diff --git a/server/src/main/java/com/aws/greengrass/cli/CLIEventStreamAgent.java b/server/src/main/java/com/aws/greengrass/cli/CLIEventStreamAgent.java
index 6c89de7..bf49ab9 100644
--- a/server/src/main/java/com/aws/greengrass/cli/CLIEventStreamAgent.java
+++ b/server/src/main/java/com/aws/greengrass/cli/CLIEventStreamAgent.java
@@ -463,7 +463,6 @@ public CreateLocalDeploymentResponse handleRequest(CreateLocalDeploymentRequest
                         .resource(AuthorizationHandler.ANY_REGEX)
                         .operation(CREATE_LOCAL_DEPLOYMENT)
                         .build());
-                String deploymentId = UUID.randomUUID().toString();
                 //All inputs are valid. If all inputs are empty, then user might just want to retrigger the deployment
                 // with new recipes set using the updateRecipesAndArtifacts API.
                 Map<String, ConfigurationUpdateOperation> configUpdate = null;
@@ -489,6 +488,9 @@ public CreateLocalDeploymentResponse handleRequest(CreateLocalDeploymentRequest
                     }
                 }
 
+                validateThingGroupName(request);
+
+                String deploymentId = UUID.randomUUID().toString();
                 LocalOverrideRequest localOverrideRequest = LocalOverrideRequest.builder().requestId(deploymentId)
                         .componentsToMerge(request.getRootComponentVersionsToAdd())
                         .componentsToRemove(request.getRootComponentsToRemove())
@@ -537,6 +539,11 @@ public CreateLocalDeploymentResponse handleRequest(CreateLocalDeploymentRequest
             });
         }
 
+        private void validateThingGroupName(CreateLocalDeploymentRequest request) {
+            if (!Utils.isEmpty(request.getGroupName()) && request.getGroupName().contains(":")) {
+                throw new InvalidArgumentsError("Thing group name cannot contain colon characters");
+            }
+        }
 
         @Override
         public void handleStreamEvent(EventStreamJsonMessage streamRequestEvent) {
diff --git a/server/src/test/java/com/aws/greengrass/cli/IPCCliTest.java b/server/src/test/java/com/aws/greengrass/cli/IPCCliTest.java
index c6c86a9..17fc970 100644
--- a/server/src/test/java/com/aws/greengrass/cli/IPCCliTest.java
+++ b/server/src/test/java/com/aws/greengrass/cli/IPCCliTest.java
@@ -36,6 +36,8 @@
 import org.junit.jupiter.api.TestMethodOrder;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.api.extension.ExtensionContext;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import software.amazon.awssdk.aws.greengrass.GreengrassCoreIPCClient;
 import software.amazon.awssdk.aws.greengrass.GreengrassCoreIPCClientV2;
 import software.amazon.awssdk.aws.greengrass.model.ComponentDetails;
@@ -451,6 +453,28 @@ void GIVEN_kernel_running_WHEN_CLI_authorized_groups_updated_THEN_old_token_revo
         }
     }
 
+    @Order(11)
+    @ParameterizedTest
+    @ValueSource(strings = {"group:", "group:1", "group:1:1"})
+    void GIVEN_kernel_running_WHEN_local_deployment_with_invalid_thing_group_THEN_deployment_fails(String invalidThingGroupName, ExtensionContext context) throws Exception {
+        ignoreExceptionOfType(context, SdkClientException.class);
+        ignoreExceptionOfType(context, PackageDownloadException.class);
+        ignoreExceptionOfType(context, ComponentVersionNegotiationException.class);
+
+        Path recipesPath = Paths.get(this.getClass().getResource("recipes").toURI());
+        Path artifactsPath = Paths.get(this.getClass().getResource("artifacts").toURI());
+
+        CreateLocalDeploymentRequest createLocalDeploymentRequest = new CreateLocalDeploymentRequest();
+        createLocalDeploymentRequest.setGroupName(invalidThingGroupName);
+        createLocalDeploymentRequest.setRootComponentVersionsToAdd(Collections.singletonMap("Component1", "1.0.0"));
+        createLocalDeploymentRequest.setRecipeDirectoryPath(recipesPath.toAbsolutePath().toString());
+        createLocalDeploymentRequest.setArtifactsDirectoryPath(artifactsPath.toAbsolutePath().toString());
+
+        ExecutionException executionException = assertThrows(ExecutionException.class, () ->
+                clientConnection.createLocalDeployment(createLocalDeploymentRequest, Optional.empty())
+                        .getResponse().get(DEFAULT_TIMEOUT_IN_SEC, TimeUnit.SECONDS));
+        assertEquals(InvalidArgumentsError.class, executionException.getCause().getClass());
+    }
 
     private String getAuthTokenFromInfoFile() throws IOException {
         File[] authFiles = kernel.getNucleusPaths().cliIpcInfoPath().toFile().listFiles();