{"record":{"id":"262facb728073ef2","repo":"floci-io/floci","slug":"toomanypublickeysinkeygroup","errorCode":"TooManyPublicKeysInKeyGroup","errorMessage":"A key group can contain at most five public keys.","messagePattern":"A key group can contain at most five public keys\\.","errorType":"exception","errorClass":"AwsException","httpStatus":400,"severity":"error","filePath":"src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java","lineNumber":1154,"sourceCode":"\n    private void validateKeyGroup(KeyGroup group) {\n        if (group == null || group.getName() == null || group.getName().isBlank()) {\n            throw new AwsException(\n                    \"InvalidArgument\", \"The parameter Name is required.\", 400);\n        }\n        if (group.getComment() != null && group.getComment().length() > 128) {\n            throw new AwsException(\n                    \"InvalidArgument\", \"The comment must be 128 characters or fewer.\", 400);\n        }\n        List<String> items = group.getItems();\n        if (items == null || items.isEmpty()) {\n            throw new AwsException(\n                    \"InvalidArgument\",\n                    \"A key group must contain at least one public key.\",\n                    400);\n        }\n        if (items.size() > 5) {\n            throw new AwsException(\n                    \"TooManyPublicKeysInKeyGroup\",\n                    \"A key group can contain at most five public keys.\",\n                    400);\n        }\n        if (new LinkedHashSet<>(items).size() != items.size()) {\n            throw new AwsException(\n                    \"InvalidArgument\",\n                    \"A public key cannot appear more than once in a key group.\",\n                    400);\n        }\n        for (String publicKeyId : items) {\n            if (publicKeyId == null\n                    || publicKeyId.isBlank()\n                    || publicKeyStore.get(publicKeyId).isEmpty()) {\n                throw new AwsException(\n                        \"InvalidArgument\",\n                        \"The specified public key does not exist.\",\n                        400);","sourceCodeStart":1136,"sourceCodeEnd":1172,"githubUrl":"https://github.com/floci-io/floci/blob/62ff490619e7bd3554597c28c704081b4c15add5/src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java#L1136-L1172","documentation":"AWS limits a CloudFront key group to five public keys, and Floci enforces the same cap. When KeyGroupConfig.Items contains more than five entries, validateKeyGroup throws TooManyPublicKeysInKeyGroup (HTTP 400). This is a distinct error code from InvalidArgument, so clients can branch on it specifically.","triggerScenarios":"CreateKeyGroup or UpdateKeyGroup with six or more public key IDs in Items — typically when rotating keys across many environments or merging key groups together.","commonSituations":"Key rotation strategies that only add new keys and never remove old ones; merging two key groups by concatenating their Items lists; copying a production key list that grew past the limit over time.","solutions":["Reduce Items to at most five public key IDs, removing the oldest or revoked keys first","Split keys across multiple key groups and reference each group where needed","Track key rotation dates so expired keys are dropped before new ones are added"],"exampleFix":"// before\nList<String> items = allKnownPublicKeyIds; // grows unbounded, now 7 entries\nconfig.setItems(items);\n\n// after\nList<String> items = allKnownPublicKeyIds.stream()\n    .sorted(Comparator.comparing(KeyRotation::newestFirst))\n    .limit(5)\n    .toList();\nconfig.setItems(items);","handlingStrategy":"validation","validationCode":"if (keyGroupConfig.getItems().size() > 5) {\n    throw new IllegalArgumentException(\"Key group supports at most 5 public keys, got \" + keyGroupConfig.getItems().size());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Bound the key list at 5 during rotation: add new, then remove oldest","Split larger key sets across multiple key groups"],"tags":["cloudfront","key-group","limits","key-rotation"],"backgroundTag":null,"analyzedSha":"62ff490619e7bd3554597c28c704081b4c15add5","analyzedAt":"2026-08-14T14:25:23.764Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}