Error responses

The error code is a string that uniquely identifies an error condition. It is meant to be read and understood by programs that detect and handle errors by type. For more information, see List of error codes.

Type: String

Ancestor: Error

Container for all error elements.

Type: Container

Ancestor: None

The error message contains a generic description of the error condition in English. It is intended for a human audience. Simple programs display the message directly to the end user if they encounter an error condition they don't know how or don't care to handle. Sophisticated programs with more exhaustive error handling and proper internationalization are more likely to ignore the error message.

Type: String

Ancestor: Error

ID of the request associated with the error.

Type: String

Ancestor: Error

The bucket or object that is involved in the error.

Type: String

Ancestor: Error

For Amazon S3 on Outposts, the bucket that you tried to create already exists in your Outpost and you own it.

409 Conflict (in all Regions except us-east-1)

This error might occur for the following reasons:

This error might occur for the following reasons:

This error might occur for the following reasons:

For encrypting, decrypting, re-encrypting, and generating data keys, the KeyUsage must be ENCRYPT_DECRYPT. For signing and verifying messages, the KeyUsage must be SIGN_VERIFY. For generating and verifying message authentication codes (MACs), the KeyUsage must be GENERATE_VERIFY_MAC. For deriving key agreement secrets, the KeyUsage must be KEY_AGREEMENT. To find the KeyUsage of a KMS key, use the DescribeKey operation.

The specified tag does not exist.

This error might occur for the following reasons:

This error might occur for the following reasons:

The AWS Region in the resource ARN doesn't match the Region that's specified in this request. The AWS account in the resource ARN doesn't match the account ID that's specified in this request. The AWS partition in the resourceArn is invalid.

This request contains a tag key or value that isn't valid. Valid characters include the following: [a-zA-Z+-=._:/]. Tag keys can contain up to 128 characters. Tag values can contain up to 256 characters. There are duplicate tag keys in your request. User-defined tag keys can't start with aws:.

The specified resource doesn't exist.

The number of tags exceeds the limit of 50 tags.

The bucket is in a transitional state because of a previous deletion attempt. Try again later.

This error might occur for the following reasons:

The request is not valid for the current state of the Outpost.

The access point is not in a state where it can be deleted.

The specified Outpost does not exist.

The specified action was not supported.

Insufficient capacity.

507 Insufficient Storage

This Region is not supported as a home Region for S3 Storage Lens.

This account not authorized to use AWS Organizations. Use your management account or delegated administrator account.

Activity metrics must be enabled.

This account is not part of your organization.

The Default configuration cannot be deleted.

There are two or more entries of the same Storage Lens group ARN in this configuration.

This error occurs for the following reasons:

You must specify a Storage Lens group with your Exclude element.

This error occurs for the following reasons:

There is a malformed AWS Organizations ARN in the configuration.

You must specify a Storage Lens group with your Include element.

Organization-level configurations do not support bucket filters.

The configuration ID is not valid.

The S3 bucket ARN is malformed.

Only one encryption method can be specified.

The default configuration must not include any filters.

You can specify either an Include container or an Exclude container in a configuration. You cannot specify both in a configuration.

Only one Include or Exclude element is allowed. At least one Include or Exclude element must be present.

The KMS key ID ARN is not valid.

MaxDepth must be within the range [1,10].

MinStorageBytesPercentage must be within the range [1.00,100.00].

The AWS Organizations ARN in the configuration is not valid.

The default configuration does not support organization-level metrics.

The specified Region is not supported for default configuration.

The Region name is not valid.

The S3 Storage Lens ARN is not required in input.

This Storage Lens group ARN isn't valid or only Storage Lens groups in your account are allowed. Additionally, you must follow the Storage Lens group ARN structure: arn::s3:::storage-lens-group/ and adhere to the 64 character limit. Storage Lens group names can also contain only the following characters: a-z, A-Z, 0-9, hyphens (-), and underscores (_).

Activity metrics must be enabled at the account level when activity metrics are enabled at the bucket level.

Activity metrics must be enabled at the bucket level when activity metrics are enabled at the account level.

The encryption method cannot be blank. Specify either SSE-KMS or SSE-S3.

Storage metrics at the prefix level are mandatory when the prefix level is enabled.

This account is not authorized to add AWS Organizations.

The specified Region does not support AWS Organizations in the configuration.

The S3 Storage Lens service-linked role is not enabled for the organization.

Prefix-level storage metrics must be enabled.

The buckets container cannot have more than 50 buckets.

The Regions container cannot have more than 50 Regions.

You can't attach more than 50 Storage Lens groups to your Storage Lens dashboard.

You don't have permission to perform Storage Lens group actions. This Region is not supported as home Region for S3 Storage Lens groups.

The specified configuration already exists.

Tags must be unique. The And logical operator includes duplicate tag keys. The Or logical operator includes duplicate tags. Logical operator includes duplicate prefixes or suffixes.

DaysLessThan and DaysGreaterThan must be positive numbers.

A filter must include one of the following elements: And, Or, MatchAnyTag, MatchAnyPrefix, MatchAnySuffix, MatchObjectAge, MatchObjectSize.

At least two sub elements must be present in the logical operators And or Or.

The MatchAnyPrefix parameter can’t be empty.

The MatchAnySuffix parameter can't be empty.

The MatchAnyTag parameter can't be empty.

The MatchObjectAge parameter can't be empty.

The MatchObjectSize parameter can't be empty.

Storage Lens group Name parameter must be between 1 and 64 characters. The Storage Lens group Name parameter must use the ^[a-zA-Z0-9\-_]+$ pattern.

This object age or object size combination isn't valid.

The maximum length of a prefix is 1,024 characters. The prefix string can't be empty.

BytesLessThan and BytesGreaterThan must be positive numbers. The maximum object size can't exceed 5 TB. The minimum object size can't be greater than or equal to 5 TB.

The maximum length of a suffix is 1,024 characters. The suffix string can't be empty.

The object tag key can’t exceed 128 characters. The object tag key string can't be null or empty. The maximum length of a tag value is 256 characters. The object tag key contains characters that aren't valid. The object tag key must contain only a-z, A-Z, 0-9, spaces, and the following characters: ^(_.:/=+\-@]*)$.

The name specified in the request doesn't match the Storage Lens group name.

You have attempted to create more Storage Lens group configurations than the 50 allowed.

The Element exceeds the maximum number of elements allowed within a logical operator. Only 10 prefixes, suffixes, or tags are allowed.

Returned to the original caller when WriteGetObjectResponse responds with ValidationError to AWS Lambda.

See the ValidationError message for more details. Not all cases of ValidationError result in a LambdaInvalidResponse error.

Lambda function invocation failed.

Callers might receive the following error when S3 Object Lambda is unable to successfully invoke the configured Lambda function.

The error message might contain details about an eventual error returned by the AWS Lambda service when invoking the function (for example, status code, error code, error message and request ID).

The AWS Lambda function was not found.

The configured Lambda function, version, or alias was not found when attempting to invoke it. Ensure that the S3 Object Lambda Access Point configuration points to the correct Lambda function ARN.

The error message might contain details about an eventual error returned by the AWS Lambda service when invoking the function (for example, status code, error code, error message and request ID).

The caller is not authorized to invoke the Lambda function.

The caller must have permission to invoke the Lambda function. Check the policies attached to the caller and ensure that they've been allowed to use lambda:Invoke for the configured function.

The error message might contain details about an eventual error returned by the AWS Lambda service when invoking the function (for example, status code, error code, error message and request ID).

The Lambda function exited without successfully calling WriteGetObjectResponse.

GetObject response data is provided by the Lambda function by calling the WriteGetObjectResponse API operation. The Amazon CloudWatch logs for the function might provide more insight into why the function did not successfully call this API operation despite exiting normally.

The Lambda function failed during execution.

An explicit error was received from the Lambda function. For details about the failure, check the AWS CloudFormation logs.

The Lambda function did not respond in the allowed time.

The Lambda function failed to complete its call to WriteGetObjectResponse within 60 seconds.

Reduce your request rate for operations involving AWS Lambda.

The function invocation was throttled by AWS Lambda, perhaps because it has reached its configured concurrency limitation. For more information, see Managing concurrency for a Lambda function in the AWS Lambda Developer Guide.

The error message might contain details about an eventual error returned by the AWS Lambda service when invoking the function (for example, status code, error code, error message and request ID).

Validation errors might be returned from the WriteGetObjectResponse API operation and can occur for numerous reasons. See the error message for more details.

Access denied.

An internal server error occurred.

The specified policy syntax is not valid.

You already have a Multi-Region Access Point with the same name.

The action failed because another request is modifying the specified resource. Try resubmitting your request after the previous request has been completed.

The specified Multi-Region Access Point is not ready to be updated.

The buckets used to create a Multi-Region Access Point cannot be in the same Region.

One of the buckets supplied to create the Multi-Region Access Point is in a Region that is not supported.

The specified bucket does not exist.

The specified Multi-Region Access Point does not exist.

The specified access grant already exists

Access Grants Instance already exists

Please clean up locations before deleting the access grants instance

Access Grants Instance does not exist

Access Grants Instance Resource Policy does not exist

The specified access grants location already exists

Please clean up access grants before deleting access grants location

The access grants location quota has been exceeded. Access Grants Locations Quota: <value>. Please reach out to S3 if an increase is required.

The access grants quota has been exceeded. Access Grants Quota: <value>. Please reach out to S3 if an increase is required.

There are duplicate tag keys in your request. Remove the duplicate tag keys and try again.

The specified Access Grant is invalid

The specified Access Grants Location is invalid

The specified IAM Role is invalid

The specified identity center instance is invalid

The specified Resource Policy is invalid

The specified Resource Policy is invalid

This request contains a tag key or value that isn't valid. Valid characters include the following: [a-zA-Z+-=._:/]. Tag keys can contain up to 128 characters. Tag values can contain up to 256 characters.

The specified access grant does not exist

The specified access grants location does not exist

An error occurred (StsNotAuthorizedError) when calling the GetDataAccess operation: User: access-grants.s3.amazonaws.com is not authorized to perform: sts:AssumeRole on resource: <IAM Role ARN>

An error occurred (StsPackedPolicyTooLargeError) when calling the GetDataAccess operation: Serialized token too large for session

The error message varies depending on the validation error.

Tag keys cannot start with AWS reserved prefix for system tags."

The number of tags exceeds the limit of 50 tags. Remove some tags and try again.