{"record":{"id":"5cd811ac3048539a","repo":"remotion-dev/remotion","slug":"could-not-list-s3-buckets-w","errorCode":null,"errorMessage":"could not list S3 buckets: %w","messagePattern":"could not list S3 buckets: %w","errorType":"exception","errorClass":"error","httpStatus":null,"severity":"error","filePath":"packages/lambda-go/s3.go","lineNumber":97,"sourceCode":"// isBucketInRegion reports whether the given bucket lives in region.\nfunc isBucketInRegion(svc bucketLocationGetter, bucket string, region string) (bool, error) {\n\tout, err := svc.GetBucketLocation(context.TODO(), &s3.GetBucketLocationInput{Bucket: new(bucket)})\n\tif err != nil {\n\t\tvar awsErr smithy.APIError\n\t\tif errors.As(err, &awsErr) && awsErr.ErrorCode() == \"NoSuchBucket\" {\n\t\t\treturn false, nil\n\t\t}\n\t\treturn false, fmt.Errorf(\"could not get location of S3 bucket %q: %w\", bucket, err)\n\t}\n\tlocation := string(out.LocationConstraint)\n\treturn location == region || (location == \"\" && region == regionUsEast1), nil\n}\n\n// getRemotionBuckets lists the Remotion buckets that exist in region.\nfunc getRemotionBuckets(svc *s3.Client, region string) ([]string, error) {\n\tout, err := svc.ListBuckets(context.TODO(), &s3.ListBucketsInput{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not list S3 buckets: %w\", err)\n\t}\n\tbuckets := []string{}\n\tfor _, bucket := range out.Buckets {\n\t\tname := aws.ToString(bucket.Name)\n\t\tif !strings.HasPrefix(name, bucketNamePrefix) {\n\t\t\tcontinue\n\t\t}\n\t\tisInRegion, err := isBucketInRegion(svc, name, region)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif isInRegion {\n\t\t\tbuckets = append(buckets, name)\n\t\t}\n\t}\n\treturn buckets, nil\n}\n","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-go/s3.go#L79-L115","documentation":"Thrown by getRemotionBuckets when ListBuckets fails. ListBuckets is the very first S3 call the bucket-resolution logic makes; if the caller cannot list buckets at all, no Remotion bucket can be discovered or created. The wrapped error is usually AccessDenied or a regional endpoint problem.","triggerScenarios":"svc.ListBuckets returns an error because the IAM principal lacks s3:ListAllMyBuckets, because the region endpoint is misconfigured, or because of a network failure reaching the S3 control plane.","commonSituations":"Scoped-down IAM roles in production that only allow specific bucket ARNs and forget the global list permission. Air-gapped or VPC-only networks without an S3 VPC endpoint.","solutions":["Add `s3:ListAllMyBuckets` to the IAM policy on `*`.","Verify the region in the AWS config resolves to a valid S3 endpoint.","From a VPC-only subnet, add an S3 gateway endpoint so ListBuckets can reach the control plane.","Inspect the wrapped error code to distinguish AccessDenied from network/endpoint issues."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"buckets, err := getRemotionBuckets(svc, region)\nif err != nil {\n    var awsErr smithy.APIError\n    if errors.As(err, &awsErr) && awsErr.ErrorCode() == \"AccessDenied\" {\n        // missing s3:ListAllMyBuckets - widen the policy\n    }\n    return nil, err\n}","preventionTips":["Always grant s3:ListAllMyBuckets on `*` in roles that drive Remotion renders.","From a VPC-only subnet, add an S3 gateway endpoint.","Use the same role for a dry-run ListBuckets as a preflight check."],"tags":["aws","s3","iam","bucket","go","lambda-go"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}