{"record":{"id":"a44fa73a6428d895","repo":"remotion-dev/remotion","slug":"unsupported-aws-caller-identity-as-assumed-role-ar","errorCode":null,"errorMessage":"Unsupported AWS Caller Identity as Assumed-Role ARN detected","messagePattern":"Unsupported AWS Caller Identity as Assumed-Role ARN detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda/src/api/iam-validation/simulate.ts","lineNumber":69,"sourceCode":"\t\tthrow new Error('Unknown AWS Caller Identity ARN detected');\n\t}\n\n\tconst callerIdentityArnType = callerIdentityArnComponents[1];\n\n\tlet callerArn;\n\tif (\n\t\tcallerIdentityArnType === 'iam' &&\n\t\tcallerIdentityArnComponents[3] === 'user'\n\t) {\n\t\tcallerArn = callerIdentity.Arn as string;\n\t} else if (\n\t\tcallerIdentityArnType === 'sts' &&\n\t\tcallerIdentityArnComponents[3] === 'assumed-role'\n\t) {\n\t\tconst assumedRoleComponents =\n\t\t\tcallerIdentityArnComponents[4].match(/\\/([^/]+)\\/(.*)/);\n\t\tif (!assumedRoleComponents) {\n\t\t\tthrow new Error(\n\t\t\t\t'Unsupported AWS Caller Identity as Assumed-Role ARN detected',\n\t\t\t);\n\t\t}\n\n\t\tcallerArn = `arn:aws:iam::${callerIdentityArnComponents[2]}:role/${assumedRoleComponents[1]}`;\n\t} else {\n\t\tthrow new Error('Unsupported AWS Caller Identity ARN detected');\n\t}\n\n\tconst results: SimulationResult[] = [];\n\n\tfor (const per of requiredPermissions) {\n\t\tconst result = await simulateRule({\n\t\t\tactionNames: per.actions,\n\t\t\tarn: callerArn,\n\t\t\tregion: options.region,\n\t\t\tresource: per.resource,\n\t\t\tretries: 2,","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda/src/api/iam-validation/simulate.ts#L51-L87","documentation":"When the caller identity is an STS assumed-role, simulatePermissions() extracts the role name from the ARN by matching /\\/([^/]+)\\/(.*)/ against the session path portion. If this sub-match fails (the assumed-role ARN does not contain the expected /role-name/session-id structure), Remotion throws this error. The extracted role name is needed to construct the role ARN for permission simulation.","triggerScenarios":"GetCallerIdentity returns an assumed-role ARN whose session portion does not match /role-name/session-id — for example, an assumed-role with a session name containing unusual characters or a non-standard path structure that breaks the regex.","commonSituations":"Using assumed-role credentials where the role path or session name is empty or has an unexpected format; a custom STS setup that modifies the session name; an assumed-role via a permission boundary that alters the ARN structure.","solutions":["Inspect the ARN returned by aws sts get-caller-identity and verify it has the form arn:aws:sts::<accountId>:assumed-role/<role-name>/<session-name>.","If the role session name is empty or unusual, re-assume the role with a standard session name.","Report the specific ARN format to Remotion maintainers if it appears to be a valid AWS pattern."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const ASSUMED_ROLE_SESSION = /\\/([^/]+)\\/(.*)/;\n\nfunction isValidAssumedRoleArn(arn: string): boolean {\n  const match = arn.match(/^arn:aws:sts::\\d+:assumed-role(.*)$/);\n  if (!match) return false;\n  return ASSUMED_ROLE_SESSION.test(match[1]);\n}\n\n// Check before calling simulatePermissions() if using an assumed role.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When assuming a role, use a standard session name to ensure the ARN parses correctly.","Inspect the assumed-role ARN via aws sts get-caller-identity before running simulatePermissions().","Avoid empty or unusual session names that may break the regex."],"tags":["lambda","aws","iam","sts","arn","assumed-role","iam-validation"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}