{"record":{"id":"455853e279c76e2c","repo":"remotion-dev/remotion","slug":"you-don-t-have-the-required-permissions-to-create","errorCode":null,"errorMessage":"You don't have the required permissions to create lifecycle rules on the bucket \"${bucketName}\", but the \"enableFolderExpiry\" was set to true. Ensure that your user has the \"s3:PutLifecycleConfiguration\" permission.","messagePattern":"You don't have the required permissions to create lifecycle rules on the bucket \"(.+?)\", but the \"enableFolderExpiry\" was set to true\\. Ensure that your user has the \"s3:PutLifecycleConfiguration\" permission\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/lifecycle-rules.ts","lineNumber":44,"sourceCode":"\tconst lcRules = getLifeCycleRules();\n\t// create the lifecyle rules\n\tconst createCommandInput = createLifeCycleInput({\n\t\tbucketName,\n\t\tlcRules,\n\t});\n\tconst createCommand = new PutBucketLifecycleConfigurationCommand(\n\t\tcreateCommandInput,\n\t);\n\ttry {\n\t\tawait getS3Client({\n\t\t\tregion,\n\t\t\tcustomCredentials,\n\t\t\tforcePathStyle,\n\t\t\trequestHandler,\n\t\t}).send(createCommand);\n\t} catch (err) {\n\t\tif ((err as Error).stack?.includes('AccessDenied')) {\n\t\t\tthrow new Error(\n\t\t\t\t`You don't have the required permissions to create lifecycle rules on the bucket \"${bucketName}\", but the \"enableFolderExpiry\" was set to true. Ensure that your user has the \"s3:PutLifecycleConfiguration\" permission.`,\n\t\t\t);\n\t\t}\n\t}\n};\n\nconst deleteLCRules = async ({\n\tbucketName,\n\tregion,\n\tcustomCredentials,\n\tforcePathStyle,\n\trequestHandler,\n}: {\n\tbucketName: string;\n\tregion: AwsRegion;\n\tcustomCredentials: CustomCredentials<AwsProvider> | null;\n\tforcePathStyle: boolean;\n\trequestHandler: RequestHandler | null;","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/lifecycle-rules.ts#L26-L62","documentation":"When enableFolderExpiry is true, Remotion calls PutBucketLifecycleConfiguration on the bucket. If the IAM user lacks s3:PutLifecycleConfiguration, AWS returns AccessDenied (matched in the error stack) and this clear message is thrown naming the bucket and the missing permission.","triggerScenarios":"Calling getOrCreateBucket (or any bucket op that applies lifecycle rules) with enableFolderExpiry:true under an IAM policy missing s3:PutLifecycleConfiguration.","commonSituations":"Adding enableFolderExpiry to an existing setup without updating the IAM policy; minimal/corporate restricted policy.","solutions":["Add s3:PutLifecycleConfiguration to the IAM user/role policy","Or disable enableFolderExpiry if folder expiry is not required"],"exampleFix":"// before\nawait getOrCreateBucket({ enableFolderExpiry: true, ... }); // IAM lacks the perm\n\n// after - either grant the permission or turn the flag off\nawait getOrCreateBucket({ enableFolderExpiry: false, ... });","handlingStrategy":"validation","validationCode":"// Before calling with enableFolderExpiry, confirm the permission is available,\n// otherwise disable the flag\nconst enableFolderExpiry = iamAllows('s3:PutLifecycleConfiguration') ? true : false;","typeGuard":null,"tryCatchPattern":"try {\n  await getOrCreateBucket({ enableFolderExpiry: true, ... });\n} catch (err) {\n  if ((err as Error).message.includes('s3:PutLifecycleConfiguration')) {\n    // either grant the permission or set enableFolderExpiry:false and retry\n  }\n  throw err;\n}","preventionTips":["Add s3:PutLifecycleConfiguration before enabling folder expiry","Default enableFolderExpiry to false unless your policy supports it","Document the extra permission requirement next to the flag in your config"],"tags":["aws","iam","s3","lifecycle","permissions"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}