floci-io/floci · error · AwsException

BadRequestException

BadRequestException

Error message

Invalid resource ARN: {arn}

What it means

Thrown by AppConfig's standalone tag handler (TagResource/UntagResource/ListTagsForResource) when the supplied ResourceArn cannot be parsed as an ARN at all — AwsArnUtils.parse() raises IllegalArgumentException and the handler converts it to BadRequestException (HTTP 400) with 'Invalid resource ARN: <arn>'. This is the structural failure; error 155 is the shape failure after a successful parse.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/appconfig/AppConfigTagHandler.java:77

    }

    @Override
    public void untagResource(String region, String arn, List<String> tagKeys) {
        ResourceRef ref = parseArn(arn);
        if ("application".equals(ref.type())) {
            service.untagApplication(ref.id(), tagKeys);
        }
    }

    private record ResourceRef(String type, String id) {}

    private static ResourceRef parseArn(String arn) {
        // arn:aws:appconfig:<region>:<account>:<resource>
        String resource;
        try {
            resource = AwsArnUtils.parse(arn).resource();
        } catch (IllegalArgumentException e) {
            throw new AwsException("BadRequestException", "Invalid resource ARN: " + arn, 400);
        }
        String[] parts = resource.split("/");
        if (parts.length >= 2 && "application".equals(parts[0])) {
            // application/<appId>
            if (parts.length == 2) return new ResourceRef("application", parts[1]);
            // application/<appId>/environment/<envId>
            // application/<appId>/configurationprofile/<profileId>
            if (parts.length == 4) return new ResourceRef(parts[2], parts[3]);
            // application/<appId>/environment/<envId>/deployment/<num>
            if (parts.length == 6) return new ResourceRef(parts[4], parts[5]);
        }
        throw new AwsException("BadRequestException", "Invalid resource ARN: " + arn, 400);
    }
}

View on GitHub (pinned to 62ff490619)

Solutions

1. Use a full AppConfig ARN: arn:aws:appconfig:<region>:<account>:application/<appId>.
2. For nested resources keep the whole path: application/<appId>/environment/<envId>, application/<appId>/configurationprofile/<profileId>, or .../environment/<envId>/deployment/<n>.
3. Copy the ARN from the create response (CreateApplication returns an ARN) rather than building it.
4. Add a caller-side preflight regex: ^arn:aws:appconfig:[a-z0-9-]+:\d{12}:application(/.*)?$.

Example fix

# before
aws appconfig tag-resource --resource-arn my-app-name --tags k=v

# after
aws appconfig tag-resource \
  --resource-arn arn:aws:appconfig:us-east-1:123456789012:application/abc1234 \
  --tags k=v

// Structural check before tagging
if (resourceArn == null || !resourceArn.startsWith("arn:aws:appconfig:")) {
    throw new IllegalArgumentException(
        "Expected arn:aws:appconfig:<region>:<account>:application/..., got: " + resourceArn);
}
appConfigClient.tagResource(TagResourceRequest.builder()
    .resourceArn(resourceArn).tags(tags).build());

boolean isAppConfigArn(String s) {
    if (s == null) return false;
    String[] p = s.split(":", 6);
    return p.length == 6 && "arn".equals(p[0]) && s.contains(":application")
        || p.length == 6 && p[5].startsWith("application/");
}

When it happens

Trigger: Passing a bare resource id ('abc1234'), an AppConfig application name, or a malformed string ('appconfig:us-east-1:application/abc') as ResourceArn. Also passing values with fewer or more than the six colon-separated ARN components.

Common situations: Confusing the application's Name with its Id and ARN. Hand-assembling ARNs from region + id and dropping a field. Passing the deployment number or environment name alone because that is what the console displays.

Understand the failure class

Background: BadRequestException (HTTP 400) — NestJS 'Bad Request' Errors: Why They Fire and How to Fix Them — this error's family across 4 libraries.

Related errors

• BadRequestException
• TLS enabled but no certificate provided and self-signed gene
• ValidationException
• ValidationException
• floci.storage.efs root-permissions must be 3-4 octal digits

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/303353a56db70ee0. Report an issue: GitHub.