{"record":{"id":"29ea7ec906f4a2a9","repo":"remotion-dev/remotion","slug":"unrecognizedclientexception-the-aws-credentials-p-29ea7e","errorCode":null,"errorMessage":"UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception","messagePattern":"UnrecognizedClientException: The AWS credentials provided were probably mixed up\\. Learn how to fix this issue here: https://remotion\\.dev/docs/lambda/troubleshooting/unrecognizedclientexception","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/render-still-on-lambda.ts","lineNumber":149,"sourceCode":"\t\treturn {\n\t\t\testimatedPrice: res.estimatedPrice,\n\t\t\turl: res.output,\n\t\t\toutKey: res.outKey,\n\t\t\tsizeInBytes: res.size,\n\t\t\tbucketName: res.bucketName,\n\t\t\trenderId: res.renderId,\n\t\t\tcloudWatchLogs: getCloudwatchMethodUrl({\n\t\t\t\tfunctionName,\n\t\t\t\tmethod: ServerlessRoutines.still,\n\t\t\t\tregion,\n\t\t\t\trenderId: res.renderId,\n\t\t\t\trendererFunctionName: null,\n\t\t\t}),\n\t\t\tartifacts: res.receivedArtifacts,\n\t\t};\n\t} catch (err) {\n\t\tif ((err as Error).stack?.includes('UnrecognizedClientException')) {\n\t\t\tthrow new Error(\n\t\t\t\t'UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception',\n\t\t\t);\n\t\t}\n\n\t\tthrow err;\n\t}\n};\n\nexport const internalRenderStillOnLambda = wrapWithErrorHandling(\n\tinnerRenderStillOnLambda,\n);\n\n/*\n * @description Renders a still image inside a lambda function and writes it to the specified output location.\n * @see [Documentation](https://remotion.dev/docs/lambda/renderstillonlambda)\n */\nexport function renderStillOnLambda(\n\tinput: RenderStillOnLambdaInput & {","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/render-still-on-lambda.ts#L131-L167","documentation":"Same UnrecognizedClientException guard as in renderMediaOnLambda, but applied to renderStillOnLambda. The Lambda invoke for the still render fails because the AWS credentials cannot be recognized (wrong region/partition or mismatched key/secret). The library re-throws with the docs link.","triggerScenarios":"The wrapped renderStill call catches an error whose stack includes 'UnrecognizedClientException'.","commonSituations":"Same credential/region mismatches as renderMediaOnLambda, encountered on the still-render path; rotating credentials and updating only the access key; using a different AWS profile for stills vs. video renders.","solutions":["Re-set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as a matched pair from the same IAM user.","Ensure AWS_REGION matches the deployment region of the Lambda function.","Run aws sts get-caller-identity to confirm the active principal.","See https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception"],"exampleFix":"// before\nawait renderStillOnLambda({ ...params }); // fails: mismatched creds\n\n// after — set matched credentials and correct region\nprocess.env.AWS_REGION = 'us-east-1';\nawait renderStillOnLambda({ ...params });","handlingStrategy":"validation","validationCode":"// Same credential sanity check as the media render path\nconst id = await new STSClient({ region }).send(new GetCallerIdentityCommand({}));\nif (id.Account !== EXPECTED_ACCOUNT_ID) {\n  throw new Error('Credentials do not match expected account; aborting still render');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await renderStillOnLambda(opts);\n} catch (e) {\n  if (e instanceof Error && /UnrecognizedClientException/.test(e.message)) {\n    throw new Error('AWS credentials misconfigured — check key/secret/region');\n  }\n  throw e;\n}","preventionTips":["Use the same matched credential pair for still and video renders.","Confirm AWS_REGION before invoking.","Run aws sts get-caller-identity in CI before the first render."],"tags":["aws","credentials","iam","lambda","region","still"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}