remotion-dev/remotion · error · Error

You don't have the required permissions to delete lifecycle

Error message

You don't have the required permissions to delete lifecycle rules on the bucket "${bucketName}", but the "enableFolderExpiry" option was set to "false". Ensure that your user has the "s3:PutLifecycleConfiguration" permission. Set "enableFolderExpiry" to "null" to not overwrite any existing lifecycle rules.

What it means

Thrown when applyLifeCyleOperation tries to DELETE the bucket's lifecycle configuration (because enableFolderExpiry was explicitly set to false) and S3 responds with AccessDenied. Deleting lifecycle rules requires the s3:PutLifecycleConfiguration IAM permission, not just read access. The error is a deliberate re-throw that translates the raw AccessDenied into actionable guidance.

Source

Thrown at packages/lambda-client/src/lifecycle-rules.ts:76

	bucketName: string;
	region: AwsRegion;
	customCredentials: CustomCredentials<AwsProvider> | null;
	forcePathStyle: boolean;
	requestHandler: RequestHandler | null;
}) => {
	const deleteCommandInput = deleteLifeCycleInput({
		bucketName,
	});
	try {
		await getS3Client({
			region,
			customCredentials,
			forcePathStyle,
			requestHandler,
		}).send(new DeleteBucketLifecycleCommand(deleteCommandInput));
	} catch (err) {
		if ((err as Error).stack?.includes('AccessDenied')) {
			throw new Error(
				`You don't have the required permissions to delete lifecycle rules on the bucket "${bucketName}", but the "enableFolderExpiry" option was set to "false". Ensure that your user has the "s3:PutLifecycleConfiguration" permission. Set "enableFolderExpiry" to "null" to not overwrite any existing lifecycle rules.`,
			);
		}
	}
};

export async function applyLifeCyleOperation({
	enableFolderExpiry,
	bucketName,
	region,
	customCredentials,
	forcePathStyle,
	requestHandler,
}: {
	enableFolderExpiry: boolean | null;
	bucketName: string;
	region: AwsRegion;
	customCredentials: CustomCredentials<AwsProvider> | null;

View on GitHub (pinned to 78fe4bb3fd)

Solutions

Set enableFolderExpiry to null instead of false to skip lifecycle rule overwrites entirely.
Add the s3:PutLifecycleConfiguration permission to the IAM user/role running the operation (on the specific bucket ARN).
Run the lifecycle cleanup once with a privileged admin role, then return to the restricted role with enableFolderExpiry=null.
Verify the bucket name is correct and belongs to the account whose credentials you are using.

Example fix

// before
await renderMediaOnLambda({ ...opts, enableFolderExpiry: false });

// after (skip lifecycle overwrites)
await renderMediaOnLambda({ ...opts, enableFolderExpiry: null });

// or grant IAM:
// { Effect: 'Allow', Action: 's3:PutLifecycleConfiguration', Resource: 'arn:aws:s3:::YOUR-BUCKET' }

Defensive patterns

Strategy: validation

Validate before calling

// Decide enableFolderExpiry based on the IAM capabilities of the runtime role
const canManageLifecycle = await hasPermission('s3:PutLifecycleConfiguration');
const enableFolderExpiry = canManageLifecycle ? false : null; // null = do not touch

Try / catch

try {
  await renderMediaOnLambda({ ...opts, enableFolderExpiry: false });
} catch (e) {
  if (e instanceof Error && /s3:PutLifecycleConfiguration/.test(e.message)) {
    // retry without overwriting lifecycle rules
    await renderMediaOnLambda({ ...opts, enableFolderExpiry: null });
  } else { throw e; }
}

Prevention

Audit your IAM policy for s3:PutLifecycleConfiguration before setting enableFolderExpiry to false.
Prefer enableFolderExpiry=null in CI roles that should not mutate bucket configuration.
Document which roles are allowed to manage lifecycle rules.

When it happens

Trigger: Calling any code path that invokes applyLifeCyleOperation with enableFolderExpiry===false while the configured AWS credentials lack s3:PutLifecycleConfiguration. The delete is attempted via DeleteBucketLifecycleCommand; when err.stack contains 'AccessDenied', this message replaces it.

Common situations: Minimal IAM policies used for cost-sensitive deployments; CI roles scoped to only what rendering needs; using a read-only or render-only role when calling deploySite/deployFunction that also normalizes lifecycle rules; switching enableFolderExpiry from null/true to false to clean up rules.

Related errors

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/927cd4ff0f82b811. Report an issue: GitHub.