floci-io/floci · error · AwsException

InvalidRequestException

InvalidRequestException

Error message

Non-empty backup vault cannot be deleted: {vaultName}

What it means

Thrown by deleteBackupVault when the vault still contains recovery points (NumberOfRecoveryPoints > 0). AWS Backup requires a vault to be empty before deletion so recovery points are not silently destroyed; Floci enforces the same rule with InvalidRequestException (HTTP 400).

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/backup/BackupService.java:94

        vault.setEncryptionKeyArn(encryptionKeyArn);
        vault.setCreationDate(Instant.now().getEpochSecond());
        vault.setCreatorRequestId(creatorRequestId);
        vault.setNumberOfRecoveryPoints(0);
        vault.setTags(tags);
        vaultStore.put(key, vault);
        LOG.infov("Created backup vault {0} in {1}", vaultName, region);
        return vault;
    }

    public BackupVault describeBackupVault(String vaultName, String region) {
        return vaultStore.get(vaultKey(region, vaultName))
                .orElseThrow(() -> new AwsException("ResourceNotFoundException", "Backup vault not found: " + vaultName, 404));
    }

    public void deleteBackupVault(String vaultName, String region) {
        BackupVault vault = describeBackupVault(vaultName, region);
        if (vault.getNumberOfRecoveryPoints() > 0) {
            throw new AwsException("InvalidRequestException",
                    "Non-empty backup vault cannot be deleted: " + vaultName, 400);
        }
        vaultStore.delete(vaultKey(region, vaultName));
    }

    public List<BackupVault> listBackupVaults(String region) {
        String prefix = region + ":";
        return vaultStore.scan(k -> k.startsWith(prefix));
    }

    // ── Plan ───────────────────────────────────────────────────────────────────

    public BackupPlan createBackupPlan(String planName, List<BackupRule> rules,
                                       String creatorRequestId, String region) {
        String planId = UUID.randomUUID().toString();
        BackupPlan plan = new BackupPlan();
        plan.setBackupPlanId(planId);
        plan.setBackupPlanArn(regionResolver.buildArn("backup", region, "backup-plan:" + planId));

View on GitHub (pinned to 62ff490619)

Solutions

  1. Delete the vault's recovery points first (ListRecoveryPointsByBackupVault + DeleteRecoveryPoint for each), then delete the vault
  2. Ensure backup plans selecting resources into this vault are deleted or disabled so no new points appear
  3. Only then call DeleteBackupVault

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

BackupVault v = backup.describeBackupVault(DescribeBackupVaultRequest.builder()
    .backupVaultName(vaultName).build());
if (v.numberOfRecoveryPoints() > 0) { /* empty the vault first */ }

Try / catch

catch (InvalidRequestException e) { delete recovery points, then retry delete vault; }

Prevention

When it happens

Trigger: Calling DeleteBackupVault on a vault whose recovery-point count is above zero — i.e. backups have been written into it and not deleted.

Common situations: Teardown scripts deleting vaults before their backup plans/jobs; forgetting that continuous or scheduled backups keep adding recovery points; test cleanup leaving the default vault populated.

Related errors

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/94d6cc998fd5f2f1. Report an issue: GitHub.