crowdsecurity/crowdsec · error

failed to load aws config: %w

Error message

failed to load aws config: %w

What it means

newS3Client builds the AWS SDK (go v2) shared configuration via config.LoadDefaultConfig for the S3 client. The SDK errors when the resolved configuration is invalid (unparseable config files, bad profile, invalid region format), and the source wraps it as 'failed to load aws config'.

Source

Thrown at pkg/acquisition/modules/s3/config.go:63

	var loadOpts []func(*config.LoadOptions) error
	if s.Config.AwsProfile != nil && *s.Config.AwsProfile != "" {
		loadOpts = append(loadOpts, config.WithSharedConfigProfile(*s.Config.AwsProfile))
	}

	region := s.Config.AwsRegion
	if region == "" {
		region = "us-east-1"
	}

	loadOpts = append(loadOpts, config.WithRegion(region))

	if c := defaultCreds(); c != nil {
		loadOpts = append(loadOpts, config.WithCredentialsProvider(c))
	}

	cfg, err := config.LoadDefaultConfig(ctx, loadOpts...)
	if err != nil {
		return nil, fmt.Errorf("failed to load aws config: %w", err)
	}

	var clientOpts []func(*s3.Options)
	if s.Config.AwsEndpoint != "" {
		clientOpts = append(clientOpts, func(o *s3.Options) {
			o.BaseEndpoint = aws.String(s.Config.AwsEndpoint)
		})
	}

	return s3.NewFromConfig(cfg, clientOpts...), nil
}

func (s *Source) newSQSClient(ctx context.Context) (*sqs.Client, error) {
	var loadOpts []func(*config.LoadOptions) error
	if s.Config.AwsProfile != nil && *s.Config.AwsProfile != "" {
		loadOpts = append(loadOpts, config.WithSharedConfigProfile(*s.Config.AwsProfile))
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Validate the environment with the AWS CLI: AWS_PROFILE=<profile> aws s3 ls (or `aws configure list`)
2. Fix region/profile entries in ~/.aws/config, or set AWS_REGION/AWS_DEFAULT_REGION explicitly
3. Repair or remove malformed entries in ~/.aws/config and ~/.aws/credentials
4. Check AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE point to readable, well-formed files

Example fix

// before (~/.aws/config)
[default]
region =
// after
[default]
region = us-east-1

if os.Getenv("AWS_REGION") == "" && os.Getenv("AWS_DEFAULT_REGION") == "" {
    // ensure ~/.aws/config defines a region for the active profile
}
if p := os.Getenv("AWS_PROFILE"); p != "" {
    if _, err := os.Stat(os.Getenv("AWS_CONFIG_FILE")); err != nil {
        // config file missing — fail fast before LoadDefaultConfig
    }
}

When it happens

Trigger: Configure or ConfigureByDSN when ~/.aws/config or ~/.aws/credentials is malformed, AWS_PROFILE names a missing profile, the region value is unparseable, or AWS_CONFIG_FILE/AWS_SHARED_CREDENTIALS_FILE point to invalid files.

Common situations: Hand-edited ~/.aws files with duplicate or malformed keys; AWS_PROFILE pointing at a profile that no longer exists; empty/invalid region entries; stale env vars in the service environment.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• bucket_name and sqs_name are mutually exclusive
• sqs_name is required when using sqs polling method
• bucket_name is required
• unknown level %s: %w
• unable to parse '%s' as duration: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/06b193f53b8f923b. Report an issue: GitHub.