{"record":{"id":"524d477727ca975c","repo":"anomalyco/sst","slug":"lambda-edge-functions-must-be-deployed-in-us-east","errorCode":null,"errorMessage":"Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}","messagePattern":"Lambda@Edge functions must be deployed in us-east-1 region\\. Got region: (.+?)","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/helpers/arn.ts","lineNumber":121,"sourceCode":"export function parseRoleArn(arn: string) {\n  // arn:aws:iam::123456789012:role/MyRole\n  const roleName = arn.split(\"/\")[1];\n  if (!arn.startsWith(\"arn:\") || !roleName)\n    throw new VisibleError(`The provided ARN \"${arn}\" is not an IAM role ARN.`);\n  return { roleName };\n}\n\nexport function parseLambdaEdgeArn(arn: string) {\n  // First validate it's a Lambda function ARN\n  const { functionName } = parseFunctionArn(arn);\n\n  // arn:aws:lambda:region:account-id:function:function-name:version\n  const parts = arn.split(\":\");\n  const region = parts[3];\n  const version = parts[7];\n\n  if (region !== \"us-east-1\") {\n    throw new VisibleError(\n      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,\n    );\n  }\n\n  if (!version || version === \"$LATEST\") {\n    throw new VisibleError(\n      `Lambda@Edge requires a qualified ARN (with version). Got: ${arn}`,\n    );\n  }\n\n  return { functionName, region, version };\n}\n\nexport function parseElasticSearch(arn: string) {\n  // arn:aws:es:region:account-id:domain/domain-name\n  const tableName = arn.split(\"/\")[1];\n  if (!arn.startsWith(\"arn:\") || !tableName)\n    throw new VisibleError(","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/helpers/arn.ts#L103-L139","documentation":"SST validates that a Lambda@Edge function ARN references a function deployed in us-east-1, because AWS only allows Lambda@Edge functions to be replicated from that region. parseLambdaEdgeArn splits the ARN and throws a VisibleError when parts[3] (the region) is not us-east-1.","triggerScenarios":"Passing a Lambda function ARN whose region segment (4th colon-separated field) is anything other than us-east-1 to a CloudFront distribution's edge function option (e.g. edge: true / handler wiring via normalizeProtection).","commonSituations":"Deploying the app in eu-west-1 or us-east-2 and reusing the default function ARN for a Lambda@Edge binding; copying a regular Lambda ARN from another stack region into a CloudFront config.","solutions":["Deploy the Lambda function in us-east-1 and use that ARN for Lambda@Edge","Convert the function to a CloudFront Functions equivalent if the logic runs at edge and does not need Lambda","Move the whole SST app/stack region to us-east-1 if edge lambdas are central"],"exampleFix":"// before\nnew sst.aws.Function(\"MyFn\", { region: \"eu-west-1\", handler: \"src/edge.handler\" })\n// after\nnew sst.aws.Function(\"MyFn\", { region: \"us-east-1\", handler: \"src/edge.handler\" })","handlingStrategy":"validation","validationCode":"function assertUsEast1Arn(arn: string) {\n  const region = arn.split(\":\")[3];\n  if (region !== \"us-east-1\") throw new Error(`Lambda@Edge requires us-east-1, got ${region}`);\n}","typeGuard":"const isUsEast1Arn = (arn: string) => arn.split(\":\")[3] === \"us-east-1\";","tryCatchPattern":null,"preventionTips":["Pin edge lambdas to us-east-1 in config","Add a CI check asserting region field of edge ARNs","Prefer SST's edge:true option which enforces this"],"tags":["lambda-edge","cloudfront","region","arn"],"backgroundTag":"lambda-edge-wrong-region","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}