What causes "invalid DSN %s for S3 source, must start with s3://" in crowdsecurity/crowdsec?

Use s3://bucket/prefix format in the acquisition DSN

invalid DSN %s for S3 source, must start with s3://

Error message

invalid DSN %s for S3 source, must start with s3://

What it means

Returned by ConfigureByDSN when the DSN given to the S3 acquisition source does not start with the required s3:// scheme prefix, i.e. the wrong datasource type was configured for this module. The offending input is the full DSN string.

Source

Thrown at pkg/acquisition/modules/s3/config.go:199

	}

	s.s3Client = client

	if s.Config.PollingMethod == PollMethodSQS {
		sqsClient, err := s.newSQSClient(ctx)
		if err != nil {
			return err
		}

		s.sqsClient = sqsClient
	}

	return nil
}

func (s *Source) ConfigureByDSN(ctx context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	if !strings.HasPrefix(dsn, "s3://") {
		return fmt.Errorf("invalid DSN %s for S3 source, must start with s3://", dsn)
	}

	s.Config = Configuration{}
	s.logger = logger.WithFields(log.Fields{
		"bucket": s.Config.BucketName,
		"prefix": s.Config.Prefix,
	})

	dsn = strings.TrimPrefix(dsn, "s3://")
	args := strings.Split(dsn, "?")

	if args[0] == "" {
		return errors.New("empty s3:// DSN")
	}

	if len(args) == 2 && args[1] != "" {
		params, err := url.ParseQuery(args[1])
		if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

Use s3://bucket/prefix format in the acquisition DSN
Ensure the DSN is assigned to the S3 source type

Example fix

// before
ConfigureByDSN(ctx, "my-bucket?log_level=info", ...)
// after
ConfigureByDSN(ctx, "s3://my-bucket?log_level=info", ...)

Defensive patterns

Strategy: validation

Validate before calling

if !strings.HasPrefix(dsn, "s3://") {
    return fmt.Errorf("DSN must start with s3://, got %q", dsn)
}

Prevention

Always build DSNs as s3://<bucket>[?options]
Convert bucket ARNs to s3:// form before passing them
Unit-test any code that generates DSN strings

When it happens

Trigger: Calling ConfigureByDSN (directly or via crowdsec DSN-based acquisition) with strings like 'bucket/my-bucket', 'arn:aws:s3:::my-bucket', or a scheme-less bucket name.

Common situations: Programmatically building DSNs and dropping the scheme; pasting a bucket ARN or plain bucket name where a DSN is expected.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/05df8aec41e35d6a. Report an issue: GitHub.