@remotion/lambda 4.0.508 → 4.0.510

package/dist/admin/make-layer-public.js

@@ -74,7 +74,7 @@ const makeLayerPublic = async () => {
     const skipRegions = parseSkipFlag();
     const regions = onlyRegion
         ? [onlyRegion]
-        : (0, get_regions_1.getRegions)().filter((r) => !skipRegions.includes(r));
+        : (0, get_regions_1.getRegions)().filter((r) => r in layerInfo && !skipRegions.includes(r));
     if (onlyRegion) {
         console.log(`Filtering to region: ${onlyRegion}`);
     }
@@ -82,6 +82,10 @@ const makeLayerPublic = async () => {
         console.log(`Skipping regions: ${skipRegions.join(', ')}`);
     }
     for (const region of regions) {
+        if (!(region in layerInfo)) {
+            throw new Error(`Remotion-hosted Layers are not supported in ${region}.`);
+        }
+        const hostedLayerRegion = region;
         for (const layer of layers) {
             const layerName = `remotion-binaries-${layer}-arm64`;
             const { Version, LayerArn } = await lambda_client_1.LambdaClientInternals.getLambdaClient(region, undefined, null).send(new client_lambda_1.PublishLayerVersionCommand({
@@ -109,16 +113,13 @@ const makeLayerPublic = async () => {
                 VersionNumber: Version,
                 StatementId: 'public-layer',
             }));
-            if (!layerInfo[region]) {
-                layerInfo[region] = [];
-            }
             if (!LayerArn) {
                 throw new Error('layerArn is null');
             }
             if (!Version) {
                 throw new Error('Version is null');
             }
-            layerInfo[region].push({
+            layerInfo[hostedLayerRegion].push({
                 layerArn: LayerArn,
                 version: Version,
             });

package/dist/api/create-function.d.ts

@@ -13,6 +13,7 @@ type CreateFunctionInput = {
     retentionInDays: number;
     ephemerealStorageInMb: number;
     customRoleArn: string;
+    customLayerArns: string[] | null;
     enableLambdaInsights: boolean;
     logLevel: LogLevel;
     vpcSubnetIds: string;
@@ -20,7 +21,7 @@ type CreateFunctionInput = {
     runtimePreference: RuntimePreference;
     requestHandler: RequestHandler | null;
 };
-export declare const createFunction: ({ createCloudWatchLogGroup, region, zipFile, functionName, accountId, memorySizeInMb, timeoutInSeconds, alreadyCreated, retentionInDays, ephemerealStorageInMb, customRoleArn, enableLambdaInsights, logLevel, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, requestHandler, }: CreateFunctionInput) => Promise<{
+export declare const createFunction: ({ createCloudWatchLogGroup, region, zipFile, functionName, accountId, memorySizeInMb, timeoutInSeconds, alreadyCreated, retentionInDays, ephemerealStorageInMb, customRoleArn, customLayerArns, enableLambdaInsights, logLevel, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, requestHandler, }: CreateFunctionInput) => Promise<{
     FunctionName: string;
 }>;
 export {};

package/dist/api/create-function.js

@@ -11,8 +11,9 @@ const version_1 = require("remotion/version");
 const get_layers_1 = require("../shared/get-layers");
 const lambda_insights_extensions_1 = require("../shared/lambda-insights-extensions");
 const suggested_policy_1 = require("./iam-validation/suggested-policy");
-const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, functionName, accountId, memorySizeInMb, timeoutInSeconds, alreadyCreated, retentionInDays, ephemerealStorageInMb, customRoleArn, enableLambdaInsights, logLevel, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, requestHandler, }) => {
-    var _a;
+const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, functionName, accountId, memorySizeInMb, timeoutInSeconds, alreadyCreated, retentionInDays, ephemerealStorageInMb, customRoleArn, customLayerArns, enableLambdaInsights, logLevel, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, requestHandler, }) => {
+    var _a, _b, _c;
+    var _d, _e, _f, _g;
     if (createCloudWatchLogGroup) {
         renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Creating CloudWatch group');
         try {
@@ -37,15 +38,52 @@ const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, funct
         }));
         renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, `Set retention to ${retentionInDays} days`);
     }
+    const insightsLayer = enableLambdaInsights
+        ? lambda_insights_extensions_1.lambdaInsightsExtensions[region]
+        : null;
+    if (enableLambdaInsights && !insightsLayer) {
+        throw new Error(`Lambda Insights is not supported by AWS in region ${region}. Please disable Lambda Insights. See http://remotion.dev/docs/lambda/insights#unsupported-regions`);
+    }
+    const layers = (customLayerArns !== null && customLayerArns !== void 0 ? customLayerArns : (0, get_layers_1.getLayers)({
+        option: runtimePreference,
+        region,
+    }).map(({ layerArn, version }) => `${layerArn}:${version}`)).concat(insightsLayer ? [insightsLayer] : []);
     if (alreadyCreated) {
         renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, `Function ${functionName} already existed`);
+        if (customLayerArns === null) {
+            return { FunctionName: functionName };
+        }
+        const lambdaClient = lambda_client_1.LambdaClientInternals.getLambdaClient(region, undefined, requestHandler);
+        const currentConfiguration = await lambdaClient.send(new client_lambda_1.GetFunctionConfigurationCommand({ FunctionName: functionName }));
+        const currentLayers = ((_d = currentConfiguration.Layers) !== null && _d !== void 0 ? _d : []).map((layer) => layer.Arn);
+        const layersAreEqual = currentLayers.length === layers.length &&
+            currentLayers.every((layer, index) => layer === layers[index]);
+        if (layersAreEqual) {
+            return { FunctionName: functionName };
+        }
+        renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, `Updating Layers for function ${functionName}`);
+        await lambdaClient.send(new client_lambda_1.UpdateFunctionConfigurationCommand({
+            FunctionName: functionName,
+            Layers: layers,
+        }));
+        while (true) {
+            const configuration = await lambdaClient.send(new client_lambda_1.GetFunctionConfigurationCommand({ FunctionName: functionName }));
+            if (configuration.State === 'Failed' ||
+                configuration.LastUpdateStatus === 'Failed') {
+                throw new Error(`Failed to update Layers for function ${functionName}: ${(_f = (_e = configuration.StateReason) !== null && _e !== void 0 ? _e : configuration.LastUpdateStatusReason) !== null && _f !== void 0 ? _f : 'Unknown reason'}`);
+            }
+            if (configuration.State === 'Active' &&
+                configuration.LastUpdateStatus !== 'InProgress') {
+                break;
+            }
+            await new Promise((resolve) => {
+                setTimeout(resolve, 1000);
+            });
+        }
         return { FunctionName: functionName };
     }
-    const defaultRoleName = `arn:aws:iam::${accountId}:role/${suggested_policy_1.ROLE_NAME}`;
-    const layers = (0, get_layers_1.getLayers)({
-        option: runtimePreference,
-        region,
-    });
+    const { partition } = lambda_client_1.LambdaClientInternals.getAwsRegionMetadata(region);
+    const defaultRoleName = `arn:${partition}:iam::${accountId}:role/${suggested_policy_1.ROLE_NAME}`;
     let vpcConfig;
     if (vpcSubnetIds && vpcSecurityGroupIds) {
         vpcConfig = {
@@ -54,12 +92,6 @@ const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, funct
         };
     }
     renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Deploying new Lambda function');
-    const insightsLayer = enableLambdaInsights
-        ? lambda_insights_extensions_1.lambdaInsightsExtensions[region]
-        : null;
-    if (enableLambdaInsights && !insightsLayer) {
-        throw new Error(`Lambda Insights is not supported by AWS in region ${region}. Please disable Lambda Insights. See http://remotion.dev/docs/lambda/insights#unsupported-regions`);
-    }
     const { FunctionName, FunctionArn } = await lambda_client_1.LambdaClientInternals.getLambdaClient(region, undefined, requestHandler).send(new client_lambda_1.CreateFunctionCommand({
         Code: {
             ZipFile: new Uint8Array((0, node_fs_1.readFileSync)(zipFile)),
@@ -71,9 +103,7 @@ const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, funct
         Description: 'Renders a Remotion video.',
         MemorySize: memorySizeInMb,
         Timeout: timeoutInSeconds,
-        Layers: layers
-            .map(({ layerArn, version }) => `${layerArn}:${version}`)
-            .concat(insightsLayer ? [insightsLayer] : []),
+        Layers: layers,
         Architectures: ['arm64'],
         EphemeralStorage: {
             Size: ephemerealStorageInMb,
@@ -110,6 +140,7 @@ const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, funct
     renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Set function retries to 0.');
     renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Waiting for the function to be ready...');
     let state = 'Pending';
+    let currentRuntimeVersionArn = null;
     while (state === 'Pending') {
         const getFn = await lambda_client_1.LambdaClientInternals.getLambdaClient(region, undefined, requestHandler).send(new client_lambda_1.GetFunctionCommand({
             FunctionName,
@@ -118,21 +149,27 @@ const createFunction = async ({ createCloudWatchLogGroup, region, zipFile, funct
             setTimeout(() => resolve(), 1000);
         });
         state = (_a = getFn.Configuration) === null || _a === void 0 ? void 0 : _a.State;
+        currentRuntimeVersionArn = (_g = (_c = (_b = getFn.Configuration) === null || _b === void 0 ? void 0 : _b.RuntimeVersionConfig) === null || _c === void 0 ? void 0 : _c.RuntimeVersionArn) !== null && _g !== void 0 ? _g : null;
     }
     renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Function is now ready.');
     renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, 'Locking the runtime version of the function...');
-    const RuntimeVersionArn = `arn:aws:lambda:${region}::runtime:58a37e8413ed69058c4ac3b1df642118591f17d40def93d6101f867c72cd03c2`;
+    const runtimeVersionArn = partition === 'aws-cn'
+        ? currentRuntimeVersionArn
+        : `arn:aws:lambda:${region}::runtime:58a37e8413ed69058c4ac3b1df642118591f17d40def93d6101f867c72cd03c2`;
     try {
+        if (!runtimeVersionArn) {
+            throw new Error('AWS did not return a runtime version ARN.');
+        }
         await lambda_client_1.LambdaClientInternals.getLambdaClient(region, undefined, requestHandler).send(new client_lambda_1.PutRuntimeManagementConfigCommand({
             FunctionName,
             UpdateRuntimeOn: 'Manual',
-            RuntimeVersionArn,
+            RuntimeVersionArn: runtimeVersionArn,
         }));
+        renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, `Function runtime is locked to ${runtimeVersionArn}`);
     }
-    catch (_b) {
+    catch (_h) {
         console.warn('⚠️ Could not lock the runtime version. We recommend to update your policies to prevent your functions from breaking in the future in case the AWS runtime changes. See https://remotion.dev/docs/lambda/feb-2023-incident for an example on how to update your policy.');
     }
-    renderer_1.RenderInternals.Log.verbose({ indent: false, logLevel }, `Function runtime is locked to ${RuntimeVersionArn}`);
     return { FunctionName: FunctionName };
 };
 exports.createFunction = createFunction;

package/dist/api/deploy-function.d.ts

@@ -20,16 +20,21 @@ type OptionalParameters = {
     runtimePreference: RuntimePreference;
     requestHandler: RequestHandler | null;
 };
-export type DeployFunctionInput = MandatoryParameters & Partial<OptionalParameters>;
+export type DeployFunctionInput = MandatoryParameters & Partial<OptionalParameters> & {
+    customLayerArns?: string[];
+};
 export type DeployFunctionOutput = {
     functionName: string;
     alreadyExisted: boolean;
 };
 export declare const internalDeployFunction: <Provider extends CloudProvider<string, Record<string, unknown>, Record<string, unknown>, string, object>>(params: MandatoryParameters & OptionalParameters & {
+    customLayerArns: string[] | null;
     providerSpecifics: ProviderSpecifics<Provider>;
     fullClientSpecifics: FullClientSpecifics<Provider>;
 }) => Promise<DeployFunctionOutput>;
-export declare const deployFunction: ({ createCloudWatchLogGroup, memorySizeInMb, region, timeoutInSeconds, cloudWatchLogRetentionPeriodInDays, customRoleArn, enableLambdaInsights, indent, logLevel, enableV5Runtime, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, diskSizeInMb, requestHandler, }: MandatoryParameters & Partial<OptionalParameters> & {
+export declare const deployFunction: ({ createCloudWatchLogGroup, memorySizeInMb, region, timeoutInSeconds, cloudWatchLogRetentionPeriodInDays, customRoleArn, customLayerArns, enableLambdaInsights, indent, logLevel, enableV5Runtime, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, diskSizeInMb, requestHandler, }: MandatoryParameters & Partial<OptionalParameters> & {
+    customLayerArns?: string[] | undefined;
+} & {
     enableV5Runtime?: boolean | undefined;
 }) => Promise<DeployFunctionOutput>;
 export {};

package/dist/api/deploy-function.js

@@ -8,6 +8,7 @@ const version_1 = require("remotion/version");
 const full_client_implementation_1 = require("../functions/full-client-implementation");
 const function_zip_path_1 = require("../shared/function-zip-path");
 const get_layers_1 = require("../shared/get-layers");
+const validate_custom_layer_arns_1 = require("../shared/validate-custom-layer-arns");
 const validate_custom_role_arn_1 = require("../shared/validate-custom-role-arn");
 const validate_retention_period_1 = require("../shared/validate-retention-period");
 const validate_timeout_1 = require("../shared/validate-timeout");
@@ -20,6 +21,12 @@ const internalDeployFunction = async (params) => {
     lambda_client_1.LambdaClientInternals.validateDiskSizeInMb(params.diskSizeInMb);
     (0, validate_custom_role_arn_1.validateCustomRoleArn)(params.customRoleArn);
     (0, get_layers_1.validateRuntimePreference)(params.runtimePreference);
+    (0, validate_custom_layer_arns_1.validateCustomLayerArns)({
+        customLayerArns: params.customLayerArns,
+        enableLambdaInsights: params.enableLambdaInsights,
+        region: params.region,
+        runtimePreference: params.runtimePreference,
+    });
     const functionName = (0, lambda_client_1.speculateFunctionName)({
         diskSizeInMb: params.diskSizeInMb,
         memorySizeInMb: params.memorySizeInMb,
@@ -48,6 +55,7 @@ const internalDeployFunction = async (params) => {
         alreadyCreated: Boolean(alreadyDeployed),
         ephemerealStorageInMb: params.diskSizeInMb,
         customRoleArn: params.customRoleArn,
+        customLayerArns: params.customLayerArns,
         enableLambdaInsights: (_b = params.enableLambdaInsights) !== null && _b !== void 0 ? _b : false,
         logLevel: params.logLevel,
         vpcSubnetIds: params.vpcSubnetIds,
@@ -69,7 +77,7 @@ const errorHandled = (0, error_handling_1.wrapWithErrorHandling)(exports.interna
  * @description Creates an AWS Lambda function in your account that will be able to render a video in the cloud.
  * @see [Documentation](https://remotion.dev/docs/lambda/deployfunction)
  */
-const deployFunction = ({ createCloudWatchLogGroup, memorySizeInMb, region, timeoutInSeconds, cloudWatchLogRetentionPeriodInDays, customRoleArn, enableLambdaInsights, indent, logLevel, enableV5Runtime, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, diskSizeInMb, requestHandler, }) => {
+const deployFunction = ({ createCloudWatchLogGroup, memorySizeInMb, region, timeoutInSeconds, cloudWatchLogRetentionPeriodInDays, customRoleArn, customLayerArns, enableLambdaInsights, indent, logLevel, enableV5Runtime, vpcSubnetIds, vpcSecurityGroupIds, runtimePreference, diskSizeInMb, requestHandler, }) => {
     if (enableV5Runtime) {
         console.warn('The `enableV5Runtime` option is now on by default. No need to specify it anymore.');
     }
@@ -78,6 +86,7 @@ const deployFunction = ({ createCloudWatchLogGroup, memorySizeInMb, region, time
         logLevel: logLevel !== null && logLevel !== void 0 ? logLevel : 'info',
         createCloudWatchLogGroup,
         customRoleArn: customRoleArn !== null && customRoleArn !== void 0 ? customRoleArn : undefined,
+        customLayerArns: customLayerArns !== null && customLayerArns !== void 0 ? customLayerArns : null,
         diskSizeInMb: diskSizeInMb !== null && diskSizeInMb !== void 0 ? diskSizeInMb : constants_1.DEFAULT_EPHEMERAL_STORAGE_IN_MB,
         enableLambdaInsights: enableLambdaInsights !== null && enableLambdaInsights !== void 0 ? enableLambdaInsights : false,
         memorySizeInMb,

package/dist/api/get-regions.d.ts

@@ -1,5 +1,5 @@
 type Options = {
     enabledByDefaultOnly?: boolean;
 };
-export declare const getRegions: (options?: Options | undefined) => readonly ("af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | "ap-southeast-4" | "ap-southeast-5" | "ca-central-1" | "eu-central-1" | "eu-central-2" | "eu-north-1" | "eu-south-1" | "eu-west-1" | "eu-west-2" | "eu-west-3" | "sa-east-1" | "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2")[];
+export declare const getRegions: (options?: Options | undefined) => readonly ("af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | "ap-southeast-4" | "ap-southeast-5" | "ca-central-1" | "cn-north-1" | "cn-northwest-1" | "eu-central-1" | "eu-central-2" | "eu-north-1" | "eu-south-1" | "eu-west-1" | "eu-west-2" | "eu-west-3" | "sa-east-1" | "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2")[];
 export {};

package/dist/api/iam-validation/resolve-caller-arn.d.ts

@@ -0,0 +1,6 @@
+import type { AwsPartition } from '@remotion/lambda-client';
+export declare const resolveCallerArnForSimulation: ({ callerIdentityArn, region, regionPartition, }: {
+    callerIdentityArn: string;
+    region: "af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | "ap-southeast-4" | "ap-southeast-5" | "ca-central-1" | "cn-north-1" | "cn-northwest-1" | "eu-central-1" | "eu-central-2" | "eu-north-1" | "eu-south-1" | "eu-west-1" | "eu-west-2" | "eu-west-3" | "sa-east-1" | "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2";
+    regionPartition: AwsPartition;
+}) => string;

package/dist/api/iam-validation/resolve-caller-arn.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCallerArnForSimulation = void 0;
+const resolveCallerArnForSimulation = ({ callerIdentityArn, region, regionPartition, }) => {
+    const components = callerIdentityArn.match(/^arn:([^:]+):([^:]+)::(\d+):([^/]+)(.*)$/);
+    if (!components) {
+        throw new Error('Unknown AWS Caller Identity ARN detected');
+    }
+    const callerPartition = components[1];
+    if (callerPartition !== regionPartition) {
+        throw new Error(`AWS Caller Identity partition ${callerPartition} does not match region ${region}, which uses partition ${regionPartition}.`);
+    }
+    const service = components[2];
+    const accountId = components[3];
+    const resourceType = components[4];
+    if (service === 'iam' && resourceType === 'user') {
+        return callerIdentityArn;
+    }
+    if (service === 'sts' && resourceType === 'assumed-role') {
+        const assumedRoleComponents = components[5].match(/^\/([^/]+)\/(.*)$/);
+        if (!assumedRoleComponents) {
+            throw new Error('Unsupported AWS Caller Identity as Assumed-Role ARN detected');
+        }
+        return `arn:${callerPartition}:iam::${accountId}:role/${assumedRoleComponents[1]}`;
+    }
+    throw new Error('Unsupported AWS Caller Identity ARN detected');
+};
+exports.resolveCallerArnForSimulation = resolveCallerArnForSimulation;

package/dist/api/iam-validation/role-permissions.d.ts

@@ -1,4 +1,7 @@
-export declare const rolePermissions: {
+import type { AwsPartition } from '@remotion/lambda-client';
+export type RolePermission = {
     actions: string[];
     resource: string[];
-}[];
+};
+export declare const getRolePermissions: (partition: AwsPartition) => RolePermission[];
+export declare const rolePermissions: RolePermission[];

package/dist/api/iam-validation/role-permissions.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rolePermissions = void 0;
+exports.rolePermissions = exports.getRolePermissions = void 0;
 const constants_1 = require("@remotion/lambda-client/constants");
-exports.rolePermissions = [
+const getRolePermissions = (partition) => [
     {
         actions: ['s3:ListAllMyBuckets'],
         resource: ['*'],
@@ -18,21 +18,23 @@ exports.rolePermissions = [
             's3:PutObject',
             's3:GetBucketLocation',
         ],
-        resource: [`arn:aws:s3:::${constants_1.REMOTION_BUCKET_PREFIX}*`],
+        resource: [`arn:${partition}:s3:::${constants_1.REMOTION_BUCKET_PREFIX}*`],
     },
     {
         actions: ['lambda:InvokeFunction'],
-        resource: [`arn:aws:lambda:*:*:function:${constants_1.RENDER_FN_PREFIX}*`],
+        resource: [`arn:${partition}:lambda:*:*:function:${constants_1.RENDER_FN_PREFIX}*`],
     },
     {
         actions: ['logs:CreateLogGroup'],
-        resource: [`arn:aws:logs:*:*:log-group:${constants_1.LAMBDA_INSIGHTS_PREFIX}`],
+        resource: [`arn:${partition}:logs:*:*:log-group:${constants_1.LAMBDA_INSIGHTS_PREFIX}`],
     },
     {
         actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
         resource: [
-            `arn:aws:logs:*:*:log-group:${constants_1.LOG_GROUP_PREFIX}${constants_1.RENDER_FN_PREFIX}*`,
-            `arn:aws:logs:*:*:log-group:${constants_1.LAMBDA_INSIGHTS_PREFIX}:*`,
+            `arn:${partition}:logs:*:*:log-group:${constants_1.LOG_GROUP_PREFIX}${constants_1.RENDER_FN_PREFIX}*`,
+            `arn:${partition}:logs:*:*:log-group:${constants_1.LAMBDA_INSIGHTS_PREFIX}:*`,
         ],
     },
 ];
+exports.getRolePermissions = getRolePermissions;
+exports.rolePermissions = (0, exports.getRolePermissions)('aws');

package/dist/api/iam-validation/simulate.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.simulatePermissions = exports.logPermissionOutput = void 0;
 const client_sts_1 = require("@aws-sdk/client-sts");
 const lambda_client_1 = require("@remotion/lambda-client");
+const resolve_caller_arn_1 = require("./resolve-caller-arn");
 const simulate_rule_1 = require("./simulate-rule");
 const user_permissions_1 = require("./user-permissions");
 const getEmojiForStatus = (decision) => {
@@ -27,29 +28,14 @@ const simulatePermissions = async (options) => {
     if (!(callerIdentity === null || callerIdentity === void 0 ? void 0 : callerIdentity.Arn)) {
         throw new Error('No valid AWS Caller Identity detected');
     }
-    const callerIdentityArnComponents = callerIdentity.Arn.match(/arn:aws:([^:]+)::(\d+):([^/]+)(.*)/);
-    if (!callerIdentityArnComponents) {
-        throw new Error('Unknown AWS Caller Identity ARN detected');
-    }
-    const callerIdentityArnType = callerIdentityArnComponents[1];
-    let callerArn;
-    if (callerIdentityArnType === 'iam' &&
-        callerIdentityArnComponents[3] === 'user') {
-        callerArn = callerIdentity.Arn;
-    }
-    else if (callerIdentityArnType === 'sts' &&
-        callerIdentityArnComponents[3] === 'assumed-role') {
-        const assumedRoleComponents = callerIdentityArnComponents[4].match(/\/([^/]+)\/(.*)/);
-        if (!assumedRoleComponents) {
-            throw new Error('Unsupported AWS Caller Identity as Assumed-Role ARN detected');
-        }
-        callerArn = `arn:aws:iam::${callerIdentityArnComponents[2]}:role/${assumedRoleComponents[1]}`;
-    }
-    else {
-        throw new Error('Unsupported AWS Caller Identity ARN detected');
-    }
+    const { partition: regionPartition } = lambda_client_1.LambdaClientInternals.getAwsRegionMetadata(options.region);
+    const callerArn = (0, resolve_caller_arn_1.resolveCallerArnForSimulation)({
+        callerIdentityArn: callerIdentity.Arn,
+        region: options.region,
+        regionPartition,
+    });
     const results = [];
-    for (const per of user_permissions_1.requiredPermissions) {
+    for (const per of (0, user_permissions_1.getRequiredPermissions)(regionPartition)) {
         const result = await (0, simulate_rule_1.simulateRule)({
             actionNames: per.actions,
             arn: callerArn,

package/dist/api/iam-validation/suggested-policy.d.ts

@@ -1,3 +1,7 @@
-export declare const getUserPolicy: () => string;
+import type { AwsPartition } from '@remotion/lambda-client';
+export type GetPolicyOptions = {
+    partition?: AwsPartition;
+};
+export declare const getUserPolicy: (options?: GetPolicyOptions | undefined) => string;
 export declare const ROLE_NAME = "remotion-lambda-role";
-export declare const getRolePolicy: () => string;
+export declare const getRolePolicy: (options?: GetPolicyOptions | undefined) => string;

package/dist/api/iam-validation/suggested-policy.js

@@ -3,42 +3,44 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRolePolicy = exports.ROLE_NAME = exports.getUserPolicy = void 0;
 const role_permissions_1 = require("./role-permissions");
 const user_permissions_1 = require("./user-permissions");
-const suggestedPolicy = {
+const makePolicy = (partition) => ({
     Version: '2012-10-17',
-    Statement: [
-        ...user_permissions_1.requiredPermissions.map((per) => {
-            return {
-                Sid: per.id,
-                Effect: 'Allow',
-                Action: per.actions,
-                Resource: per.resource,
-            };
-        }),
-    ],
-};
-const suggestedRolePolicy = {
+    Statement: (0, user_permissions_1.getRequiredPermissions)(partition).map((per) => {
+        return {
+            Sid: per.id,
+            Effect: 'Allow',
+            Action: per.actions,
+            Resource: per.resource,
+        };
+    }),
+});
+const makeRolePolicy = (partition) => ({
     Version: '2012-10-17',
-    Statement: [
-        ...role_permissions_1.rolePermissions.map((per, i) => {
-            return {
-                Sid: String(i),
-                Effect: 'Allow',
-                Action: per.actions,
-                Resource: per.resource,
-            };
-        }),
-    ],
-};
+    Statement: (0, role_permissions_1.getRolePermissions)(partition).map((per, i) => {
+        return {
+            Sid: String(i),
+            Effect: 'Allow',
+            Action: per.actions,
+            Resource: per.resource,
+        };
+    }),
+});
 /*
  * @description Returns an inline JSON policy to be assigned to the AWS user whose credentials are being used for executing CLI commands or calling Node.JS functions.
  * @see [Documentation](https://remotion.dev/docs/lambda/getuserpolicy)
  */
-const getUserPolicy = () => JSON.stringify(suggestedPolicy, null, 2);
+const getUserPolicy = (options) => {
+    var _a;
+    return JSON.stringify(makePolicy((_a = options === null || options === void 0 ? void 0 : options.partition) !== null && _a !== void 0 ? _a : 'aws'), null, 2);
+};
 exports.getUserPolicy = getUserPolicy;
 exports.ROLE_NAME = 'remotion-lambda-role';
 /*
  * @description Returns an inline JSON policy to be assigned to the 'remotion-lambda-role' role that needs to be created in your AWS account.
  * @see [Documentation](https://remotion.dev/docs/lambda/getrolepolicy)
  */
-const getRolePolicy = () => JSON.stringify(suggestedRolePolicy, null, 2);
+const getRolePolicy = (options) => {
+    var _a;
+    return JSON.stringify(makeRolePolicy((_a = options === null || options === void 0 ? void 0 : options.partition) !== null && _a !== void 0 ? _a : 'aws'), null, 2);
+};
 exports.getRolePolicy = getRolePolicy;

package/dist/api/iam-validation/user-permissions.d.ts

@@ -1,5 +1,8 @@
-export declare const requiredPermissions: {
+import type { AwsPartition } from '@remotion/lambda-client';
+export type RequiredPermission = {
     actions: string[];
     resource: string[];
     id: string;
-}[];
+};
+export declare const getRequiredPermissions: (partition: AwsPartition) => RequiredPermission[];
+export declare const requiredPermissions: RequiredPermission[];

package/dist/api/iam-validation/user-permissions.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredPermissions = void 0;
+exports.requiredPermissions = exports.getRequiredPermissions = void 0;
 const constants_1 = require("@remotion/lambda-client/constants");
 const hosted_layers_1 = require("../../shared/hosted-layers");
-exports.requiredPermissions = [
+const getRequiredPermissions = (partition) => [
     {
         id: 'HandleQuotas',
         actions: [
@@ -22,7 +22,7 @@ exports.requiredPermissions = [
     {
         id: 'LambdaInvokation',
         actions: ['iam:PassRole'],
-        resource: ['arn:aws:iam::*:role/remotion-lambda-role'],
+        resource: [`arn:${partition}:iam::*:role/remotion-lambda-role`],
     },
     {
         id: 'Storage',
@@ -41,7 +41,7 @@ exports.requiredPermissions = [
             's3:PutBucketPolicy',
             's3:PutLifecycleConfiguration',
         ],
-        resource: [`arn:aws:s3:::${constants_1.REMOTION_BUCKET_PREFIX}*`],
+        resource: [`arn:${partition}:s3:::${constants_1.REMOTION_BUCKET_PREFIX}*`],
     },
     {
         id: 'BucketListing',
@@ -64,21 +64,25 @@ exports.requiredPermissions = [
             'lambda:PutRuntimeManagementConfig',
             'lambda:TagResource',
         ],
-        resource: [`arn:aws:lambda:*:*:function:${constants_1.RENDER_FN_PREFIX}*`],
+        resource: [`arn:${partition}:lambda:*:*:function:${constants_1.RENDER_FN_PREFIX}*`],
     },
     {
         id: 'LogsRetention',
         actions: ['logs:CreateLogGroup', 'logs:PutRetentionPolicy'],
         resource: [
-            `arn:aws:logs:*:*:log-group:${constants_1.LOG_GROUP_PREFIX}${constants_1.RENDER_FN_PREFIX}*`,
+            `arn:${partition}:logs:*:*:log-group:${constants_1.LOG_GROUP_PREFIX}${constants_1.RENDER_FN_PREFIX}*`,
         ],
     },
     {
         id: 'FetchBinaries',
         actions: ['lambda:GetLayerVersion'],
-        resource: [
-            hosted_layers_1.REMOTION_HOSTED_LAYER_ARN,
-            'arn:aws:lambda:*:580247275435:layer:LambdaInsightsExtension*',
-        ],
+        resource: partition === 'aws-cn'
+            ? ['arn:aws-cn:lambda:*:488211338238:layer:LambdaInsightsExtension*']
+            : [
+                hosted_layers_1.REMOTION_HOSTED_LAYER_ARN,
+                'arn:aws:lambda:*:580247275435:layer:LambdaInsightsExtension*',
+            ],
     },
 ];
+exports.getRequiredPermissions = getRequiredPermissions;
+exports.requiredPermissions = (0, exports.getRequiredPermissions)('aws');

package/dist/cli/args.d.ts

@@ -26,6 +26,7 @@ type LambdaCommandLineOptions = {
     ['s3-output-provider-region']: AwsRegion | (string & {}) | undefined;
     ['s3-output-provider-force-path-style']: boolean;
     ['custom-role-arn']: string | undefined;
+    ['custom-layer-arns']: string | undefined;
     privacy: Privacy;
     webhook: string | undefined;
     ['webhook-secret']: string | undefined;

package/dist/cli/commands/functions/deploy.js

@@ -21,6 +21,11 @@ const functionsDeploySubcommand = async ({ logLevel, providerSpecifics, fullClie
     const memorySizeInMb = (_b = args_1.parsedLambdaCli.memory) !== null && _b !== void 0 ? _b : constants_1.DEFAULT_MEMORY_SIZE;
     const diskSizeInMb = (_c = args_1.parsedLambdaCli.disk) !== null && _c !== void 0 ? _c : constants_1.DEFAULT_EPHEMERAL_STORAGE_IN_MB;
     const customRoleArn = (_d = args_1.parsedLambdaCli['custom-role-arn']) !== null && _d !== void 0 ? _d : undefined;
+    const customLayerArns = args_1.parsedLambdaCli['custom-layer-arns'] === undefined
+        ? null
+        : args_1.parsedLambdaCli['custom-layer-arns']
+            .split(',')
+            .map((arn) => arn.trim());
     const createCloudWatchLogGroup = !args_1.parsedLambdaCli['disable-cloudwatch'];
     const enableLambdaInsights = (_e = args_1.parsedLambdaCli['enable-lambda-insights']) !== null && _e !== void 0 ? _e : false;
     const cloudWatchLogRetentionPeriodInDays = (_f = args_1.parsedLambdaCli['retention-period']) !== null && _f !== void 0 ? _f : constants_1.DEFAULT_CLOUDWATCH_RETENTION_PERIOD;
@@ -47,6 +52,7 @@ Version = ${version_1.VERSION}
 CloudWatch Logging Enabled = ${createCloudWatchLogGroup}
 CloudWatch Retention Period = ${cloudWatchLogRetentionPeriodInDays} days
 Lambda Insights Enabled = ${enableLambdaInsights}
+Custom Layers = ${customLayerArns === null ? 'Not specified' : customLayerArns.length}
 
 				`.trim()));
         if (vpcSubnetIds) {
@@ -73,6 +79,7 @@ VPC Security Group IDs = ${vpcSecurityGroupIds}
         cloudWatchLogRetentionPeriodInDays,
         diskSizeInMb,
         customRoleArn,
+        customLayerArns,
         enableLambdaInsights,
         indent: false,
         logLevel,

package/dist/cli/commands/policies/role.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.roleSubcommand = exports.ROLE_SUBCOMMAND = void 0;
+const lambda_client_1 = require("@remotion/lambda-client");
 const suggested_policy_1 = require("../../../api/iam-validation/suggested-policy");
+const get_aws_region_1 = require("../../get-aws-region");
 const log_1 = require("../../log");
 exports.ROLE_SUBCOMMAND = 'role';
 const roleSubcommand = (logLevel) => {
-    log_1.Log.info({ indent: false, logLevel }, (0, suggested_policy_1.getRolePolicy)());
+    const region = (0, get_aws_region_1.getAwsRegion)();
+    const { partition } = lambda_client_1.LambdaClientInternals.getAwsRegionMetadata(region);
+    log_1.Log.info({ indent: false, logLevel }, (0, suggested_policy_1.getRolePolicy)({ partition }));
 };
 exports.roleSubcommand = roleSubcommand;

package/dist/cli/commands/policies/user.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.userSubcommand = exports.USER_SUBCOMMAND = void 0;
+const lambda_client_1 = require("@remotion/lambda-client");
 const suggested_policy_1 = require("../../../api/iam-validation/suggested-policy");
+const get_aws_region_1 = require("../../get-aws-region");
 const log_1 = require("../../log");
 exports.USER_SUBCOMMAND = 'user';
 const userSubcommand = (logLevel) => {
-    log_1.Log.info({ indent: false, logLevel }, (0, suggested_policy_1.getUserPolicy)());
+    const region = (0, get_aws_region_1.getAwsRegion)();
+    const { partition } = lambda_client_1.LambdaClientInternals.getAwsRegionMetadata(region);
+    log_1.Log.info({ indent: false, logLevel }, (0, suggested_policy_1.getUserPolicy)({ partition }));
 };
 exports.userSubcommand = userSubcommand;