShard(ctx, out, shardID)
			})
		}

		select {
		case <-t.Dying():
			s.logger.Info("kinesis source is dying")
			s.shardReaderTomb.Kill(nil)
			_ = s.shardReaderTomb.Wait() // we don't care about the error as we kill the tomb ourselves

View on GitHub (pinned to 909b515798)

Solutions

1. Check AWS credentials, region and network connectivity
2. Verify IAM permissions for kinesis:ListShards
3. Confirm the stream name and that the stream is ACTIVE

When it happens

Trigger: Thrown at pkg/acquisition/modules/kinesis/run.go:398 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/492631186b5b463b. Report an issue: GitHub.