A tag key or value was rejected by validation

WHAT IT MEANS

What this error means

The API validated the submitted tags and refused one of them:

1 validation error detected: Value 'aws:team' at 'tags.1.member.key'
failed to satisfy constraint: Member must satisfy regular expression pattern

The useful part is the path, tags.1.member.key. The index tells you which tag in the set failed and whether the problem is the key or the value, which is usually faster than re-reading the whole template. Two causes account for nearly all of these:

• The reserved aws: prefix. Keys beginning aws: are reserved for AWS-generated tags. They cannot be set, changed, or deleted by a deployment, and the rejection is unconditional — no permission grants the ability to write one.
• A character or length violation. Tag keys and values have a maximum length and an allowed character set; values assembled from build metadata, branch names, or commit subjects are the usual way an illegal character arrives.

Because validation happens before any resource work, nothing was partially created — re-running after the fix is safe.

FIX

How to fix it

1. Read the index in the error — tags.N.member.key or .value — and find that tag in the template's Tags block, the Globals section, or the tag list in samconfig.toml. Remember tags can be inherited from more than one of those places.
2. Rename any key using the reserved aws: prefix. If the intent was to mirror an AWS-generated tag, use a distinct prefix of your own instead.
3. Check the key and value against the tag restrictions — length limits and the allowed character set. Where a value is interpolated from build metadata, constrain or sanitize it rather than passing a branch name or commit subject through unchanged.
4. Re-run the deployment. Validation runs before any resource is created, so no cleanup or stack repair is needed first.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognises a rejected tag key or value and points at the index in the error (medium confidence), separating it from the permission failure it superficially resembles. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• Access denied on a tagging action — the same tag set refused for permissions rather than contents.
• Property is not defined for resource type — another template-shape failure caught before deployment.
• Template failed SAM or CloudFormation schema validation — the broader validation family this belongs to.