{"record":{"id":"39c6a24cc43f2ec8","repo":"remotion-dev/remotion","slug":"unrecognizedclientexception-the-aws-credentials-p-39c6a2","errorCode":null,"errorMessage":"UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception","messagePattern":"UnrecognizedClientException: The AWS credentials provided were probably mixed up\\. Learn how to fix this issue here: https://remotion\\.dev/docs/lambda/troubleshooting/unrecognizedclientexception","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/render-media-on-lambda.ts","lineNumber":150,"sourceCode":"\t\t\t}),\n\t\t\tfolderInS3Console: getS3RenderUrl({\n\t\t\t\tbucketName: res.bucketName,\n\t\t\t\trenderId: res.renderId,\n\t\t\t\tregion,\n\t\t\t}),\n\t\t\tlambdaInsightsLogs: getLambdaInsightsUrl({\n\t\t\t\tfunctionName,\n\t\t\t\tregion,\n\t\t\t}),\n\t\t\tprogressJsonInConsole: getProgressJsonUrl({\n\t\t\t\tbucketName: res.bucketName,\n\t\t\t\trenderId: res.renderId,\n\t\t\t\tregion,\n\t\t\t}),\n\t\t};\n\t} catch (err) {\n\t\tif ((err as Error).stack?.includes('UnrecognizedClientException')) {\n\t\t\tthrow new Error(\n\t\t\t\t'UnrecognizedClientException: The AWS credentials provided were probably mixed up. Learn how to fix this issue here: https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception',\n\t\t\t);\n\t\t}\n\n\t\tthrow err;\n\t}\n};\n\nexport const renderMediaOnLambdaOptionalToRequired = (\n\toptions: RenderMediaOnLambdaInput,\n): InnerRenderMediaOnLambdaInput => {\n\treturn {\n\t\toffthreadVideoThreads: options.offthreadVideoThreads ?? null,\n\t\taudioBitrate: options.audioBitrate ?? null,\n\t\taudioCodec: options.audioCodec ?? null,\n\t\tchromiumOptions: options.chromiumOptions ?? {},\n\t\tcodec: options.codec,\n\t\tcolorSpace: options.colorSpace ?? null,","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/render-media-on-lambda.ts#L132-L168","documentation":"Thrown by renderMediaOnLambda when the underlying Lambda invoke fails with UnrecognizedClientException. AWS throws this exception when credentials are used against the wrong region/partition or when access key and secret are mismatched (e.g., key from one account, secret from another). The library re-throws a friendly message linking the troubleshooting doc.","triggerScenarios":"The wrapped render call catches an error whose stack includes 'UnrecognizedClientException' and replaces it with this message + the docs URL.","commonSituations":"Mixing AWS_ACCESS_KEY_ID from one account with AWS_SECRET_ACCESS_KEY from another in .env; setting AWS_REGION to a region different from where the Lambda was deployed; copying only the access key without the secret after rotation; profile mismatch between deploy and render machines.","solutions":["Re-set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as a matched pair from the same IAM user.","Ensure AWS_REGION matches the region where the Remotion Lambda function is deployed.","Verify with `aws sts get-caller-identity` that the active credentials resolve to the expected account.","If using profiles, confirm AWS_PROFILE points to the same profile used for deployFunction.","See https://remotion.dev/docs/lambda/troubleshooting/unrecognizedclientexception"],"exampleFix":"// before (mismatched creds / region)\n// AWS_ACCESS_KEY_ID=AKIA...accountA\n// AWS_SECRET_ACCESS_KEY=...accountB\n// AWS_REGION=eu-west-1  (function deployed in us-east-1)\n\n// after\n// AWS_ACCESS_KEY_ID=AKIA...accountA\n// AWS_SECRET_ACCESS_KEY=...accountA  (matched pair)\n// AWS_REGION=us-east-1","handlingStrategy":"validation","validationCode":"// Verify the credentials resolve to the expected account before rendering\nconst sts = new STSClient({ region });\nconst id = await sts.send(new GetCallerIdentityCommand({}));\nif (id.Account !== EXPECTED_ACCOUNT_ID) {\n  throw new Error('Active credentials do not match expected account; refusing to render');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await renderMediaOnLambda(opts);\n} catch (e) {\n  if (e instanceof Error && /UnrecognizedClientException/.test(e.message)) {\n    // halt and surface a credentials-config error; do NOT retry\n    throw new Error('AWS credentials misconfigured — check key/secret/region');\n  }\n  throw e;\n}","preventionTips":["Always set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as a matched pair.","Confirm AWS_REGION matches the function's deployment region.","Run aws sts get-caller-identity in CI before invoking Lambda."],"tags":["aws","credentials","iam","lambda","region"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}