crowdsecurity/crowdsec · error

failed to load aws config: %w

Error message

failed to load aws config: %w

What it means

newClient loads the AWS SDK v2 config (config.LoadDefaultConfig) honoring region, profile and credentials chains. When that load fails — bad profile, missing credentials file, invalid configuration — the error is wrapped as `failed to load aws config: <err>`. No cloudwatch client can be created, so acquisition or one-shot collection stops.

Source

Thrown at pkg/acquisition/modules/cloudwatch/run.go:81

		region = "us-east-1"
	}

	loadOpts = append(loadOpts, config.WithRegion(region))

	var sharedConfigProfileNotExistError config.SharedConfigProfileNotExistError

	cfg, err := config.LoadDefaultConfig(ctx, loadOpts...)
	if errors.As(err, &sharedConfigProfileNotExistError) {
		// Fallback for tests/CI where the profile is not present
		s.logger.Debugf("shared config profile %q not found; retrying without profile", aws.ToString(s.Config.AwsProfile))
		cfg, err = config.LoadDefaultConfig(ctx,
			config.WithRegion(region),
			config.WithCredentialsProvider(aws.AnonymousCredentials{}),
		)
	}

	if err != nil {
		return fmt.Errorf("failed to load aws config: %w", err)
	}

	var clientOpts []func(*cloudwatchlogs.Options)

	if v := os.Getenv("AWS_ENDPOINT_FORCE"); v != "" {
		s.logger.Debugf("[testing] overloading endpoint with %s", v)

		clientOpts = append(clientOpts, func(o *cloudwatchlogs.Options) {
			o.BaseEndpoint = aws.String(v)
		})
	}

	s.cwClient = cloudwatchlogs.NewFromConfig(cfg, clientOpts...)

	return nil
}

func (s *Source) StreamingAcquisition(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the profile exists: `aws configure list-profiles` and check ~/.aws/config and ~/.aws/credentials
2. Remove the `profile=` parameter from the DSN to use the default chain
3. Set AWS_REGION or add aws_region to the DSN and ensure credentials are resolvable (env vars, shared files, instance role)
4. Run `aws sts get-caller-identity --profile <name>` to validate the profile works with the AWS CLI

Example fix

// before
cloudwatch://my-group?profile=nonexistent
// after
cloudwatch://my-group?profile=default&aws_region=us-east-1

profiles, err := exec.Command("aws", "configure", "list-profiles").Output()
if err != nil || !strings.Contains(string(profiles), wantedProfile) {
    return fmt.Errorf("AWS profile %q not found in shared config", wantedProfile)
}

cfg, err := newClient(ctx)
if err != nil {
    var credsErr error
    if errors.As(err, &credsErr) { /* fall back to env credentials or default profile */ }
    return err
}

When it happens

Trigger: newClient called via ConfigureByDSN, Configure, or setupAWS when the AWS profile named in the DSN does not exist in ~/.aws/config, credentials files are malformed, or region configuration is invalid.

Common situations: `profile=prod` present in DSN but absent from ~/.aws/config; corrupted ~/.aws/credentials; AWS_CONFIG_FILE pointing to a missing file; invalid shared config YAML.

Related errors

• unknown level %s: %w
• unable to parse '%s' as duration: %w
• unexpected argument %s
• cannot create kinesis client: %w
• group_name is mandatory for CloudwatchSource

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ed6fb52ff5bb83a1. Report an issue: GitHub.