remotion-dev/remotion · error · Error

AWS Caller Identity partition ${callerPartition} does not ma

Error message

AWS Caller Identity partition ${callerPartition} does not match region ${region}, which uses partition ${regionPartition}.

What it means

Remotion Lambda's policy simulation derives from your STS caller identity, but only inside the same AWS partition as the region you target (aws, aws-cn, aws-us-gov). This error fires when the partition embedded in your caller identity ARN differs from the partition that the configured region belongs to - e.g. China-partition credentials used with a global region, or GovCloud credentials with a commercial region.

Source

Thrown at packages/lambda/src/api/iam-validation/resolve-caller-arn.ts:21

export const resolveCallerArnForSimulation = ({
	callerIdentityArn,
	region,
	regionPartition,
}: {
	callerIdentityArn: string;
	region: AwsRegion;
	regionPartition: AwsPartition;
}): string => {
	const components = callerIdentityArn.match(
		/^arn:([^:]+):([^:]+)::(\d+):([^/]+)(.*)$/,
	);
	if (!components) {
		throw new Error('Unknown AWS Caller Identity ARN detected');
	}

	const callerPartition = components[1];
	if (callerPartition !== regionPartition) {
		throw new Error(
			`AWS Caller Identity partition ${callerPartition} does not match region ${region}, which uses partition ${regionPartition}.`,
		);
	}

	const service = components[2];
	const accountId = components[3];
	const resourceType = components[4];
	if (service === 'iam' && resourceType === 'user') {
		return callerIdentityArn;
	}

	if (service === 'sts' && resourceType === 'assumed-role') {
		const assumedRoleComponents = components[5].match(/^\/([^/]+)\/(.*)$/);
		if (!assumedRoleComponents) {
			throw new Error(
				'Unsupported AWS Caller Identity as Assumed-Role ARN detected',
			);
		}

View on GitHub (pinned to 10db9de073)

Solutions

1. Align region and credentials: export AWS_REGION/AWS_DEFAULT_REGION to a region in the SAME partition as your credentials (e.g. cn-north-1 for aws-cn identities)
2. Switch the active profile to one whose credentials belong to the target region's partition: `export AWS_PROFILE=china-profile`
3. Verify with `aws sts get-caller-identity` which partition you are actually authenticated as, then reconcile with your configured region
4. Double-check for stray AWS_REGION/AWS_DEFAULT_REGION/AWS_PARTITION variables in your environment or .env files

Example fix

# before - China credentials, global region
export AWS_PROFILE=china-account
export AWS_REGION=eu-central-1
npx remotion lambda policies validate  # partition mismatch

# after - region matches the credentials' partition
export AWS_PROFILE=china-account
export AWS_REGION=cn-north-1
npx remotion lambda policies validate

// Assert credentials partition matches the target region before running
import {STKClient, GetCallerIdentityCommand} from '@aws-sdk/client-sts';

const PARTITION_BY_REGION_PREFIX: Record<string, string> = {
  cn: 'aws-cn',
  'us-gov': 'aws-us-gov',
  'us-iso': 'aws-iso',
  'us-isob': 'aws-iso-b',
};
const partitionOf = (region: string): string => {
  const prefix = Object.keys(PARTITION_BY_REGION_PREFIX).find((p) =>
    region.startsWith(p),
  );
  return prefix ? PARTITION_BY_REGION_PREFIX[prefix] : 'aws';
};

const {Arn} = await sts.send(new GetCallerIdentityCommand({}));
const callerPartition = Arn?.split(':')[1] ?? '';
if (callerPartition !== partitionOf(process.env.AWS_REGION!)) {
  throw new Error(
    `Credentials partition ${callerPartition} does not match region partition ${partitionOf(process.env.AWS_REGION!)}`,
  );
}

When it happens

Trigger: Running a Remotion Lambda command that triggers IAM simulation (e.g. `npx remotion lambda policies validate`) where the active credentials' partition (from STS GetCallerIdentity) mismatches the partition of the region the CLI is configured for - like AWS_REGION=eu-central-1 with an aws-cn identity, or us-gov-west-1 with commercial credentials (packages/lambda/src/api/iam-validation/resolve-caller-arn.ts:19-24).

Common situations: Multiple AWS accounts across partitions (global + China, or commercial + GovCloud) with the wrong AWS_PROFILE/AWS_REGION exported; CI runners with partition-mismatched injected credentials; copy-pasted region strings from docs.

Related errors

• UnrecognizedClientException: The AWS credentials provided we
• UnrecognizedClientException: The AWS credentials provided we
• Unknown AWS Caller Identity ARN detected
• Unsupported AWS Caller Identity as Assumed-Role ARN detected
• No valid AWS Caller Identity detected

AI-assisted analysis of remotion-dev/remotion@10db9de073 (2026-08-22). Data as JSON: /api/errors/cd4041e5fc01230a. Report an issue: GitHub.