crowdsecurity/crowdsec · error

stream_arn and stream_name are mutually exclusive

Error message

stream_arn and stream_name are mutually exclusive

What it means

StreamName and StreamARN are two alternative ways to address the same Kinesis stream, so Configuration.Validate() refuses configs that set both, since which one wins would be ambiguous. Pick exactly one identifier — the name for shared-consumer mode or the ARN for enhanced fan-out mode.

Source

Thrown at pkg/acquisition/modules/kinesis/config.go:89

	return nil
}

func (c *Configuration) Validate() error {
	if c.StreamName == "" && !c.UseEnhancedFanOut {
		return errors.New("stream_name is mandatory when use_enhanced_fanout is false")
	}

	if c.StreamARN == "" && c.UseEnhancedFanOut {
		return errors.New("stream_arn is mandatory when use_enhanced_fanout is true")
	}

	if c.ConsumerName == "" && c.UseEnhancedFanOut {
		return errors.New("consumer_name is mandatory when use_enhanced_fanout is true")
	}

	if c.StreamARN != "" && c.StreamName != "" {
		return errors.New("stream_arn and stream_name are mutually exclusive")
	}

	return nil
}

func (s *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	err = s.newClient(ctx)
	if err != nil {
		return fmt.Errorf("cannot create kinesis client: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Remove stream_name and keep only stream_arn (with use_enhanced_fanout: true and consumer_name), or
2. Remove stream_arn and keep only stream_name for non-fan-out mode.
3. Search the effective merged YAML (including included files) for duplicate stream keys.

Example fix

// before (yaml)
source: kinesis
stream_name: logs
stream_arn: arn:aws:kinesis:us-east-1:123456789012:stream/logs

// after (yaml)
source: kinesis
stream_name: logs

if cfg.StreamARN != "" && cfg.StreamName != "" {
    return fmt.Errorf("kinesis: set either stream_arn or stream_name, not both")
}

When it happens

Trigger: Calling Validate() on a kinesis Configuration where both StreamARN and StreamName are non-empty, regardless of UseEnhancedFanOut.

Common situations: Users add stream_arn to an existing stream_name config while migrating to enhanced fan-out but forget to delete stream_name, or merge config fragments from two examples.

Related errors

• stream_name is mandatory when use_enhanced_fanout is false
• stream_arn is mandatory when use_enhanced_fanout is true
• consumer_name is mandatory when use_enhanced_fanout is true
• cannot create kinesis client: %w
• failed to load aws config: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9c6f25a9a22fc724. Report an issue: GitHub.