{"record":{"id":"a76f5322e9c74508","repo":"remotion-dev/remotion","slug":"no-valid-aws-caller-identity-detected","errorCode":null,"errorMessage":"No valid AWS Caller Identity detected","messagePattern":"No valid AWS Caller Identity detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda/src/api/iam-validation/simulate.ts","lineNumber":44,"sourceCode":"\nexport type SimulatePermissionsOutput = {\n\tresults: SimulationResult[];\n};\n\n/*\n * @description Simulates calls using the AWS Simulator to validate the correct permissions.\n * @see [Documentation](https://remotion.dev/docs/lambda/simulatepermissions)\n */\nexport const simulatePermissions = async (\n\toptions: SimulatePermissionsInput,\n): Promise<SimulatePermissionsOutput> => {\n\tconst callerIdentity = await LambdaClientInternals.getStsClient(\n\t\toptions.region,\n\t\toptions.requestHandler,\n\t).send(new GetCallerIdentityCommand({}));\n\n\tif (!callerIdentity?.Arn) {\n\t\tthrow new Error('No valid AWS Caller Identity detected');\n\t}\n\n\tconst callerIdentityArnComponents = callerIdentity.Arn.match(\n\t\t/arn:aws:([^:]+)::(\\d+):([^/]+)(.*)/,\n\t);\n\tif (!callerIdentityArnComponents) {\n\t\tthrow new Error('Unknown AWS Caller Identity ARN detected');\n\t}\n\n\tconst callerIdentityArnType = callerIdentityArnComponents[1];\n\n\tlet callerArn;\n\tif (\n\t\tcallerIdentityArnType === 'iam' &&\n\t\tcallerIdentityArnComponents[3] === 'user'\n\t) {\n\t\tcallerArn = callerIdentity.Arn as string;\n\t} else if (","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda/src/api/iam-validation/simulate.ts#L26-L62","documentation":"simulatePermissions() calls AWS STS GetCallerIdentity to determine the current principal. If the response has no Arn field, Remotion cannot determine which IAM entity to simulate permissions for and throws this error. This typically means the AWS credentials are invalid, expired, or not configured at all.","triggerScenarios":"Calling simulatePermissions({region, ...}) when the AWS SDK cannot establish a valid caller identity — no credentials configured, expired temporary credentials, wrong profile, or a misconfigured credential provider chain.","commonSituations":"AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars not set or expired session token; wrong AWS profile selected; running in an environment without IAM role attached (e.g. local dev without configured credentials); credentials have been revoked.","solutions":["Verify AWS credentials are configured: run aws sts get-caller-identity in a terminal and confirm it returns a valid ARN.","Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN if using temporary credentials) environment variables, or configure the correct AWS profile.","If using AWS SSO, run aws sso login to refresh credentials before running simulatePermissions().","Check that the region passed to simulatePermissions() matches a region where your credentials are valid."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import {STSClient, GetCallerIdentityCommand} from '@aws-sdk/client-sts';\n\nasync function assertAwsCredentialsValid(region: string): Promise<void> {\n  const client = new STSClient({region});\n  const response = await client.send(new GetCallerIdentityCommand({}));\n  if (!response.Arn) {\n    throw new Error('AWS credentials are not configured or are invalid.');\n  }\n}\n\nawait assertAwsCredentialsValid(region);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run aws sts get-caller-identity before calling simulatePermissions() to verify credentials.","Ensure AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN) env vars are set.","Refresh AWS SSO or temporary credentials before they expire.","Use the correct AWS profile if multiple profiles are configured."],"tags":["lambda","aws","iam","sts","credentials","authentication","iam-validation"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}