DynamoDB update_item doesn't raise error if unused ExpressionAttributeValue is passed

[t-veor]

Testing with the following script:

import traceback

import boto3
from moto import mock_aws


def bad_update(table):
    table.update_item(
        Key={"pk": "foo", "sk": "bar"},
        UpdateExpression="SET x = :one",
        ExpressionAttributeValues={":one": 1, ":something_else": 2},
    )


@mock_aws
def moto_test():
    dynamodb = boto3.resource("dynamodb", region_name="eu-west-1")
    table = dynamodb.create_table(
        AttributeDefinitions=[
            {"AttributeName": "pk", "AttributeType": "S"},
            {"AttributeName": "sk", "AttributeType": "S"},
        ],
        TableName="test-table",
        KeySchema=[
            {"AttributeName": "pk", "KeyType": "HASH"},
            {"AttributeName": "sk", "KeyType": "RANGE"},
        ],
        BillingMode="PAY_PER_REQUEST",
    )

    bad_update(table)


def boto_test():
    dynamodb = boto3.resource("dynamodb", region_name="eu-west-1")
    table = dynamodb.Table("test-table")

    bad_update(table)


print("moto_test:")
try:
    moto_test()
    print("Success!")
except:
    traceback.print_exc()


print("boto_test:")
try:
    boto_test()
    print("Success!")
except:
    traceback.print_exc()

I get this output:

moto_test:
Success!
boto_test:
Traceback (most recent call last):
  File "[snip]/moto-test/main.py", line 51, in <module>
    boto_test()
    ~~~~~~~~~^^
  File "[snip]/moto-test/main.py", line 38, in boto_test
    bad_update(table)
    ~~~~~~~~~~^^^^^^^
  File "[snip]/moto-test/main.py", line 8, in bad_update
    table.update_item(
    ~~~~~~~~~~~~~~~~~^
        Key={"pk": "foo", "sk": "bar"},
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        UpdateExpression="SET x = :one",
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        ExpressionAttributeValues={":one": 1, ":something_else": 2},
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "[snip]/moto-test/.venv/lib/python3.13/site-packages/boto3/resources/factory.py", line 581, in do_action
    response = action(self, *args, **kwargs)
  File "[snip]/moto-test/.venv/lib/python3.13/site-packages/boto3/resources/action.py", line 88, in __call__
    response = getattr(parent.meta.client, operation_name)(*args, **params)
  File "[snip]/moto-test/.venv/lib/python3.13/site-packages/botocore/client.py", line 570, in _api_call
    return self._make_api_call(operation_name, kwargs)
           ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "[snip]/moto-test/.venv/lib/python3.13/site-packages/botocore/context.py", line 124, in wrapper
    return func(*args, **kwargs)
  File "[snip]/moto-test/.venv/lib/python3.13/site-packages/botocore/client.py", line 1031, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the UpdateItem operation: Value provided in ExpressionAttributeValues unused in expressions: keys: {:something_else}

Environment:

• moto = 5.1.1
• boto3 = 1.37.11
• python = 3.13.1
• OS = Linux 6.13.5-arch1-1

[t-veor]

Additionally moto doesn't raise a validation error if an empty set is passed as an ExpressionAttributeValue either, whereas AWS does. Replacing the bad_update function with the following:

def bad_update(table):
    table.update_item(
        Key={"pk": "foo", "sk": "bar"},
        UpdateExpression="SET x = :one",
        ExpressionAttributeValues={":one": set()},
    )

Works with moto, but I get this error from boto3:

botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the UpdateItem operation: ExpressionAttributeValues contains invalid value: One or more parameter values were invalid: An number set  may not be empty for key :one