crowdsecurity/crowdsec · error

cannot parse S3Acquisition configuration: %s

Error message

cannot parse S3Acquisition configuration: %s

What it means

UnmarshalConfig parses the S3 acquisition yaml with yaml.Strict(), which rejects unknown fields in addition to syntax errors. Any parse failure is formatted and wrapped as 'cannot parse S3Acquisition configuration'.

Source

Thrown at pkg/acquisition/modules/s3/config.go:111

	cfg, err := config.LoadDefaultConfig(ctx, loadOpts...)
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}

	var clientOpts []func(*sqs.Options)
	if s.Config.AwsEndpoint != "" {
		clientOpts = append(clientOpts, func(o *sqs.Options) { o.BaseEndpoint = aws.String(s.Config.AwsEndpoint) })
	}

	return sqs.NewFromConfig(cfg, clientOpts...), nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.Config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.Config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse S3Acquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.Config.Mode == "" {
		s.Config.Mode = configuration.TAIL_MODE
	}

	if s.Config.PollingMethod == "" {
		s.Config.PollingMethod = PollMethodList
	}

	if s.Config.PollingInterval == 0 {
		s.Config.PollingInterval = 60
	}

	if s.Config.MaxBufferSize == 0 {
		s.Config.MaxBufferSize = bufio.MaxScanTokenSize
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error message: it names the exact unknown field or syntax problem
2. Fix the typo or remove the unsupported key
3. Compare the config against the documented S3 source keys for your crowdsec version
4. Lint the file with yamllint before deploying

Example fix

// before
bucket_nam: my-bucket
// after
bucket_name: my-bucket

var cfg s3acquisition.Configuration
if err := yaml.UnmarshalWithOptions(data, &cfg, yaml.Strict()); err != nil {
    // fix the yaml before deploying
}

When it happens

Trigger: Loading an S3 acquisition yaml containing a syntax error, wrong indentation, or any key not present in the module's Configuration struct (strict mode).

Common situations: Typo'd keys (bucket_nam vs bucket_name); config copied from another acquisition module; keys renamed/deprecated after a crowdsec upgrade; tab/indent mistakes.

Related errors

• bucket_name and sqs_name are mutually exclusive
• sqs_name is required when using sqs polling method
• bucket_name is required
• empty file
• while parsing DockerAcquisition configuration: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/128846ca77be8720. Report an issue: GitHub.