floci-io/floci · error · AwsException

TooManyPublicKeysInKeyGroup

TooManyPublicKeysInKeyGroup

Error message

A key group can contain at most five public keys.

What it means

AWS limits a CloudFront key group to five public keys, and Floci enforces the same cap. When KeyGroupConfig.Items contains more than five entries, validateKeyGroup throws TooManyPublicKeysInKeyGroup (HTTP 400). This is a distinct error code from InvalidArgument, so clients can branch on it specifically.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java:1154

    private void validateKeyGroup(KeyGroup group) {
        if (group == null || group.getName() == null || group.getName().isBlank()) {
            throw new AwsException(
                    "InvalidArgument", "The parameter Name is required.", 400);
        }
        if (group.getComment() != null && group.getComment().length() > 128) {
            throw new AwsException(
                    "InvalidArgument", "The comment must be 128 characters or fewer.", 400);
        }
        List<String> items = group.getItems();
        if (items == null || items.isEmpty()) {
            throw new AwsException(
                    "InvalidArgument",
                    "A key group must contain at least one public key.",
                    400);
        }
        if (items.size() > 5) {
            throw new AwsException(
                    "TooManyPublicKeysInKeyGroup",
                    "A key group can contain at most five public keys.",
                    400);
        }
        if (new LinkedHashSet<>(items).size() != items.size()) {
            throw new AwsException(
                    "InvalidArgument",
                    "A public key cannot appear more than once in a key group.",
                    400);
        }
        for (String publicKeyId : items) {
            if (publicKeyId == null
                    || publicKeyId.isBlank()
                    || publicKeyStore.get(publicKeyId).isEmpty()) {
                throw new AwsException(
                        "InvalidArgument",
                        "The specified public key does not exist.",
                        400);

View on GitHub (pinned to 62ff490619)

Solutions

1. Reduce Items to at most five public key IDs, removing the oldest or revoked keys first
2. Split keys across multiple key groups and reference each group where needed
3. Track key rotation dates so expired keys are dropped before new ones are added

Example fix

// before
List<String> items = allKnownPublicKeyIds; // grows unbounded, now 7 entries
config.setItems(items);

// after
List<String> items = allKnownPublicKeyIds.stream()
    .sorted(Comparator.comparing(KeyRotation::newestFirst))
    .limit(5)
    .toList();
config.setItems(items);

if (keyGroupConfig.getItems().size() > 5) {
    throw new IllegalArgumentException("Key group supports at most 5 public keys, got " + keyGroupConfig.getItems().size());
}

When it happens

Trigger: CreateKeyGroup or UpdateKeyGroup with six or more public key IDs in Items — typically when rotating keys across many environments or merging key groups together.

Common situations: Key rotation strategies that only add new keys and never remove old ones; merging two key groups by concatenating their Items lists; copying a production key list that grew past the limit over time.

Related errors

• ResourceInUse
• KeyGroupAlreadyExists
• TooManyTagsException
• ApiKeyLimitExceededException
• InvalidIfMatchVersion

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/262facb728073ef2. Report an issue: GitHub.