anomalyco/sst · error · VisibleError

Lambda@Edge requires a qualified ARN (with version). Got: ${

Error message

Lambda@Edge requires a qualified ARN (with version). Got: ${arn}

What it means

Lambda@Edge can only be attached to a CloudFront distribution via a versioned function ARN; $LATEST or an unqualified ARN is rejected by AWS. parseLambdaEdgeArn extracts parts[7] (the version) and throws a VisibleError when it is missing or equals "$LATEST".

Source

Thrown at platform/src/components/aws/helpers/arn.ts:127

}

export function parseLambdaEdgeArn(arn: string) {
  // First validate it's a Lambda function ARN
  const { functionName } = parseFunctionArn(arn);

  // arn:aws:lambda:region:account-id:function:function-name:version
  const parts = arn.split(":");
  const region = parts[3];
  const version = parts[7];

  if (region !== "us-east-1") {
    throw new VisibleError(
      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,
    );
  }

  if (!version || version === "$LATEST") {
    throw new VisibleError(
      `Lambda@Edge requires a qualified ARN (with version). Got: ${arn}`,
    );
  }

  return { functionName, region, version };
}

export function parseElasticSearch(arn: string) {
  // arn:aws:es:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a ElasticSearch domain ARN.`,
    );
  return { tableName };
}

export function parseOpenSearch(arn: string) {

View on GitHub (pinned to a0bd20f762)

Solutions

1. Publish a version of the Lambda and use the qualified ARN ending in :<version-number>
2. In SST, reference the function's version output rather than the raw arn
3. Never use $LATEST for edge functions; pin an explicit version

Example fix

// before
edge: "arn:aws:lambda:us-east-1:123456789012:function:myFn:$LATEST"
// after
edge: "arn:aws:lambda:us-east-1:123456789012:function:myFn:3"

function assertVersionedArn(arn: string) {
  const version = arn.split(":")[7];
  if (!version || version === "$LATEST") throw new Error(`ARN must have a version: ${arn}`);
}

const isQualifiedArn = (arn: string) => { const v = arn.split(":")[7]; return !!v && v !== "$LATEST"; };

When it happens

Trigger: Passing a bare function ARN like arn:aws:lambda:us-east-1:123456789:function:name (no version suffix), or one ending in :$LATEST, to a Lambda@Edge/CloudFront option handled by normalizeProtection.

Common situations: Copying the function ARN from the AWS console (which shows the unqualified ARN) instead of the version ARN; referencing a function alias not a published version; forgetting to publish a version after updating code.

Related errors

• Lambda@Edge functions must be deployed in us-east-1 region.
• There have been some minor changes to the "Router" component
• Need to provide a validated certificate via "cert" when DNS
• Provisioned concurrency requires function versioning. Set "v
• The provided ARN "${arn}" is not a Lambda function ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/26a60f72bccf3536. Report an issue: GitHub.