SAM Doctor

ERROR REFERENCE

An S3 lifecycle abort rule cannot use a tag filter

S3 rejected the bucket lifecycle configuration because the rule that aborts incomplete multipart uploads also tries to filter objects by tags. Those two conditions belong in separate lifecycle rules.

WHAT IT MEANS

What this error means

AbortIncompleteMultipartUpload cannot be specified with Tags.
(Service: S3, Status Code: 400, Error Code: InvalidRequest)

An incomplete multipart upload has not become an object yet, so it has no object tags for S3 to evaluate. The abort action can be scoped by key prefix, or left unfiltered, but it cannot share a rule with a tag-based filter.

FIX

How to fix it

  1. Inspect the current lifecycle configuration (read-only): 
    aws s3api get-bucket-lifecycle-configuration --bucket <bucket>
  2. Give the abort action its own rule. Remove the tag filter from the rule containing AbortIncompleteMultipartUpload. Use an object-key prefix if the cleanup should cover only one path.
  3. Keep tag-based actions separate. Put expiration or transition behavior that depends on object tags in another rule; that rule can retain its tag filter.
  4. Re-run the deployment after validating the generated AWS::S3::Bucket lifecycle configuration. A failed CloudFormation update may leave the prior lifecycle policy in place, so confirm which version is active before testing again.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes this S3 validation error (high confidence), keeps it separate from generic CloudFormation resource failures, and points at the exact lifecycle rule split. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED