ackee
Open deployment manager
Docs/Ackee Script

Error reference

Every AK code: what it means and how to fix it.

Every problem Ackee reports — while reading your file, checking it, or deploying it — carries a code. The code leads the message, then where in the file, then what is wrong:

reading an error
AK211 line 9:1: service "web" needs an image
AK504: database "main": the encryption key for this resource is not accessible

Codes are permanent: once published, a code keeps its meaning, so a search for one finds the same answer later. Errors raised while deploying name the declaration they were building, as it is written in your file.

Reading the file AK1xx

The file is not valid Ackee Script syntax. Nothing was checked beyond the line named.

AK101The file does not start with ackee 1

Every script opens with the language version it is written in, so a reader can refuse a file from a later version before misreading it.

Fix: Make ackee 1 the very first line of the file, before any comment.

a script that raises AK101
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}

AK102This version of Ackee Script is not supported

The file declares a language version this compiler does not read. Version 1 is the current version.

Fix: Change the first line to ackee 1, or deploy with an Ackee release that reads the version the file was written for.

a script that raises AK102
ackee 2

AK103A character that has no meaning here

The reader met a character that cannot start a name, a value or a symbol. A common cause is a value that should be quoted, or a stray symbol pasted from another language.

Fix: Quote text values (region = "us-east-1") and remove the character the message names.

a script that raises AK103
ackee 1
project "shop" {
  region = @east
}

AK104A number that cannot be read

Something that starts like a number is not one, such as 1.2.3 or 5-.

Fix: Write a plain number such as 3, 0.5 or 1e3. Version strings and ranges are text and need quotes.

a script that raises AK104
ackee 1
project "shop" {
  region = 1.2.3
}

AK105A string is not closed

A quoted string runs to the end of the line or the file without a closing quote, or contains an escape that does not exist.

Fix: Close the string on the same line. Write a literal quote as \" and a backslash as \\.

a script that raises AK105
ackee 1
project "shop {
}

AK106Expected a declaration

At the top level of a file every statement is a declaration that starts with a keyword: project, a portable declaration such as service or bucket, node, or connect.

Fix: Start the line with a declaration keyword, or move the line inside the block it belongs to.

a script that raises AK106
ackee 1
"shop" {}

AK107A reserved word used as a declaration

when, if, on, every and run are reserved for a later version of the language, so files written today keep working when they arrive.

Fix: Use another keyword. These words cannot start a declaration in version 1.

a script that raises AK107
ackee 1
on "push" {}

AK108A declaration's header is malformed

A declaration is a keyword, its quoted name, an optional type "...", and then {. Something else came before the opening brace.

Fix: Write it as node "api" type "aws/ecs-service@1" { ... } — quotes around the name and the type, and the { on the same line.

a script that raises AK108
ackee 1
node "api" type aws {
}

AK109A block or list is never closed

The file ends before a { or [ is matched by its closing } or ].

Fix: Add the missing closing brace or bracket. The line in the message is where the reader gave up, which is usually the end of the file; the opening is above it.

a script that raises AK109
ackee 1
project "shop" {
  cloud = "aws"

AK110A field is malformed

Inside a block every line is name = value. The reader found something that is not a name, or a name not followed by =.

Fix: Write the field as name = value. Names are bare words; quote a name only when it contains characters a bare word cannot.

a script that raises AK110
ackee 1
project "shop" {
  cloud "aws"
}

AK111Not a value

Values are quoted strings, numbers, true, false, lists [...], maps {...}, and references var.NAME and secret.NAME. A bare word is none of these.

Fix: Quote text: region = "us-east-1", not region = us-east-1.

a script that raises AK111
ackee 1
project "shop" {
  cloud = aws
}

AK112A reference is malformed

A reference to an environment value is written var.NAME or secret.NAME.

Fix: Follow var or secret with a dot and the value's name.

a script that raises AK112
ackee 1
project "shop" {
  region = var
}

AK113A connection is malformed

A connection is written connect <kind> "from" -> "to", optionally followed by id "...". Something in that shape is missing.

Fix: Name the kind (network, env, iam or traffic), quote both ends, and put -> between them.

a script that raises AK113
ackee 1
connect env "web" "db"

AK114Expected the end of the line

A statement that must stand alone on its line has more after it. Separate statements with a line break or ;.

Fix: Move what follows onto its own line.

a script that raises AK114
ackee 1 project "shop" {}

AK115A field is set twice

The same field appears twice in one block or map. Ackee Script does not let a later line silently override an earlier one.

Fix: Keep one of the two lines.

a script that raises AK115
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "a" type "aws/secret@1" {
  name = "one"
  name = "two"
}

Declarations AK2xx

The syntax is fine, but a declaration is missing, repeated, or shaped wrongly.

AK201There is no project block

Every script has exactly one project block, which says which cloud and region everything else is built in.

Fix: Add project "name" { cloud = "aws" region = "us-east-1" env = "dev" }.

a script that raises AK201
ackee 1

AK202More than one project block

A script describes one environment of one project, so it has one project block.

Fix: Merge the two blocks, or move the second environment into its own file.

a script that raises AK202
ackee 1
project "a" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
project "b" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}

AK203The project has no name

The project's name prefixes every cloud resource Ackee creates, so it is required.

Fix: Write project "shop" { ... }.

a script that raises AK203
ackee 1
project {
  cloud = "aws"
}

AK204A field this declaration does not have

The field is not one this declaration understands. Portable declarations such as service have a deliberately small set of fields that mean the same thing on every cloud.

Fix: Check the field list for the declaration in the language reference. For a provider-specific setting, declare the resource with node and its full type instead.

a script that raises AK204
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
  zone = "a"
}

AK205A declaration this version does not understand

The keyword is not a declaration in Ackee Script version 1.

Fix: Use one of the declarations the language reference lists, or node with a type for anything else.

a script that raises AK205
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
widget "x" {}

AK206A node needs a name and a type

node declares one resource from the catalogue exactly, so it needs both the name it is known by and the catalogue type it is.

Fix: Write node "api" type "aws/ecs-service@1" { ... }.

a script that raises AK206
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "api" {}

AK207A name is declared twice

Names identify resources for their whole life — renaming one replaces it in the cloud — so two declarations cannot share a name.

Fix: Rename one of them. If the second was meant to change the first, edit the first instead.

a script that raises AK207
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "a" type "aws/secret@1" {
  name = "a"
}
node "a" type "aws/secret@1" {
  name = "b"
}

AK208A connection names something that is not declared

Both ends of a connect must be declared somewhere in the file.

Fix: Check the spelling of both names, or declare the missing one.

a script that raises AK208
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
connect env "web" -> "db"

AK209Something is already called net

Portable declarations that run in a network — service, database, worker, job, cache, and on Azure the rest — share one that Ackee adds for them, called net. The file already declares something with that name.

Fix: Rename your declaration, or declare every resource with node, including the network, and connect them yourself.

a script that raises AK209
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "net" type "aws/secret@1" {
  name = "net"
}
database "main" {}

AK210A portable declaration's header is malformed

Portable declarations such as service and database take exactly one name and no type: the cloud in the project block decides what they become.

Fix: Give it one quoted name and remove any type "...". To pick the exact resource type yourself, use node instead.

a script that raises AK210
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
service "web" type "aws/ecs-service@1" {
  image = "nginx"
}

AK211A required field is missing

The declaration cannot be built without this field.

Fix: Add the field the message names.

a script that raises AK211
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
service "web" {}

AK212Not available on this cloud

The declaration is portable in general but has no equivalent on the cloud this project targets — a secret on Azure, a site on Google Cloud.

Fix: Follow the message: it names the declarations that do the same job on this cloud.

a script that raises AK212
ackee 1
project "shop" {
  env = "dev"
  cloud = "azure"
  region = "eastus"
}
secret "stripe" {}

AK213An unknown cloud

cloud in the project block is aws, gcp or azure.

Fix: Set cloud to one of the three.

a script that raises AK213
ackee 1
project "shop" {
  env = "dev"
  cloud = "mars"
  region = "us-east-1"
}
service "web" {
  image = "nginx"
}

AK214The file targets a different cloud than this environment

An environment is created for one cloud and stays on it: the resources it already owns live there. The script's cloud names another.

Fix: Set cloud to the environment's cloud. To move to another cloud, create a new project for it and deploy the script there.

what it looks like
AK214: project "shop": the script targets Google Cloud, but this environment was created for AWS

AK215Connections form a cycle

Every connection means one end is built into the other, so a loop of connections has no end that can be built first.

Fix: Remove one connection in the loop the message lists. Two services that call each other connect to a shared resource instead of to each other.

a script that raises AK215
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "a" type "aws/ecs-service@1" {
  name = "a"
  image = "nginx"
}
node "b" type "aws/ecs-service@1" {
  name = "b"
  image = "nginx"
}
connect env "a" -> "b"
connect env "b" -> "a"

AK216The same connection is written twice

Two connect lines have the same kind and the same two ends. A second one would, for example, inject every variable twice.

Fix: Delete one of the two lines.

a script that raises AK216
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
service "web" {
  image = "nginx"
}
database "main" {}
connect env "web" -> "main"
connect env "web" -> "main"

AK217A required connection is missing

The declaration cannot be built on its own: it needs something only a connection provides — most often a network to run in.

Fix: Add the connection the message names, such as connect network "net" -> "jobs". Portable declarations are connected to the shared network for you; node declarations are connected by hand.

a script that raises AK217
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
node "jobs" type "aws/worker@1" {
  name = "jobs"
  image = "public.ecr.aws/docker/library/alpine:3.21"
}

AK218A build names a source that is not declared

A declaration's build says which source its code comes from, and no source block has that name.

Fix: Declare the source — source "app" { repository = "acme/storefront" } — or correct the name in build.

a script that raises AK218
ackee 1
project "shop" {
  env = "dev"
  cloud = "gcp"
  region = "us-east1"
  gcpProject = "acme"
}
service "web" {
  image = "nginx"
  build = { source = "app", image = "us-docker.pkg.dev/acme/apps/web:{sha}" }
}

AK219This declaration cannot be built from source

Only declarations that run code — a service, a worker, a job, or a node of a compute type — have an image that a push can replace.

Fix: Move build to the service, worker or job that runs the code.

a script that raises AK219
ackee 1
project "shop" {
  env = "dev"
  cloud = "gcp"
  region = "us-east1"
  gcpProject = "acme"
}
source "app" {
  repository = "acme/storefront"
}
database "main" {
  build = { source = "app", image = "x:{sha}" }
}

Values and references AK3xx

A field has a value of the wrong kind, outside its allowed set, or that the environment does not provide.

AK301A value of the wrong type

The field expects a different kind of value — text where a number was given, or a map where a string was given.

Fix: Use the type the message names. Text is quoted, numbers are not, and true/false are bare.

a script that raises AK301
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
service "web" {
  image = "nginx"
  port = "80"
}

AK302A value outside the allowed set

The field takes one of a fixed set of values, such as small, medium or large for size.

Fix: Use one of the values the message lists.

a script that raises AK302
ackee 1
project "shop" {
  env = "dev"
  cloud = "aws"
  region = "us-east-1"
}
database "main" {
  size = "huge"
}

AK303An unknown kind of reference

References are var.NAME for a setting and secret.NAME for a secret.

Fix: Use var. or secret..

AK304A referenced value is not set in this environment

The script refers to var.NAME, and the environment being deployed has no value by that name. Values live in the environment, not in the file, so the same script can deploy to dev and prod with different settings.

Fix: Set the value on the Values screen for this environment, then deploy again. Nothing was built.

what it looks like
AK304: this graph refers to value DATABASE_URL, which the prod environment does not set

AK305Secret references cannot be deployed yet

secret.NAME parses, but resolving it needs a secret created in your cloud outside the deployment, and that step does not exist yet.

Fix: Use a secret resource and connect it to the service with connect env, or keep the value in a var until secret references ship.

Checking the infrastructure AK4xx

The file is well formed, but what it declares cannot be built as written.

AK401A resource's configuration is invalid

The declaration parsed, but the resource it describes rejected a field: a required setting is missing, or a value is out of range for that resource.

Fix: The message names the declaration and the field. The resource's page in the reference lists every field and its allowed values.

what it looks like
AK401 line 12:1: node "api": port must be between 1 and 65535

AK402An unknown resource type

The type of a node is not in the catalogue, or is from another cloud than the project's.

Fix: Check the type against the resource reference for your cloud. Types carry a version, as in aws/vpc@1.

what it looks like
AK402 line 7:1: node "q": unknown type "aws/kafka@1"

AK403These two cannot be connected this way

A connection's kind must be one both ends accept: a database takes env from a service, a network takes network to what runs in it.

Fix: Use the kind the message suggests, or connect a different pair.

what it looks like
AK403 line 20:1: connect env "db" -> "web": a database cannot inject into a service; connect env "web" -> "db"

AK404This cannot be written as Ackee Script

Something drawn on the canvas has no Ackee Script spelling yet. It deploys as drawn; only the file view is affected.

Fix: Report it from the editor. Nothing about your deployment needs to change.

What the cloud said AK5xx

Reported during a deploy, when your cloud refused or could not complete a change. The message names the declaration it was building and quotes the cloud's own reason.

AK501Your cloud credentials are missing a permission

The cloud refused an action because the credentials connected to this environment are not allowed to perform it. Ackee asks for the least it needs, so a new kind of resource can need a permission the old grant did not include.

Fix: Open Cloud credentials, copy the current policy (it is generated for what this environment declares), and replace the one attached to your credentials. Then plan again.

what it looks like
AK501: service "web": your credentials are not allowed to perform ecs:CreateService

AK502Your cloud credentials were rejected

The cloud did not accept the credentials connected to this environment: the key was mistyped, deleted, deactivated or has expired.

Fix: Create a new key or secret in your cloud console and connect it again under Cloud credentials.

what it looks like
AK502: the cloud rejected the credentials connected to this environment (InvalidClientTokenId)

AK503No cloud credentials are connected

Credentials belong to one environment. This one has none, which is the case for any newly added environment even when its siblings have them.

Fix: Connect credentials under Cloud credentials in the project sidebar, then deploy again.

what it looks like
AK503: no gcp credentials are connected to the dev environment

AK504An encryption key is not accessible

Creating the resource needed an encryption key the deploying credentials cannot use or describe. On AWS this is most often a database whose password Ackee has the cloud manage in its secrets service.

Fix: Plan again: Ackee's own runner grants itself key access on every run. If it persists, copy the current policy from Cloud credentials and replace the one on your credentials.

what it looks like
AK504: database "main": the encryption key for this resource is not accessible (KMSKeyNotAccessibleFault)

AK505A cloud quota or limit was reached

Your cloud account is at a limit for this kind of resource in this region, such as the number of networks or database instances.

Fix: Remove unused resources, request a higher quota from your cloud provider, or deploy to another region.

what it looks like
AK505: network "net": the account has reached its limit for this resource (VpcLimitExceeded)

AK506The cloud was temporarily unable to do this

The cloud reported a temporary fault or a lack of capacity. Nothing is wrong with the file.

Fix: Deploy again in a few minutes. Ackee already retried before reporting this.

what it looks like
AK506: capacity is unavailable at this time in this zone

AK507That name is already taken

A resource with the same name already exists — in your account, or, for globally named resources such as storage buckets, anywhere.

Fix: Change the declaration's name, or remove the existing resource if it is left over from an earlier deployment.

what it looks like
AK507: bucket "uploads": a resource with this name already exists (BucketAlreadyExists)

AK508A cloud service is not enabled

The cloud service this resource lives in is not enabled for the project or subscription.

Fix: Enable the service the message names in your cloud console, wait a minute for it to take effect, and deploy again.

what it looks like
AK508: service "web": the run.googleapis.com service is not enabled in project acme-prod

AK509Something this resource needs does not exist

The resource refers to something the cloud cannot find. A common case is a service reading a secret that has been created but never given a value.

Fix: Give the secret a value in your cloud's secret manager, or create what the message names, then deploy again.

what it looks like
AK509: service "api": secret webtest-dev-api-key has no value yet

AK510The cloud rejected a setting

The cloud considered a value invalid for this resource, such as a size that does not exist in this region or a name with characters it does not allow.

Fix: Change the field the message points at. The cloud's own reason is quoted in the message.

what it looks like
AK510: database "main": the cloud rejected a value: DB instance class db.t9.nano is not available

AK599The cloud reported an error

The cloud refused a change for a reason Ackee does not classify yet. The cloud's own message is included.

Fix: Read the quoted reason; it usually names the problem. The deployment log has the full detail.

what it looks like
AK599: service "web": the cloud refused the change: ...

Ackee's safeguards AK6xx

Ackee stopped a deploy on purpose, because going ahead could have cost you data or built something you had not approved.

AK601Ackee refused to deploy over lost records

This environment has deployed before, but the record of what it built is now empty. Deploying would build a second copy of everything instead of updating what exists, so Ackee stopped.

Fix: Contact support from the editor. Do not delete the environment: its resources still exist in your account.

AK602The approved plan is no longer available

A plan is applied exactly as it was approved. The saved plan was lost, usually because Ackee restarted between approval and deployment.

Fix: Plan again and approve the new plan.

AK603The isolated runner could not start

Ackee runs every deployment in a short-lived, isolated machine in your own cloud account. Preparing or starting it failed.

Fix: The message says which step failed. Permission problems are fixed by updating the policy from Cloud credentials; capacity problems by deploying again.

AK604This deployment needs durable records

Ackee keeps the record of what it built in a bucket in your account. This deployment needs one and none could be prepared.

Fix: Check that your credentials can create storage buckets, then deploy again.