Description
- Encountered an issue where if you have multiple Certificate Authorities in your AWS account and some are already in the
DELETED state, then it means that no other Certificate Authorities are cleaned up as the ListTags operation will return an error since you can't list tags on Certificate Authorities in a deleted state.
- Since we return early in the code with if any error is returned it means that it won't attempt to clean any other resources that need to be deleted.
time="2025-12-18T00:16:50Z" level=error msg="Listing ACMPCACertificateAuthority failed:\n InvalidStateException: The certificate authority is in the DELETED state and must be restored to complete this action."
...
time="2025-12-18T00:16:51Z" level=error msg="Listing ACMPCACertificateAuthorityState failed:\n InvalidStateException: The certificate authority is in the DELETED state and must be restored to complete this action."
Potential Solution
- If we encounter an
InvalidStateException we can still consider the resource to be cleaned up instead of returning and if it is already in the DELETED state, then it will be filtered out by it's Filter implementation.
Description
DELETEDstate, then it means that no other Certificate Authorities are cleaned up as theListTagsoperation will return an error since you can't list tags on Certificate Authorities in a deleted state.Potential Solution
InvalidStateExceptionwe can still consider the resource to be cleaned up instead of returning and if it is already in theDELETEDstate, then it will be filtered out by it'sFilterimplementation.