{"record":{"id":"f38e8f54d5588a69","repo":"remotion-dev/remotion","slug":"unknown-aws-caller-identity-arn-detected","errorCode":null,"errorMessage":"Unknown AWS Caller Identity ARN detected","messagePattern":"Unknown AWS Caller Identity ARN detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda/src/api/iam-validation/simulate.ts","lineNumber":51,"sourceCode":" * @see [Documentation](https://remotion.dev/docs/lambda/simulatepermissions)\n */\nexport const simulatePermissions = async (\n\toptions: SimulatePermissionsInput,\n): Promise<SimulatePermissionsOutput> => {\n\tconst callerIdentity = await LambdaClientInternals.getStsClient(\n\t\toptions.region,\n\t\toptions.requestHandler,\n\t).send(new GetCallerIdentityCommand({}));\n\n\tif (!callerIdentity?.Arn) {\n\t\tthrow new Error('No valid AWS Caller Identity detected');\n\t}\n\n\tconst callerIdentityArnComponents = callerIdentity.Arn.match(\n\t\t/arn:aws:([^:]+)::(\\d+):([^/]+)(.*)/,\n\t);\n\tif (!callerIdentityArnComponents) {\n\t\tthrow new Error('Unknown AWS Caller Identity ARN detected');\n\t}\n\n\tconst callerIdentityArnType = callerIdentityArnComponents[1];\n\n\tlet callerArn;\n\tif (\n\t\tcallerIdentityArnType === 'iam' &&\n\t\tcallerIdentityArnComponents[3] === 'user'\n\t) {\n\t\tcallerArn = callerIdentity.Arn as string;\n\t} else if (\n\t\tcallerIdentityArnType === 'sts' &&\n\t\tcallerIdentityArnComponents[3] === 'assumed-role'\n\t) {\n\t\tconst assumedRoleComponents =\n\t\t\tcallerIdentityArnComponents[4].match(/\\/([^/]+)\\/(.*)/);\n\t\tif (!assumedRoleComponents) {\n\t\t\tthrow new Error(","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda/src/api/iam-validation/simulate.ts#L33-L69","documentation":"simulatePermissions() parses the caller identity ARN with a regex expecting the format arn:aws:<partition>::<accountId>:<type>... If the ARN does not match this pattern at all, Remotion cannot extract the account ID and principal type needed to simulate permissions and throws this error. This is an unexpected ARN shape from STS.","triggerScenarios":"GetCallerIdentity returns an Arn that does not match the regex /arn:aws:([^:]+)::(\\d+):([^/]+)(.*)/ — for example, an ARN with a non-standard partition (aws-cn, aws-us-gov) that the regex's literal 'aws:' prefix does not match, or a malformed ARN.","commonSituations":"Using AWS GovCloud (aws-us-gov partition) or AWS China (aws-cn partition) where the ARN starts with arn:aws-us-gov: or arn:aws-cn: instead of arn:aws:; a non-standard STS endpoint returning an unexpected ARN format.","solutions":["If using a non-standard partition (GovCloud, China), check whether simulatePermissions() supports it — this may require a Remotion update.","Verify the ARN returned by aws sts get-caller-identity matches the expected arn:aws:... format.","Report the ARN format to Remotion maintainers if it is a legitimate AWS partition that should be supported."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const AWS_PARTITION_ARN = /^arn:aws:[^:]+::\\d+:[^/]+.*$/;\n\nfunction isValidStandardAwsArn(arn: string | undefined): boolean {\n  return Boolean(arn && AWS_PARTITION_ARN.test(arn));\n}\n\n// Before simulatePermissions():\nconst identity = await stsClient.send(new GetCallerIdentityCommand({}));\nif (!isValidStandardAwsArn(identity.Arn)) {\n  throw new Error(\n    `Caller identity ARN uses an unsupported partition/format: ${identity.Arn}. simulatePermissions() currently supports the 'aws' partition only.`\n  );\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify your caller ARN matches the standard arn:aws:... format before running simulatePermissions().","Be aware that GovCloud (aws-us-gov) and China (aws-cn) partitions may not be supported by the ARN parser.","Run aws sts get-caller-identity to inspect the ARN shape before calling simulatePermissions()."],"tags":["lambda","aws","iam","sts","arn","iam-validation","partition"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}