remotion-dev/remotion · error · Error

No valid AWS Caller Identity detected

Error message

No valid AWS Caller Identity detected

What it means

simulatePermissions() calls AWS STS GetCallerIdentity to determine the current principal. If the response has no Arn field, Remotion cannot determine which IAM entity to simulate permissions for and throws this error. This typically means the AWS credentials are invalid, expired, or not configured at all.

Source

Thrown at packages/lambda/src/api/iam-validation/simulate.ts:44

export type SimulatePermissionsOutput = {
	results: SimulationResult[];
};

/*
 * @description Simulates calls using the AWS Simulator to validate the correct permissions.
 * @see [Documentation](https://remotion.dev/docs/lambda/simulatepermissions)
 */
export const simulatePermissions = async (
	options: SimulatePermissionsInput,
): Promise<SimulatePermissionsOutput> => {
	const callerIdentity = await LambdaClientInternals.getStsClient(
		options.region,
		options.requestHandler,
	).send(new GetCallerIdentityCommand({}));

	if (!callerIdentity?.Arn) {
		throw new Error('No valid AWS Caller Identity detected');
	}

	const callerIdentityArnComponents = callerIdentity.Arn.match(
		/arn:aws:([^:]+)::(\d+):([^/]+)(.*)/,
	);
	if (!callerIdentityArnComponents) {
		throw new Error('Unknown AWS Caller Identity ARN detected');
	}

	const callerIdentityArnType = callerIdentityArnComponents[1];

	let callerArn;
	if (
		callerIdentityArnType === 'iam' &&
		callerIdentityArnComponents[3] === 'user'
	) {
		callerArn = callerIdentity.Arn as string;
	} else if (

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Verify AWS credentials are configured: run aws sts get-caller-identity in a terminal and confirm it returns a valid ARN.
2. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN if using temporary credentials) environment variables, or configure the correct AWS profile.
3. If using AWS SSO, run aws sso login to refresh credentials before running simulatePermissions().
4. Check that the region passed to simulatePermissions() matches a region where your credentials are valid.

import {STSClient, GetCallerIdentityCommand} from '@aws-sdk/client-sts';

async function assertAwsCredentialsValid(region: string): Promise<void> {
  const client = new STSClient({region});
  const response = await client.send(new GetCallerIdentityCommand({}));
  if (!response.Arn) {
    throw new Error('AWS credentials are not configured or are invalid.');
  }
}

await assertAwsCredentialsValid(region);

When it happens

Trigger: Calling simulatePermissions({region, ...}) when the AWS SDK cannot establish a valid caller identity — no credentials configured, expired temporary credentials, wrong profile, or a misconfigured credential provider chain.

Common situations: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars not set or expired session token; wrong AWS profile selected; running in an environment without IAM role attached (e.g. local dev without configured credentials); credentials have been revoked.

Related errors

• Unknown AWS Caller Identity ARN detected
• Unsupported AWS Caller Identity as Assumed-Role ARN detected
• Unsupported AWS Caller Identity ARN detected
• UnrecognizedClientException: The AWS credentials provided we
• UnrecognizedClientException: The AWS credentials provided we

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/a76f5322e9c74508. Report an issue: GitHub.