anomalyco/sst · error · VisibleError

Lambda@Edge functions must be deployed in us-east-1 region.

Error message

Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}

What it means

SST validates that a Lambda@Edge function ARN references a function deployed in us-east-1, because AWS only allows Lambda@Edge functions to be replicated from that region. parseLambdaEdgeArn splits the ARN and throws a VisibleError when parts[3] (the region) is not us-east-1.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:121

export function parseRoleArn(arn: string) {
  // arn:aws:iam::123456789012:role/MyRole
  const roleName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !roleName)
    throw new VisibleError(`The provided ARN "${arn}" is not an IAM role ARN.`);
  return { roleName };
}

export function parseLambdaEdgeArn(arn: string) {
  // First validate it's a Lambda function ARN
  const { functionName } = parseFunctionArn(arn);

  // arn:aws:lambda:region:account-id:function:function-name:version
  const parts = arn.split(":");
  const region = parts[3];
  const version = parts[7];

  if (region !== "us-east-1") {
    throw new VisibleError(
      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,
    );
  }

  if (!version || version === "$LATEST") {
    throw new VisibleError(
      `Lambda@Edge requires a qualified ARN (with version). Got: ${arn}`,
    );
  }

  return { functionName, region, version };
}

export function parseElasticSearch(arn: string) {
  // arn:aws:es:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(

View on GitHub (pinned to a0bd20f762)

Solutions

1. Deploy the Lambda function in us-east-1 and use that ARN for Lambda@Edge
2. Convert the function to a CloudFront Functions equivalent if the logic runs at edge and does not need Lambda
3. Move the whole SST app/stack region to us-east-1 if edge lambdas are central

Example fix

// before
new sst.aws.Function("MyFn", { region: "eu-west-1", handler: "src/edge.handler" })
// after
new sst.aws.Function("MyFn", { region: "us-east-1", handler: "src/edge.handler" })

function assertUsEast1Arn(arn: string) {
  const region = arn.split(":")[3];
  if (region !== "us-east-1") throw new Error(`Lambda@Edge requires us-east-1, got ${region}`);
}

const isUsEast1Arn = (arn: string) => arn.split(":")[3] === "us-east-1";

When it happens

Trigger: Passing a Lambda function ARN whose region segment (4th colon-separated field) is anything other than us-east-1 to a CloudFront distribution's edge function option (e.g. edge: true / handler wiring via normalizeProtection).

Common situations: Deploying the app in eu-west-1 or us-east-2 and reusing the default function ARN for a Lambda@Edge binding; copying a regular Lambda ARN from another stack region into a CloudFront config.

Related errors

• Lambda@Edge requires a qualified ARN (with version). Got: ${
• Need to provide a validated certificate via "cert" when DNS
• The provided ARN "${arn}" is not a Lambda function ARN.
• The provided ARN "${arn}" is not an S3 bucket ARN.
• The provided ARN "${arn}" is not an SNS Topic ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/524d477727ca975c. Report an issue: GitHub.