floci-io/floci · error · AwsException

UnknownService

UnknownService

Error message

Unsupported AWS service integration: " + service

What it means

Thrown by API Gateway's AWS service integration router when an integration's URI names an AWS service that Floci does not route. invokeJson() switch-cases exactly these service names: dynamodb, sqs, sns, events, ssm, kinesis, logs, monitoring, secretsmanager, kms, cognito-idp, acm. Any other service token in the integration URI (e.g. 'lambda' via direct invoke, 's3', 'stepfunctions', or a typo like 'sqs2') falls to the default arm and yields UnknownService with HTTP 400.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/apigateway/AwsServiceRouter.java:169

    public Response invoke(String service, String action, JsonNode requestBody, String region) {
        LOG.debugv("AWS integration dispatch: {0}:{1} in {2}", service, action, region);

        try {
            return switch (service) {
                case "states" -> stepFunctionsHandler.handle(action, requestBody, region);
                case "dynamodb" -> dynamoDbHandler.handle(action, requestBody, region);
                case "sqs" -> sqsHandler.handle(action, requestBody, region);
                case "sns" -> snsHandler.handle(action, requestBody, region);
                case "events" -> eventBridgeHandler.handle(action, requestBody, region);
                case "ssm" -> ssmHandler.handle(action, requestBody, region);
                case "kinesis" -> kinesisHandler.handle(action, requestBody, region);
                case "logs" -> logsHandler.handle(action, requestBody, region);
                case "monitoring" -> metricsHandler.handle(action, requestBody, region);
                case "secretsmanager" -> secretsManagerHandler.handle(action, requestBody, region);
                case "kms" -> kmsHandler.handle(action, requestBody, region);
                case "cognito-idp" -> cognitoHandler.handle(action, requestBody, region);
                case "acm" -> acmHandler.handle(action, requestBody, region);
                default -> throw new AwsException("UnknownService",
                        "Unsupported AWS service integration: " + service, 400);
            };
        } catch (AwsException e) {
            throw e;
        } catch (Exception e) {
            throw new AwsException("InternalError",
                    e.getMessage() != null ? e.getMessage() : "Service invocation failed", 500);
        }
    }

    /**
     * Dispatches an AWS query-protocol (form-encoded) integration request.
     *
     * <p>Used for {@code path/}-style integration URIs whose VTL request template renders an
     * {@code application/x-www-form-urlencoded} body in the AWS query protocol, e.g.
     * {@code Action=SendMessage&QueueUrl=...&MessageBody=...}. The {@code Action} parameter
     * selects the operation, mirroring {@link io.github.hectorvent.floci.core.common.AwsQueryController}.
     *

View on GitHub (pinned to 62ff490619)

Solutions

1. Check the integration's integrationUri/integration credentials URI and confirm the service token is one of: dynamodb, sqs, sns, events, ssm, kinesis, logs, monitoring, secretsmanager, kms, cognito-idp, acm.
2. For Lambda backends use integration type AWS_PROXY (Lambda proxy) instead of the generic service-router path — the router only covers direct service actions.
3. Fix typos in the service segment (e.g. 'sqs' not 'sqs2', 'events' not 'eventbridge').
4. If you need an unrouted service, switch the integration to HTTP_PROXY/HTTP pointing at that service's Floci endpoint, or raise a feature request for the service in Floci's router.

Example fix

// before
integration: { type: "AWS", uri: "arn:aws:apigateway:us-east-1:account:s3:path/bucket/key", ... }

// after
integration: { type: "AWS", uri: "arn:aws:apigateway:us-east-1:account:sqs:path/123456789012/MyQueue", ... }

// Java: whitelist the service before building the integration
Set<String> ROUTED = Set.of("dynamodb", "sqs", "sns", "events", "ssm", "kinesis",
    "logs", "monitoring", "secretsmanager", "kms", "cognito-idp", "acm");
String svc = uriServiceSegment(integrationUri); // lowercased, trimmed
if (!ROUTED.contains(svc)) {
    throw new UnsupportedOperationException(
        "Floci does not route AWS integration for service: " + svc
        + "; use AWS_PROXY for lambda or HTTP_PROXY for others");
}

catch (AwsException e) {
    if ("UnknownService".equals(e.getCode())) {
        // deterministic config error — fix the integration URI; retrying cannot help
        throw new InvalidIntegrationException(e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: A RestApi method with integration type AWS whose URI is arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/... style but naming an unrouted service, or arn:aws:apigateway:<region>:<acct>:s3:path/..., or invoking the integration at runtime (or via test-invoke) with such a URI. Also triggered by typos in the service segment extracted from the integration URI.

Common situations: Porting APIs that integrate Step Functions, S3, or direct Lambda invokes through the generic AWS integration path — none are in the router's case list. Expecting LocalStack-level breadth from Floci's integration router. A service name that works in one Floci version but was never added, so the deploy succeeds and only the request fails.

Related errors

• InternalError
• BadRequestException
• BadRequestException
• MissingAction
• ValidationException

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/0a94f8004c974f87. Report an issue: GitHub.