floci-io/floci · error · AwsException

ResourceInUse

ResourceInUse

Error message

Cannot delete this resource because it is in use.

What it means

CloudFrontService.deleteKeyGroup throws ResourceInUse (HTTP 409) when keyGroupInUse(id) determines the group is still referenced by a stored distribution configuration. CloudFront refuses to delete key groups that distributions depend on (trusted key groups on cache behaviors), and the emulator enforces the same guard.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java:1083

        validateKeyGroup(updated);
        validateUniqueKeyGroupName(updated.getName(), id);
        updated.setId(id);
        updated.setLastModifiedTime(Instant.now());
        updated.setEtag(UUID.randomUUID().toString());
        keyGroupStore.put(id, updated);
        return updated;
    }

    public synchronized void deleteKeyGroup(String id, String ifMatch) {
        KeyGroup existing = getKeyGroup(id);
        if (!existing.getEtag().equals(ifMatch)) {
            throw new AwsException(
                    "PreconditionFailed",
                    "The precondition in one or more request-header fields evaluated to false.",
                    412);
        }
        if (keyGroupInUse(id)) {
            throw new AwsException(
                    "ResourceInUse",
                    "Cannot delete this resource because it is in use.",
                    409);
        }
        keyGroupStore.delete(id);
    }

    private void validateUniqueKeyGroupName(String name, String excludedId) {
        boolean duplicate = keyGroupStore.scan(group -> true).stream()
                .anyMatch(group -> !Objects.equals(excludedId, group.getId())
                        && Objects.equals(name, group.getName()));
        if (duplicate) {
            throw new AwsException(
                    "KeyGroupAlreadyExists",
                    "A key group with this name already exists.",
                    409);
        }
    }

View on GitHub (pinned to 62ff490619)

Solutions

  1. Delete or update distributions that reference the key group first (remove it from TrustedKeyGroups), then delete the group.
  2. Inspect ListDistributions for references before attempting deletion.
  3. In tests, clean up state or use unique names per run so stale distributions cannot hold references.

Example fix

// before
deleteKeyGroup(groupId); // 409 while distributions reference it

// after
for (Distribution d : distributionsReferencingGroup(groupId)) {
    deleteDistribution(d.getId());
}
deleteKeyGroup(groupId);
Defensive patterns

Strategy: try-catch

Validate before calling

boolean keyGroupReferenced(CloudFrontClient client, String groupId) {
    return client.listDistributions(r -> r.build()).distributionList().items().stream()
            .anyMatch(d -> distributionBehaviorsTrustGroup(d, groupId));
}

Try / catch

try {
    client.deleteKeyGroup(r -> r.id(groupId).ifMatch(etag));
} catch (ResourceInUse e) {
    // strip the group from TrustedKeyGroups on referencing distributions (or delete them), then retry
}

Prevention

When it happens

Trigger: DeleteKeyGroup while any distribution's cache behaviors still list the group in TrustedKeyGroups — commonly deleting the group before the distribution, or after a test re-created a distribution referencing it.

Common situations: Teardown in creation order; long-lived emulator state where old distributions from earlier runs still reference the fixture key group; forgetting that UpdateDistribution can re-attach a group.

Related errors

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/414981aa0af0f7ed. Report an issue: GitHub.