remotion-dev/remotion · error · Error

Unsupported AWS Caller Identity as Assumed-Role ARN detected

Error message

Unsupported AWS Caller Identity as Assumed-Role ARN detected

What it means

When the caller identity is an STS assumed-role, simulatePermissions() extracts the role name from the ARN by matching /\/([^/]+)\/(.*)/ against the session path portion. If this sub-match fails (the assumed-role ARN does not contain the expected /role-name/session-id structure), Remotion throws this error. The extracted role name is needed to construct the role ARN for permission simulation.

Source

Thrown at packages/lambda/src/api/iam-validation/simulate.ts:69

		throw new Error('Unknown AWS Caller Identity ARN detected');
	}

	const callerIdentityArnType = callerIdentityArnComponents[1];

	let callerArn;
	if (
		callerIdentityArnType === 'iam' &&
		callerIdentityArnComponents[3] === 'user'
	) {
		callerArn = callerIdentity.Arn as string;
	} else if (
		callerIdentityArnType === 'sts' &&
		callerIdentityArnComponents[3] === 'assumed-role'
	) {
		const assumedRoleComponents =
			callerIdentityArnComponents[4].match(/\/([^/]+)\/(.*)/);
		if (!assumedRoleComponents) {
			throw new Error(
				'Unsupported AWS Caller Identity as Assumed-Role ARN detected',
			);
		}

		callerArn = `arn:aws:iam::${callerIdentityArnComponents[2]}:role/${assumedRoleComponents[1]}`;
	} else {
		throw new Error('Unsupported AWS Caller Identity ARN detected');
	}

	const results: SimulationResult[] = [];

	for (const per of requiredPermissions) {
		const result = await simulateRule({
			actionNames: per.actions,
			arn: callerArn,
			region: options.region,
			resource: per.resource,
			retries: 2,

View on GitHub (pinned to 78fe4bb3fd)

Solutions

Inspect the ARN returned by aws sts get-caller-identity and verify it has the form arn:aws:sts::<accountId>:assumed-role/<role-name>/<session-name>.
If the role session name is empty or unusual, re-assume the role with a standard session name.
Report the specific ARN format to Remotion maintainers if it appears to be a valid AWS pattern.

Defensive patterns

Strategy: validation

Validate before calling

const ASSUMED_ROLE_SESSION = /\/([^/]+)\/(.*)/;

function isValidAssumedRoleArn(arn: string): boolean {
  const match = arn.match(/^arn:aws:sts::\d+:assumed-role(.*)$/);
  if (!match) return false;
  return ASSUMED_ROLE_SESSION.test(match[1]);
}

// Check before calling simulatePermissions() if using an assumed role.

Prevention

When assuming a role, use a standard session name to ensure the ARN parses correctly.
Inspect the assumed-role ARN via aws sts get-caller-identity before running simulatePermissions().
Avoid empty or unusual session names that may break the regex.

When it happens

Trigger: GetCallerIdentity returns an assumed-role ARN whose session portion does not match /role-name/session-id — for example, an assumed-role with a session name containing unusual characters or a non-standard path structure that breaks the regex.

Common situations: Using assumed-role credentials where the role path or session name is empty or has an unexpected format; a custom STS setup that modifies the session name; an assumed-role via a permission boundary that alters the ARN structure.

Related errors

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/a44fa73a6428d895. Report an issue: GitHub.