{"record":{"id":"cd4041e5fc01230a","repo":"remotion-dev/remotion","slug":"aws-caller-identity-partition-callerpartition-d","errorCode":null,"errorMessage":"AWS Caller Identity partition ${callerPartition} does not match region ${region}, which uses partition ${regionPartition}.","messagePattern":"AWS Caller Identity partition (.+?) does not match region (.+?), which uses partition (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda/src/api/iam-validation/resolve-caller-arn.ts","lineNumber":21,"sourceCode":"export const resolveCallerArnForSimulation = ({\n\tcallerIdentityArn,\n\tregion,\n\tregionPartition,\n}: {\n\tcallerIdentityArn: string;\n\tregion: AwsRegion;\n\tregionPartition: AwsPartition;\n}): string => {\n\tconst components = callerIdentityArn.match(\n\t\t/^arn:([^:]+):([^:]+)::(\\d+):([^/]+)(.*)$/,\n\t);\n\tif (!components) {\n\t\tthrow new Error('Unknown AWS Caller Identity ARN detected');\n\t}\n\n\tconst callerPartition = components[1];\n\tif (callerPartition !== regionPartition) {\n\t\tthrow new Error(\n\t\t\t`AWS Caller Identity partition ${callerPartition} does not match region ${region}, which uses partition ${regionPartition}.`,\n\t\t);\n\t}\n\n\tconst service = components[2];\n\tconst accountId = components[3];\n\tconst resourceType = components[4];\n\tif (service === 'iam' && resourceType === 'user') {\n\t\treturn callerIdentityArn;\n\t}\n\n\tif (service === 'sts' && resourceType === 'assumed-role') {\n\t\tconst assumedRoleComponents = components[5].match(/^\\/([^/]+)\\/(.*)$/);\n\t\tif (!assumedRoleComponents) {\n\t\t\tthrow new Error(\n\t\t\t\t'Unsupported AWS Caller Identity as Assumed-Role ARN detected',\n\t\t\t);\n\t\t}","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/remotion-dev/remotion/blob/10db9de07356446fb0edb3c3ae211369b693d18b/packages/lambda/src/api/iam-validation/resolve-caller-arn.ts#L3-L39","documentation":"Remotion Lambda's policy simulation derives from your STS caller identity, but only inside the same AWS partition as the region you target (aws, aws-cn, aws-us-gov). This error fires when the partition embedded in your caller identity ARN differs from the partition that the configured region belongs to - e.g. China-partition credentials used with a global region, or GovCloud credentials with a commercial region.","triggerScenarios":"Running a Remotion Lambda command that triggers IAM simulation (e.g. `npx remotion lambda policies validate`) where the active credentials' partition (from STS GetCallerIdentity) mismatches the partition of the region the CLI is configured for - like AWS_REGION=eu-central-1 with an aws-cn identity, or us-gov-west-1 with commercial credentials (packages/lambda/src/api/iam-validation/resolve-caller-arn.ts:19-24).","commonSituations":"Multiple AWS accounts across partitions (global + China, or commercial + GovCloud) with the wrong AWS_PROFILE/AWS_REGION exported; CI runners with partition-mismatched injected credentials; copy-pasted region strings from docs.","solutions":["Align region and credentials: export AWS_REGION/AWS_DEFAULT_REGION to a region in the SAME partition as your credentials (e.g. cn-north-1 for aws-cn identities)","Switch the active profile to one whose credentials belong to the target region's partition: `export AWS_PROFILE=china-profile`","Verify with `aws sts get-caller-identity` which partition you are actually authenticated as, then reconcile with your configured region","Double-check for stray AWS_REGION/AWS_DEFAULT_REGION/AWS_PARTITION variables in your environment or .env files"],"exampleFix":"# before - China credentials, global region\nexport AWS_PROFILE=china-account\nexport AWS_REGION=eu-central-1\nnpx remotion lambda policies validate  # partition mismatch\n\n# after - region matches the credentials' partition\nexport AWS_PROFILE=china-account\nexport AWS_REGION=cn-north-1\nnpx remotion lambda policies validate","handlingStrategy":"validation","validationCode":"// Assert credentials partition matches the target region before running\nimport {STKClient, GetCallerIdentityCommand} from '@aws-sdk/client-sts';\n\nconst PARTITION_BY_REGION_PREFIX: Record<string, string> = {\n  cn: 'aws-cn',\n  'us-gov': 'aws-us-gov',\n  'us-iso': 'aws-iso',\n  'us-isob': 'aws-iso-b',\n};\nconst partitionOf = (region: string): string => {\n  const prefix = Object.keys(PARTITION_BY_REGION_PREFIX).find((p) =>\n    region.startsWith(p),\n  );\n  return prefix ? PARTITION_BY_REGION_PREFIX[prefix] : 'aws';\n};\n\nconst {Arn} = await sts.send(new GetCallerIdentityCommand({}));\nconst callerPartition = Arn?.split(':')[1] ?? '';\nif (callerPartition !== partitionOf(process.env.AWS_REGION!)) {\n  throw new Error(\n    `Credentials partition ${callerPartition} does not match region partition ${partitionOf(process.env.AWS_REGION!)}`,\n  );\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Derive AWS_REGION from the same profile that provides the credentials","Keep one partition per CI job; never mix global and China/GovCloud exports in one shell","Assert caller identity partition at job start with aws sts get-caller-identity"],"tags":["aws","partition","region","credentials","iam-validation","remotion","lambda"],"backgroundTag":"aws-region-partition-mismatch","analyzedSha":"10db9de07356446fb0edb3c3ae211369b693d18b","analyzedAt":"2026-08-22T21:45:17.748Z","contentChangedAt":"2026-08-22T21:45:17.748Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}