microsoft/aspire · error · ArgumentException

AWS account ID ' ' must be exactly 12 digits.

Error message

AWS account ID '{value}' must be exactly 12 digits.

What it means

CloudProviderValidation.ValidateAwsAccountId enforces that an AWS account ID is exactly 12 digits (matched by AwsAccountIdPattern). Null/empty values are rejected first, then values failing the regex throw ArgumentException("AWS account ID '{value}' must be exactly 12 digits.").

Solutions

1. Provide the 12-digit numeric account ID, e.g. '123456789012'.
2. Retrieve it with 'aws sts get-caller-identity --query Account --output text'.
3. Strip formatting like '1234-5678-9012' or spaces before passing the value.
4. Confirm you are not accidentally using an access key or ARN in the account-ID field.

Example fix

// before
ValidateAwsAccountId("AKIAIOSFODNN7EXAMPLE", nameof(accountId));

// after
ValidateAwsAccountId("123456789012", nameof(accountId));

if (string.IsNullOrEmpty(accountId) || !System.Text.RegularExpressions.Regex.IsMatch(accountId, @"^\d{12}$"))
{
    throw new ArgumentException($"AWS account ID '{accountId}' must be exactly 12 digits.", nameof(accountId));
}

try
{
    providerBuilder.WithAwsAccountId(accountId);
}
catch (ArgumentException ex) when (ex.Message.Contains("12 digits"))
{
    logger.LogError("'{Value}' is not a valid AWS account ID", accountId);
    throw;
}

When it happens

Trigger: Configuring a Radius AWS cloud provider with an account ID string that is not exactly 12 numeric characters (too short, too long, containing letters, dashes, or spaces).

Common situations: Confusing account ID with access key ID (20 chars, starts with AKIA), ARN, or role name; pasting an ID with hyphens or whitespace; using a masked/truncated ID from logs.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• IAM role ARN ' ' is not in the expected form 'arn:aws:iam:…
• Unknown AWS credential type
• Value ' ' is not a valid GUID.
• A recipe parameter on Radius environment
• ASPIRERADIUS011

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/fa2018cbb2861b59. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/CloudProviders/CloudProviderValidation.cs:33

{
    internal static void ValidateGuid(string value, string paramName)
    {
        ArgumentException.ThrowIfNullOrEmpty(value, paramName);
        if (!Guid.TryParse(value, out _))
        {
            throw new ArgumentException($"Value '{value}' is not a valid GUID.", paramName);
        }
    }

    internal static void ValidateNonEmpty(string value, string paramName)
        => ArgumentException.ThrowIfNullOrEmpty(value, paramName);

    internal static void ValidateAwsAccountId(string value, string paramName)
    {
        ArgumentException.ThrowIfNullOrEmpty(value, paramName);
        if (!AwsAccountIdPattern().IsMatch(value))
        {
            throw new ArgumentException(
                $"AWS account ID '{value}' must be exactly 12 digits.", paramName);
        }
    }

    internal static void ValidateIamRoleArn(string value, string paramName)
    {
        ArgumentException.ThrowIfNullOrEmpty(value, paramName);
        if (!IamRoleArnPattern().IsMatch(value))
        {
            throw new ArgumentException(
                $"IAM role ARN '{value}' is not in the expected form 'arn:aws:iam::<account>:role/<name>' (an optional path segment is allowed, e.g. 'arn:aws:iam::<account>:role/<path>/<name>').",
                paramName);
        }
    }

    [GeneratedRegex(@"^\d{12}$")]
    private static partial Regex AwsAccountIdPattern();

View on GitHub (pinned to 25830f84bd)