{"record":{"id":"07c46cb4d191857e","repo":"anomalyco/sst","slug":"the-provided-arn-arn-is-not-an-iam-role-arn","errorCode":null,"errorMessage":"The provided ARN \"${arn}\" is not an IAM role ARN.","messagePattern":"The provided ARN \"(.+?)\" is not an IAM role ARN\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/helpers/arn.ts","lineNumber":107,"sourceCode":"    );\n  return { streamName };\n}\n\nexport function parseEventBusArn(arn: string) {\n  // arn:aws:events:region:account-id:event-bus/bus-name\n  const busName = arn.split(\"/\")[1];\n  if (!arn.startsWith(\"arn:\") || !busName)\n    throw new VisibleError(\n      `The provided ARN \"${arn}\" is not a EventBridge event bus ARN.`,\n    );\n  return { busName };\n}\n\nexport function parseRoleArn(arn: string) {\n  // arn:aws:iam::123456789012:role/MyRole\n  const roleName = arn.split(\"/\")[1];\n  if (!arn.startsWith(\"arn:\") || !roleName)\n    throw new VisibleError(`The provided ARN \"${arn}\" is not an IAM role ARN.`);\n  return { roleName };\n}\n\nexport function parseLambdaEdgeArn(arn: string) {\n  // First validate it's a Lambda function ARN\n  const { functionName } = parseFunctionArn(arn);\n\n  // arn:aws:lambda:region:account-id:function:function-name:version\n  const parts = arn.split(\":\");\n  const region = parts[3];\n  const version = parts[7];\n\n  if (region !== \"us-east-1\") {\n    throw new VisibleError(\n      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,\n    );\n  }\n","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/helpers/arn.ts#L89-L125","documentation":"parseRoleArn validates an IAM role ARN (arn:aws:iam::account-id:role/MyRole) and extracts the role name. It throws a VisibleError when the string lacks 'arn:' or has no '/'-delimited role name.","triggerScenarios":"Resolving the auth/unauth role from an ARN (Auth.fromArn style usage) where the string is a role name, a user ARN, or a policy ARN.","commonSituations":"Passing just the role name, using an IAM user or policy ARN instead of a role ARN, missing the role/ path prefix.","solutions":["Use the full form arn:aws:iam::account-id:role/role-name","Copy the ARN from the IAM console role summary","If you only have the role name, construct the ARN with your account ID"],"exampleFix":"// before\nparseRoleArn(\"MyRole\");\n// after\nparseRoleArn(\"arn:aws:iam::123456789012:role/MyRole\");","handlingStrategy":"validation","validationCode":"const ROLE_ARN = /^arn:aws[a-zA-Z-]*:iam::\\d{12}:role\\/[\\w+=,.@/-]+$/;\nif (!ROLE_ARN.test(arn)) throw new Error(`Not an IAM role ARN: ${arn}`);","typeGuard":"function isRoleArn(v: string): boolean {\n  return /^arn:aws[a-zA-Z-]*:iam::\\d{12}:role\\/[\\w+=,.@/-]+$/.test(v);\n}","tryCatchPattern":"try {\n  const { roleName } = parseRoleArn(arn);\n} catch (e) {\n  throw new Error(`Failed to parse IAM role ARN \"${arn}\": ${(e as Error).message}`);\n}","preventionTips":["Confirm the ARN path starts with role/ (not user/ or policy/)","IAM ARNs have an empty region segment; do not insert one","Copy the role ARN from the IAM console role summary to avoid truncation"],"tags":["arn","iam","validation","sst"],"backgroundTag":"invalid-arn-format","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}