serverless/serverless · error · ServerlessError

AWS_WAF_INVALID_ALB_ARN

AWS_WAF_INVALID_ALB_ARN

Error message

Invalid ALB ARN format

What it means

Returned by findClosestMatch (version.go:312) when semver.NewConstraint(constraint) fails to parse the user-supplied frameworkVersion as a valid semver range expression. The Masterminds/semver library rejects strings that do not conform to its constraint grammar.

Source

Thrown at packages/engine/src/lib/aws/alb.js:405

   * @param {Object} params - The parameters for associating a WAF ACL with an ALB.
   * @param {string} params.albArn - The ARN of the ALB.
   * @param {string} params.wafAclArn - The ARN of the WAF ACL.
   * @returns {Promise<void>}
   * @throws {ServerlessError} If the ALB ARN or WAF ACL ARN is invalid.
   */
  async associateWafToAlb({ albArn, wafAclArn }) {
    // Validate WAF ACL ARN format
    if (!wafAclArn.startsWith('arn:aws:wafv2:')) {
      throw new ServerlessError(
        'Invalid WAF ACL ARN format',
        'AWS_WAF_INVALID_ACL_ARN',
        { stack: false },
      )
    }

    // Validate ALB ARN format
    if (!albArn.startsWith('arn:aws:elasticloadbalancing:')) {
      throw new ServerlessError(
        'Invalid ALB ARN format',
        'AWS_WAF_INVALID_ALB_ARN',
        { stack: false },
      )
    }

    await this.wafClient.send(
      new AssociateWebACLCommand({
        ResourceArn: albArn,
        WebACLArn: wafAclArn,
      }),
    )
  }

  /**
   * Retrieves and updates a target group.
   * @param {string} targetGroupName - The name of the target group.
   * @param {{ path?: string, routingPath?: string }} healthcheck - The healthcheck configuration.

View on GitHub (pinned to b9d7ea51c8)

Solutions

1. Use standard semver constraint syntax: ^4.15.0, ~4.15.0, >=4.15.0, or an exact 4.15.0
2. Remove non-semver values like 'latest' — omit frameworkVersion entirely for latest
3. Validate the constraint with an online semver checker before committing

Example fix

# before
frameworkVersion: latest
# after
frameworkVersion: ^4.15.0

// Validate constraint syntax before calling getVersion
func validConstraint(c string) bool {
    _, err := semver.NewConstraint(c)
    return err == nil
}

When it happens

Trigger: getVersion calls findClosestMatch with a non-empty frameworkVersion string; semver.NewConstraint returns a parse error because the string is not a valid constraint (e.g. contains illegal characters, unbalanced operators, or bare non-semver text).

Common situations: frameworkVersion: latest (not a semver constraint); frameworkVersion: 4..15.0 (double dot); frameworkVersion: >>>=4 (garbled operator); frameworkVersion: v4.15.0 (the 'v' prefix may or may not be accepted depending on library version); accidentally quoting or escaping the value incorrectly in YAML.

Related errors

• Load balancer ARN does not exists
• Exceeded maximum rule priority limit
• Failed to create load balancer.
• AWS_ALB_FAILED_TO_CREATE_TARGET_GROUP
• ACM_CERTIFICATE_VALIDATION_TIMEOUT

AI-assisted analysis of serverless/serverless@b9d7ea51c8 (2026-08-13). Data as JSON: /api/errors/a5db85f0cf3369fb. Report an issue: GitHub.