{"record":{"id":"036c8162b81e7a4a","repo":"remotion-dev/remotion","slug":"bucket-owner-mismatch-expected-the-bucket-bucke","errorCode":null,"errorMessage":"Bucket owner mismatch: Expected the bucket ${bucketName} to be owned by you (AWS Account ID: ${expectedBucketOwner}) but it's not the case. Did you accidentially specify the wrong bucket?","messagePattern":"Bucket owner mismatch: Expected the bucket (.+?) to be owned by you \\(AWS Account ID: (.+?)\\) but it's not the case\\. Did you accidentially specify the wrong bucket\\?","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/list-objects.ts","lineNumber":80,"sourceCode":"\t\t} catch (err) {\n\t\t\tif (!expectedBucketOwner) {\n\t\t\t\tthrow err;\n\t\t\t}\n\n\t\t\t// Prevent from accessing a foreign bucket, retry without ExpectedBucketOwner and see if it works. If it works then it's an owner mismatch.\n\t\t\tif ((err as Error).stack?.includes('AccessDenied')) {\n\t\t\t\tawait getS3Client({\n\t\t\t\t\tregion,\n\t\t\t\t\tcustomCredentials: null,\n\t\t\t\t\tforcePathStyle,\n\t\t\t\t\trequestHandler,\n\t\t\t\t}).send(\n\t\t\t\t\tnew ListObjectsV2Command({\n\t\t\t\t\t\tBucket: bucketName,\n\t\t\t\t\t\tPrefix: prefix,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Bucket owner mismatch: Expected the bucket ${bucketName} to be owned by you (AWS Account ID: ${expectedBucketOwner}) but it's not the case. Did you accidentially specify the wrong bucket?`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthrow err;\n\t\t}\n\t};\n","sourceCodeStart":62,"sourceCodeEnd":88,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/list-objects.ts#L62-L88","documentation":"Thrown by list-objects after a two-step probe: the initial list call fails with AccessDenied, then the code retries the same ListObjectsV2 with customCredentials=null (using the account's default credentials). If that retry succeeds, it proves the bucket exists and is reachable but is NOT owned by the account you expected, so the original AccessDenied was an ownership mismatch rather than a missing permission.","triggerScenarios":"listObjects receives AccessDenied on the first attempt, then a fallback ListObjectsV2 with customCredentials:null succeeds. This combination is interpreted as the bucket belonging to a different AWS account than expectedBucketOwner.","commonSituations":"Typo or copy/paste error in the bucket name passed to render/simulation APIs; pointing render at a bucket created by a different AWS account or a different region's deploy; AWS account switch without updating the bucket reference; cross-account access where the bucket name was reused.","solutions":["Verify the bucket name spelling and confirm it is the one created by your Remotion deploy in the current account/region.","Check that expectedBucketOwner matches the AWS account ID that actually owns the bucket.","If the bucket is intentionally cross-account, configure proper cross-account bucket policy + bucket-owner-enforced ACLs instead of relying on a mismatch.","Re-run npx remotion lambda regions and npx remotion lambda buckets to confirm the correct bucket."],"exampleFix":"// before\nrenderMediaOnLambda({ bucketName: 'remotionlambda- Prod', ... }) // typo / wrong owner\n\n// after\nrenderMediaOnLambda({ bucketName: 'remotionlambda-us-east-1-1234567890', ... }) // correct bucket for this account","handlingStrategy":"validation","validationCode":"// Confirm the bucket belongs to the expected account before rendering\nconst owner = await getBucketOwnerName(bucketName); // via s3:GetBucketLocation + sts\nif (owner !== expectedAccountName) {\n  throw new Error(`Bucket ${bucketName} is owned by ${owner}, aborting render`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await listObjects({ bucketName, region, expectedBucketOwner });\n} catch (e) {\n  if (e instanceof Error && /Bucket owner mismatch/.test(e.message)) {\n    // surface a config error, do not retry blindly\n    throw new Error('Configuration error: wrong bucket for this AWS account');\n  }\n  throw e;\n}","preventionTips":["Keep the bucket name and AWS account in a single source of truth (e.g., deploy manifest).","Verify bucket ownership with aws s3api list-buckets after account switches.","Use unique bucket names per environment to avoid cross-account confusion."],"tags":["aws","s3","iam","bucket-ownership","permissions"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}