AWS051 - AWS Rejected a Request Parameter

Agent error code #AWS051 indicates that AWS refused a value in the request. AWS returns InvalidParameterValue, InvalidParameter or MalformedInput in this situation.

The credentials and the security group were both accepted. Something in the rule the agent tried to write was not valid.

Common causes include:

• The port configured on the knoc is outside the range AWS accepts
• The protocol on the knoc does not match what the rule requires
• The address being granted is not a form AWS will accept in a security group rule
• An IPv6 address is being granted to a rule slot configured for IPv4, or the reverse

Steps to Resolve

Check the Port and Protocol

1. In the Knocknoc admin interface, open the backend configuration for the affected knoc
2. Confirm the port is within 1 to 65535
3. Confirm the protocol matches the service being protected

Check the Address Family

AWS security group rules keep IPv4 ranges (IpRanges) and IPv6 ranges (Ipv6Ranges) in separate fields. If users are reaching the service over IPv6 but the knoc is set up for IPv4 only, the grant fails here.

Confirm which family the failing grant used, and that the knoc is configured for it.

Check the Security Group Rule Quota

AWS limits the number of rules per security group. A group at its limit rejects further additions. In the AWS console, open the group and compare its inbound rule count against the account's quota.

Check the Agent Log

The full AWS response, including the exact parameter AWS named, is written to the agent log and never to this message. Inspect the log entry recorded with the failed grant.