remotion-dev/remotion · error · Error

Unknown AWS Caller Identity ARN detected

Error message

Unknown AWS Caller Identity ARN detected

What it means

simulatePermissions() parses the caller identity ARN with a regex expecting the format arn:aws:<partition>::<accountId>:<type>... If the ARN does not match this pattern at all, Remotion cannot extract the account ID and principal type needed to simulate permissions and throws this error. This is an unexpected ARN shape from STS.

Source

Thrown at packages/lambda/src/api/iam-validation/simulate.ts:51

 * @see [Documentation](https://remotion.dev/docs/lambda/simulatepermissions)
 */
export const simulatePermissions = async (
	options: SimulatePermissionsInput,
): Promise<SimulatePermissionsOutput> => {
	const callerIdentity = await LambdaClientInternals.getStsClient(
		options.region,
		options.requestHandler,
	).send(new GetCallerIdentityCommand({}));

	if (!callerIdentity?.Arn) {
		throw new Error('No valid AWS Caller Identity detected');
	}

	const callerIdentityArnComponents = callerIdentity.Arn.match(
		/arn:aws:([^:]+)::(\d+):([^/]+)(.*)/,
	);
	if (!callerIdentityArnComponents) {
		throw new Error('Unknown AWS Caller Identity ARN detected');
	}

	const callerIdentityArnType = callerIdentityArnComponents[1];

	let callerArn;
	if (
		callerIdentityArnType === 'iam' &&
		callerIdentityArnComponents[3] === 'user'
	) {
		callerArn = callerIdentity.Arn as string;
	} else if (
		callerIdentityArnType === 'sts' &&
		callerIdentityArnComponents[3] === 'assumed-role'
	) {
		const assumedRoleComponents =
			callerIdentityArnComponents[4].match(/\/([^/]+)\/(.*)/);
		if (!assumedRoleComponents) {
			throw new Error(

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. If using a non-standard partition (GovCloud, China), check whether simulatePermissions() supports it — this may require a Remotion update.
2. Verify the ARN returned by aws sts get-caller-identity matches the expected arn:aws:... format.
3. Report the ARN format to Remotion maintainers if it is a legitimate AWS partition that should be supported.

const AWS_PARTITION_ARN = /^arn:aws:[^:]+::\d+:[^/]+.*$/;

function isValidStandardAwsArn(arn: string | undefined): boolean {
  return Boolean(arn && AWS_PARTITION_ARN.test(arn));
}

// Before simulatePermissions():
const identity = await stsClient.send(new GetCallerIdentityCommand({}));
if (!isValidStandardAwsArn(identity.Arn)) {
  throw new Error(
    `Caller identity ARN uses an unsupported partition/format: ${identity.Arn}. simulatePermissions() currently supports the 'aws' partition only.`
  );
}

When it happens

Trigger: GetCallerIdentity returns an Arn that does not match the regex /arn:aws:([^:]+)::(\d+):([^/]+)(.*)/ — for example, an ARN with a non-standard partition (aws-cn, aws-us-gov) that the regex's literal 'aws:' prefix does not match, or a malformed ARN.

Common situations: Using AWS GovCloud (aws-us-gov partition) or AWS China (aws-cn partition) where the ARN starts with arn:aws-us-gov: or arn:aws-cn: instead of arn:aws:; a non-standard STS endpoint returning an unexpected ARN format.

Related errors

• Unsupported AWS Caller Identity as Assumed-Role ARN detected
• No valid AWS Caller Identity detected
• Unsupported AWS Caller Identity ARN detected
• Cannot get account ID
• UnrecognizedClientException: The AWS credentials provided we

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/f38e8f54d5588a69. Report an issue: GitHub.