floci-io/floci · error · AwsException

TrustedKeyGroupDoesNotExist

TrustedKeyGroupDoesNotExist

Error message

The specified key group does not exist.

What it means

Floci validates that each ID in a distribution's TrustedKeyGroups list exists in keyGroupStore, throwing TrustedKeyGroupDoesNotExist (HTTP 400) when one is null, blank, or unknown. AWS uses the same error code. The check applies to the default cache behavior and every cache behavior on create and update.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/cloudfront/CloudFrontService.java:1211

                }
            }
        }
    }

    private void validateTrustedKeyGroups(
            boolean enabled, List<String> keyGroupIds) {
        List<String> ids = keyGroupIds != null ? keyGroupIds : List.of();
        if (enabled && ids.isEmpty()) {
            throw new AwsException(
                    "InvalidArgument",
                    "TrustedKeyGroups cannot be enabled without a key group.",
                    400);
        }
        for (String keyGroupId : ids) {
            if (keyGroupId == null
                    || keyGroupId.isBlank()
                    || keyGroupStore.get(keyGroupId).isEmpty()) {
                throw new AwsException(
                        "TrustedKeyGroupDoesNotExist",
                        "The specified key group does not exist.",
                        400);
            }
        }
    }

    private boolean publicKeyInUse(String id) {
        for (KeyGroup group : keyGroupStore.scan(k -> true)) {
            if (group.getItems() != null && group.getItems().contains(id)) {
                return true;
            }
        }
        return false;
    }

    private boolean keyGroupInUse(String id) {
        for (Distribution distribution : distStore.scan(k -> true)) {

View on GitHub (pinned to 62ff490619)

Solutions

1. Call ListKeyGroups and verify each referenced ID exists before submitting the distribution config
2. Recreate the missing key group and public keys, then use the new key group ID
3. Before deleting a key group, update all distributions that reference it

Example fix

// before
.trustedKeyGroups(TrustedKeyGroups.builder()
    .enabled(true)
    .items(List.of("STALE-GROUP-ID"))
    .build())

// after
Set<String> groupIds = cloudFrontClient.listKeyGroups().keyGroupList().items().stream()
    .map(KeyGroupSummary::id)
    .collect(Collectors.toSet());
String groupId = groupIds.stream().findFirst()
    .orElseThrow(() -> new IllegalStateException("create a key group first"));
.trustedKeyGroups(TrustedKeyGroups.builder()
    .enabled(true)
    .items(List.of(groupId))
    .build())

Set<String> groupIds = cloudFrontClient.listKeyGroups().keyGroupList().items().stream()
    .map(KeyGroupSummary::id)
    .collect(Collectors.toSet());
if (!groupIds.containsAll(referencedKeyGroupIds)) {
    throw new IllegalStateException("Distribution references a key group that does not exist: "
        + referencedKeyGroupIds.stream().filter(Predicate.not(groupIds::contains)).toList());
}

catch (CloudFrontException e) {
    if ("TrustedKeyGroupDoesNotExist".equals(e.awsErrorDetails().errorCode())) {
        // recreate key group + keys, rebuild distribution config, retry
    } else { throw e; }
}

When it happens

Trigger: CreateDistribution/UpdateDistribution referencing a key group ID that was deleted, created in another region/account context, or typo'd; or after an emulator restart wiped non-persistent storage.

Common situations: Key group deleted while still referenced by a distribution config; storage reset between runs; distribution templates shared across environments that hardcode key group IDs.

Related errors

• InconsistentQuantities
• InvalidIfMatchVersion
• DistributionNotDisabled
• InvalidIfMatchVersion
• InvalidArgument

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/5511e0679a6c32b0. Report an issue: GitHub.