anomalyco/sst · error · VisibleError

The provided ARN "${arn}" is not an IAM role ARN.

Error message

The provided ARN "${arn}" is not an IAM role ARN.

What it means

parseRoleArn validates an IAM role ARN (arn:aws:iam::account-id:role/MyRole) and extracts the role name. It throws a VisibleError when the string lacks 'arn:' or has no '/'-delimited role name.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:107

    );
  return { streamName };
}

export function parseEventBusArn(arn: string) {
  // arn:aws:events:region:account-id:event-bus/bus-name
  const busName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !busName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a EventBridge event bus ARN.`,
    );
  return { busName };
}

export function parseRoleArn(arn: string) {
  // arn:aws:iam::123456789012:role/MyRole
  const roleName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !roleName)
    throw new VisibleError(`The provided ARN "${arn}" is not an IAM role ARN.`);
  return { roleName };
}

export function parseLambdaEdgeArn(arn: string) {
  // First validate it's a Lambda function ARN
  const { functionName } = parseFunctionArn(arn);

  // arn:aws:lambda:region:account-id:function:function-name:version
  const parts = arn.split(":");
  const region = parts[3];
  const version = parts[7];

  if (region !== "us-east-1") {
    throw new VisibleError(
      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,
    );
  }

View on GitHub (pinned to a0bd20f762)

Solutions

1. Use the full form arn:aws:iam::account-id:role/role-name
2. Copy the ARN from the IAM console role summary
3. If you only have the role name, construct the ARN with your account ID

Example fix

// before
parseRoleArn("MyRole");
// after
parseRoleArn("arn:aws:iam::123456789012:role/MyRole");

const ROLE_ARN = /^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/[\w+=,.@/-]+$/;
if (!ROLE_ARN.test(arn)) throw new Error(`Not an IAM role ARN: ${arn}`);

function isRoleArn(v: string): boolean {
  return /^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/[\w+=,.@/-]+$/.test(v);
}

try {
  const { roleName } = parseRoleArn(arn);
} catch (e) {
  throw new Error(`Failed to parse IAM role ARN "${arn}": ${(e as Error).message}`);
}

When it happens

Trigger: Resolving the auth/unauth role from an ARN (Auth.fromArn style usage) where the string is a role name, a user ARN, or a policy ARN.

Common situations: Passing just the role name, using an IAM user or policy ARN instead of a role ARN, missing the role/ path prefix.

Related errors

• The provided ARN "${arn}" is not a Lambda function ARN.
• The provided ARN "${arn}" is not an S3 bucket ARN.
• The provided ARN "${arn}" is not an SNS Topic ARN.
• The provided ARN "${arn}" is not an SQS Queue ARN.
• The provided ARN "${arn}" is not a DynamoDB table ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/07c46cb4d191857e. Report an issue: GitHub.