diff --git a/metaflow/plugins/aws/aws_utils.py b/metaflow/plugins/aws/aws_utils.py
index 96143c67c70..c3766f6e40a 100644
--- a/metaflow/plugins/aws/aws_utils.py
+++ b/metaflow/plugins/aws/aws_utils.py
@@ -219,7 +219,7 @@ def validate_aws_tag(key: str, value: str):
 
     if not re.match(PERMITTED, key):
         raise MetaflowException(
-            "Key *s* is not permitted. Tags must match pattern: %s" % (key, PERMITTED)
+            "Key *%s* is not permitted. Tags must match pattern: %s" % (key, PERMITTED)
         )
     if not re.match(PERMITTED, value):
         raise MetaflowException(
diff --git a/test/unit/test_aws_util.py b/test/unit/test_aws_util.py
index a212996c4eb..1398b0729d8 100644
--- a/test/unit/test_aws_util.py
+++ b/test/unit/test_aws_util.py
@@ -1,5 +1,6 @@
 import pytest
 
+from metaflow.exception import MetaflowException
 from metaflow.plugins.aws.aws_utils import validate_aws_tag
 
 
@@ -37,3 +38,17 @@ def test_validate_aws_tag(key, value, should_raise):
         did_raise = True
 
     assert did_raise == should_raise
+
+
+@pytest.mark.parametrize(
+    "key, value, expected_prefix",
+    [
+        ("#not-permitted", "ok", "Key *#not-permitted* is not permitted."),
+        ("ok", "#not-permitted", "Value *#not-permitted* is not permitted."),
+    ],
+)
+def test_validate_aws_tag_not_permitted_message(key, value, expected_prefix):
+    with pytest.raises(MetaflowException) as exc_info:
+        validate_aws_tag(key, value)
+
+    assert str(exc_info.value).startswith(expected_prefix)