floci-io/floci · error · AwsException

%s is an unknown Reserved Tag.

Error message

%s is an unknown Reserved Tag.

What it means

Thrown during pipeline execution when a stage action declares owner 'AWS' but its provider is not one of the providers the emulator implements: S3, CodeBuild, CodeDeploy, Lambda, or CodePipeline. Real AWS supports many more AWS-owned providers (e.g. ECR, CodeCommit, GitHub? no—those differ, CloudFormation, ECS, etc.); Floci fails the action declaration rather than silently no-oping. It surfaces as InvalidActionDeclarationException at action start.

Source

Thrown at src/main/java/io/github/hectorvent/floci/core/common/ReservedTags.java:128

        }
        for (String key : tags.keySet()) {
            if (isReserved(key)) {
                throw new AwsException(
                        VALIDATION_EXCEPTION,
                        "Reserved tag keys with prefix " + RESERVED_PREFIX + " can only be supplied during resource creation.",
                        400
                );
            }
        }
    }

    public static void rejectUnknownReservedTags(Map<String, String> tags, String errorCode) {
        if (tags == null) {
            return;
        }
        for (String key : tags.keySet()) {
            if (isReserved(key) && !key.equals(OVERRIDE_ID_KEY) && !key.equals(OVERRIDE_COGNITO_CLIENT_ID_KEY) && !key.equals(OVERRIDE_COGNITO_CLIENT_SECRET_KEY)) {
                    throw new AwsException(
                            errorCode,
                            "%s is an unknown Reserved Tag.".formatted(key),
                            400
                    );
                }
        }
    }

    private static String getOverride(Map<String, String> tags, String override, TriFunction<String, String, String, String> validator, String name, String errorCode) {
        if (tags == null) {
            return null;
        }
        if (tags.containsKey(override)) {
            String ov = tags.get(override);
            return validator.apply(ov, name, errorCode);
        }
        return null;
    }

View on GitHub (pinned to 62ff490619)

Solutions

1. Replace unsupported AWS-owned provider actions with one of S3, CodeBuild, CodeDeploy, Lambda, or CodePipeline for emulator runs
2. For source actions, switch to an S3 source (S3Bucket/S3ObjectKey configuration) which the emulator fully executes
3. If you need a custom worker flow, change the action owner to Custom and poll with PollForJobs instead

Example fix

# before
- Name: Deploy
  Actions:
    - Name: cfn-deploy
      ActionTypeId: { Category: Deploy, Owner: AWS, Provider: CloudFormation, Version: '1' }

# after
- Name: Deploy
  Actions:
    - Name: lambda-deploy
      ActionTypeId: { Category: Deploy, Owner: AWS, Provider: Lambda, Version: '1' }

Set<String> supported = Set.of("S3", "CodeBuild", "CodeDeploy", "Lambda", "CodePipeline");
for (ActionDeclaration a : stage.actions()) {
    if ("AWS".equals(a.actionTypeId().owner())
            && !supported.contains(a.actionTypeId().provider())) {
        throw new UnsupportedOperationException(
            "Provider not available in emulator: " + a.actionTypeId().provider());
}

try {
    client.createPipeline(req);
} catch (InvalidActionDeclarationException e) {
    // surface which provider is unsupported; adjust pipeline for emulator runs
}

When it happens

Trigger: A pipeline with a deploy action using provider 'CloudFormation', 'ECS', 'ECR', 'CodeCommit', 'SNS', or any AWS-owned provider outside the supported five; importing an existing production pipeline into the emulator unchanged.

Common situations: Porting real-world pipelines to local testing; pipelines whose source stage uses CodeCommit or ECR; newly added provider types in AWS that the emulator version predates.

Related errors

• TLS enabled but no certificate provided and self-signed gene
• Failed to write self-signed TLS certificate
• ${description} file not found or not readable: ${path}
• BadRequestException
• ValidationException

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/7b8433242a5a9139. Report an issue: GitHub.