{"record":{"id":"8d96103d3852c961","repo":"remotion-dev/remotion","slug":"unsupported-aws-caller-identity-arn-detected","errorCode":null,"errorMessage":"Unsupported AWS Caller Identity ARN detected","messagePattern":"Unsupported AWS Caller Identity ARN detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda/src/api/iam-validation/simulate.ts","lineNumber":76,"sourceCode":"\t\tcallerIdentityArnType === 'iam' &&\n\t\tcallerIdentityArnComponents[3] === 'user'\n\t) {\n\t\tcallerArn = callerIdentity.Arn as string;\n\t} else if (\n\t\tcallerIdentityArnType === 'sts' &&\n\t\tcallerIdentityArnComponents[3] === 'assumed-role'\n\t) {\n\t\tconst assumedRoleComponents =\n\t\t\tcallerIdentityArnComponents[4].match(/\\/([^/]+)\\/(.*)/);\n\t\tif (!assumedRoleComponents) {\n\t\t\tthrow new Error(\n\t\t\t\t'Unsupported AWS Caller Identity as Assumed-Role ARN detected',\n\t\t\t);\n\t\t}\n\n\t\tcallerArn = `arn:aws:iam::${callerIdentityArnComponents[2]}:role/${assumedRoleComponents[1]}`;\n\t} else {\n\t\tthrow new Error('Unsupported AWS Caller Identity ARN detected');\n\t}\n\n\tconst results: SimulationResult[] = [];\n\n\tfor (const per of requiredPermissions) {\n\t\tconst result = await simulateRule({\n\t\t\tactionNames: per.actions,\n\t\t\tarn: callerArn,\n\t\t\tregion: options.region,\n\t\t\tresource: per.resource,\n\t\t\tretries: 2,\n\t\t\trequestHandler: options.requestHandler,\n\t\t});\n\t\tfor (const res of result) {\n\t\t\tresults.push(res);\n\t\t\toptions.onSimulation?.(res);\n\t\t}\n\t}","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda/src/api/iam-validation/simulate.ts#L58-L94","documentation":"After parsing the caller identity ARN type, simulatePermissions() only supports two principal types: an IAM user (partition type 'iam' with subtype 'user') and an STS assumed-role (partition type 'sts' with subtype 'assumed-role'). If the caller identity is neither — for example a role principal, federated user, or service role — Remotion throws this error because it cannot determine the correct role ARN to simulate permissions against.","triggerScenarios":"The GetCallerIdentity ARN's type/subtype does not match iam/user or sts/assumed-role. Examples: arn:aws:sts::<acct>:assumed-role with a different subtype, an IAM role principal (arn:aws:iam::<acct>:role/...), or a web-identity/federated principal.","commonSituations":"Running Remotion Lambda permission simulation from within an EC2 instance with an instance profile role (whose caller identity may resolve differently); using a web identity or SAML federation; running inside a container task role that presents an unexpected principal type.","solutions":["Run simulatePermissions() from a context that uses a standard IAM user or assumed-role principal (e.g. an IAM user with access keys).","If running inside an EC2/instance profile, try assuming a role explicitly first so the caller identity is an assumed-role.","Report the principal type to Remotion maintainers if it is a common deployment pattern that should be supported."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const SUPPORTED_PRINCIPAL = /arn:aws:(iam):.*:(user)\\/|^arn:aws:(sts):.*:(assumed-role)\\//;\n\nfunction isSupportedCallerPrincipal(arn: string): boolean {\n  if (arn.startsWith('arn:aws:iam::') && arn.includes(':user/')) return true;\n  if (arn.startsWith('arn:aws:sts::') && arn.includes(':assumed-role/')) return true;\n  return false;\n}\n\n// Verify principal type before simulatePermissions():\nif (!isSupportedCallerPrincipal(identity.Arn)) {\n  throw new Error('Caller principal type is not supported by simulatePermissions(). Use an IAM user or assumed-role.');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run simulatePermissions() from an IAM user or assumed-role context for best compatibility.","Be aware that instance profile roles, federated, and web-identity principals are not supported.","If running inside EC2/ECS, explicitly assume a role so the caller identity is an assumed-role."],"tags":["lambda","aws","iam","sts","principal","iam-validation"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}