floci-io/floci · error · AwsException

ValidationError

ValidationError

Error message

SecretTargetAttachment deletion requires the StackResource metadata that records its managed fields.

What it means

Error "SecretTargetAttachment deletion requires the StackResource metadata that records its managed fields." thrown in floci-io/floci.

Source

Thrown at src/main/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationResourceProvisioner.java:588

        }
        switch (resourceType) {
            case "AWS::S3::Bucket" -> s3Service.deleteBucket(physicalId);
            case "AWS::SNS::Topic" -> snsService.deleteTopic(physicalId, region);
            case "AWS::SNS::Subscription" -> snsService.unsubscribe(physicalId, region);
            case "AWS::DynamoDB::Table" -> deleteDynamoTableSafe(physicalId, region);
            case "AWS::Lambda::Function" -> deleteLambdaFunctionSafe(physicalId, region);
            // AWS::IAM::Policy is inline: it is removed together with its owning principal (see
            // IamRoleCfnProvisioner#delete), or precisely via the StackResource-aware delete path.
            // Nothing to do here when only the physical id (policy name) is known, as on rollback.
            case "AWS::IAM::Policy" -> { }
            case "AWS::IAM::ManagedPolicy" -> deletePolicySafe(physicalId);
            case "AWS::IAM::InstanceProfile" -> iamService.deleteInstanceProfile(physicalId);
            case "AWS::SSM::Parameter" -> ssmService.deleteParameter(physicalId, region);
            case "AWS::KMS::Key" -> {
            } // KMS keys can't be immediately deleted; skip
            case "AWS::KMS::Alias" -> kmsService.deleteAlias(physicalId, region);
            case "AWS::SecretsManager::Secret" -> deleteSecretSafe(physicalId, region);
            case "AWS::SecretsManager::SecretTargetAttachment" -> throw new AwsException(
                    "ValidationError",
                    "SecretTargetAttachment deletion requires the StackResource metadata that records its managed fields.",
                    400);
            // No bus context on the type/physicalId path (e.g. CREATE-rollback); targets the default bus.
            case "AWS::Events::Rule" -> deleteEventBridgeRuleSafe(physicalId, null, region);
            case "AWS::Events::EventBus" -> deleteEventBusSafe(physicalId, region);
            case "AWS::Events::EventBusPolicy" -> removeEventBusPolicySafe(physicalId, region);
            case "AWS::ApiGateway::RestApi" -> apiGatewayService.deleteRestApi(region, physicalId);
            case "AWS::ApiGatewayV2::Api" -> apiGatewayV2Service.deleteApi(region, physicalId);
            case "AWS::ECR::Repository" ->
                    ecrService.deleteRepository(physicalId, null, true, region);
            case "AWS::Pipes::Pipe" -> pipesService.deletePipe(physicalId, region);
            case "AWS::StepFunctions::StateMachine" -> stepFunctionsService.deleteStateMachine(physicalId);
            case "AWS::Lambda::EventSourceMapping" -> lambdaService.deleteEventSourceMapping(physicalId);
            case "AWS::Lambda::LayerVersion" -> deleteLambdaLayerVersion(physicalId, region);
            case "AWS::Cognito::UserPool" -> cognitoService.deleteUserPool(physicalId);
            case "AWS::Cognito::UserPoolClient" -> cognitoService.deleteUserPoolClient(physicalId);
            case "AWS::ECS::Cluster" -> deleteEcsClusterSafe(physicalId, region);

View on GitHub (pinned to 62ff490619)

Solutions

1. Recreate the stack so the SecretTargetAttachment resource stores the required StackResource metadata, or remove the resource and let it be recreated.

When it happens

Trigger: Thrown at src/main/java/io/github/hectorvent/floci/services/cloudformation/CloudFormationResourceProvisioner.java:588 when the library encounters an invalid state.

Common situations: Occurs when deleting a CloudFormation-managed SecretsManager SecretTargetAttachment without the recorded StackResource metadata. Do not remove the stack metadata; delete via the stack.

Understand the failure class

Background: ValidationError explained: why open-source libraries reject your input — file uploads, YAML manifests, unique fields, and query permissions — this error's family across 13 libraries.

AI-assisted analysis of floci-io/floci@62ff490619 (2026-08-14). Data as JSON: /api/errors/02d528dda96cbf91. Report an issue: GitHub.