| ThrottlingException |
AWS: ThrottlingException / Rate exceeded |
You exceeded the request rate for an AWS API; retry with exponential backoff. |
| Runtime.ImportModuleError |
Runtime.ImportModuleError: Unable to import module 'lambda_function': No module named 'x' |
Lambda couldn’t load your handler file or one of its dependencies — the package is missing from the deploymen… |
| UnrecognizedClientException |
UnrecognizedClientException: The security token included in the request is invalid |
The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary c… |
| Task timed out |
AWS Lambda: Task timed out after X seconds |
The function ran longer than its configured timeout (default 3 seconds) and Lambda stopped it. |
| NoSuchKey |
AWS S3: NoSuchKey / NoSuchBucket — The specified key/bucket does not exist |
S3 found no object at that key (or no bucket with that name in the region/account you’re calling). |
| The request could not be satisfied |
CloudFront: 403 ERROR — The request could not be satisfied |
CloudFront refused or couldn’t serve the request — wrong alternate domain/certificate, blocked by origin acce… |
| Endpoint request timed out |
API Gateway: {"message": "Endpoint request timed out"} (504 after 29 seconds) |
The backend (usually Lambda) didn’t respond within API Gateway’s integration timeout (29 seconds by default f… |
| SignatureDoesNotMatch |
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match |
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used diff… |
| PermanentRedirect |
S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint |
The request went to the wrong S3 region/endpoint for that bucket. |
| No updates are to be performed |
CloudFormation: No updates are to be performed |
You ran an update/deploy with a template and parameters identical to what’s deployed, so there’s nothing to c… |
| RequestEntityTooLargeException |
Lambda: Request must be smaller than 6291456 bytes for the InvokeFunction operation (RequestEntityTooLargeException) |
The event payload (or response) is over Lambda’s 6 MB synchronous limit (256 KB for async invocations). |
| MessageRejected |
SES MessageRejected: Email address is not verified. The following identities failed the check in region |
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandb… |
| SlowDown |
S3 SlowDown: Please reduce your request rate (503) |
S3 is throttling requests to a prefix because the request rate is above what it can currently serve. |
| Pending validation |
ACM certificate stuck in Pending validation |
ACM is waiting to see the DNS (or email) validation record — it wasn’t created, was created in the wrong DNS… |
| Malformed Lambda proxy response |
API Gateway {"message": "Internal server error"} 502 — Malformed Lambda proxy response |
The Lambda behind an API Gateway proxy integration returned something that isn’t the required {statusCode, he… |
| not authorized to access this resource |
API Gateway 403: User is not authorized to access this resource with an explicit deny |
An API Gateway authorizer (Lambda/Cognito) or resource policy denied the request. |
| AccessDenied |
AWS S3: AccessDenied (403) when calling GetObject / PutObject |
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 requ… |
| NoCredentialsError |
AWS: Unable to locate credentials / Could not load credentials from any providers |
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instanc… |
| ECR token expired |
denied: Your authorization token has expired. Reauthenticate and try again. (Amazon ECR) |
Docker’s login to Amazon ECR has expired — ECR tokens last 12 hours, so pushes and pulls fail until you log i… |
| Instance reachability check failed |
EC2 status check failed: Instance reachability check failed (1/2 checks passed) |
AWS can reach the host, but the operating system inside the instance isn’t responding — kernel panic, full di… |
| Environment health has transitioned to Severe |
Elastic Beanstalk: Environment health has transitioned from Ok to Severe |
Most instances in the Elastic Beanstalk environment are failing health checks or returning errors. |
| ProvisionedThroughputExceededException |
ProvisionedThroughputExceededException: The level of configured provisioned throughput for the table was exceeded |
Requests exceed the table’s (or index’s) provisioned read/write capacity, or one partition is hot. |
| Health checks failed |
ALB target unhealthy: Health checks failed with these codes: [404] / Request timed out |
The load balancer’s health checks to your targets fail, so it stops sending traffic (and returns 502/503 if n… |
| UnauthorizedOperation |
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ... |
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which actio… |
| role cannot be assumed by Lambda |
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda |
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM h… |
| Unzipped size must be smaller than 262144000 bytes |
Lambda: Unzipped size must be smaller than 262144000 bytes |
The function code plus layers exceed Lambda’s 250 MB unzipped limit for zip deployments. |
| EntityTooLarge |
S3 EntityTooLarge: Your proposed upload exceeds the maximum allowed size |
A single PUT can be at most 5 GB (and presigned POST policies can set lower limits); larger files must use mu… |
| AWS.SimpleQueueService.NonExistentQueue |
SQS: The specified queue does not exist (AWS.SimpleQueueService.NonExistentQueue / QueueDoesNotExist) |
The queue URL/name doesn’t exist in that region/account, or it was deleted (recently deleted names are blocke… |
| You must specify a region |
You must specify a region. You can also configure your region by running "aws configure" (NoRegionError) |
No region is configured for the CLI/SDK call. |
| AccessControlListNotSupported |
AccessControlListNotSupported: The bucket does not allow ACLs |
The upload sets an ACL (like public-read), but the bucket uses “Bucket owner enforced” Object Ownership, whic… |
| aws: error: argument |
aws: error: argument command: Invalid choice / Unknown options |
The AWS CLI doesn’t recognise the command or option — usually CLI v1 vs v2 differences, an old CLI version, o… |
| ExpiredToken |
AWS: ExpiredToken — The security token included in the request is expired |
Temporary AWS credentials (STS/SSO/assumed role) have expired. |
| BucketAlreadyExists |
BucketAlreadyExists: The requested bucket name is not available |
S3 bucket names are global across all AWS accounts, and someone else already uses this one. |
| UPDATE_ROLLBACK_FAILED |
CloudFormation stack in UPDATE_ROLLBACK_FAILED |
An update failed, and then the rollback also failed, leaving the stack stuck until you continue the rollback. |
| ConditionalCheckFailedException |
ConditionalCheckFailedException: The conditional request failed |
A write’s ConditionExpression evaluated to false, so DynamoDB didn’t perform it — often exactly as designed. |
| CannotPullContainerError |
ECS task stopped: CannotPullContainerError: pull image manifest has been retried ... / ref pull has been retried |
The ECS task couldn’t pull its image — no network route to the registry, missing ECR permissions, or a wrong… |
| InsufficientInstanceCapacity |
InsufficientInstanceCapacity: We currently do not have sufficient capacity in the Availability Zone you requested |
AWS has no free capacity for that instance type in that Availability Zone right now. |
| InvalidAMIID.NotFound |
InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist |
The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared. |
| sts:AssumeRole denied |
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/... |
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust po… |
| KMS AccessDenied kms:Decrypt |
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access) |
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decr… |
| ROLLBACK_COMPLETE |
Stack is in ROLLBACK_COMPLETE state and can not be updated |
The stack’s first creation failed and rolled back; a stack in ROLLBACK_COMPLETE can only be deleted, not upda… |
| IAM AccessDeniedException |
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ... |
The IAM user or role making the call has no permission for that action on that resource — the message names b… |
| already exists in stack |
CloudFormation: Resource ... already exists (AlreadyExists / already exists in stack) |
The template tries to create a resource with a fixed name that already exists — created manually, by another… |
| ResourceNotFoundException (DynamoDB) |
DynamoDB ResourceNotFoundException: Requested resource not found (table) |
The table (or index) doesn’t exist in the region/account the client is using. |
| ValidationException: Missing the key |
DynamoDB ValidationException: One or more parameter values were invalid: Missing the key pk in the item / The provided key element does not match the schema |
The item or key doesn’t match the table’s primary key schema — wrong attribute name, wrong type, or missing s… |
| ResourceInitializationError |
ECS: ResourceInitializationError: unable to pull secrets or registry auth |
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting conta… |
| InvalidKeyPair.NotFound |
InvalidKeyPair.NotFound: The key pair 'x' does not exist |
The key pair name you passed doesn’t exist in that region (key pairs are regional). |
| VcpuLimitExceeded |
VcpuLimitExceeded: You have requested more vCPU capacity than your current vCPU limit |
Your account’s On-Demand (or Spot) vCPU quota for that instance family and region is used up. |
| Runtime exited with error: signal: killed |
Lambda: Runtime exited with error: signal: killed (Runtime.ExitError) |
The function process was killed — almost always because it ran out of its configured memory. |
| Runtime.HandlerNotFound |
Runtime.HandlerNotFound: index.handler is undefined or not exported |
Lambda loaded the file but couldn’t find the function named in the handler setting. |
| Essential container in task exited |
ECS: Essential container in task exited (task keeps stopping) |
The main (essential) container stopped, so ECS stopped the whole task and the service keeps replacing it. |