anomalyco/sst · error · VisibleError

Failed to get auth token for Redis ${name}.

Error message

Failed to get auth token for Redis ${name}.

What it means

When Redis v1 components are referenced via ref, SST re-creates the cluster reference by looking up the stored auth token from a secret. If the secret exists but its value is empty or unresolvable, the apply throws this VisibleError.

Source

Thrown at platform/src/components/aws/redis-v1.ts:581

    const cluster = elasticache.ReplicationGroup.get(
      `${name}Cluster`,
      clusterID,
      undefined,
      opts,
    );
    const secret = cluster.tagsAll.apply((tags) =>
      tags?.["sst:auth-token-ref"]
        ? secretsmanager.getSecretVersionOutput(
            {
              secretId: tags["sst:auth-token-ref"],
            },
            opts,
          )
        : output(undefined),
    );
    const authToken = secret.apply((v) => {
      if (!v)
        throw new VisibleError(`Failed to get auth token for Redis ${name}.`);
      return JSON.parse(v.secretString).authToken as string;
    });

    return new Redis(name, {
      ref: true,
      cluster,
      authToken,
    } as unknown as RedisArgs);
  }
}

const __pulumiType = "sst:aws:Redis";
// @ts-expect-error
Redis.__pulumiType = __pulumiType;

View on GitHub (pinned to a0bd20f762)

Solutions

1. Verify the auth token secret exists in Secrets Manager in the same region/stage
2. Redeploy the original Redis component so the secret is recreated
3. If rotation emptied the value, restore it with the cluster's authToken

Example fix

// before (referencing a cluster whose secret was deleted)
const redis = sst.aws.Redis.get("Redis", "my-cluster");
// after: redeploy the owning component first so the secret is recreated
// sst deploy --stage <stage> (in the app that owns the cluster), then get() again

// before Redis.get, verify the auth token secret exists
const secretName = `/<app>/<stage>/Redis/<name>/authToken`;
await aws.secretsmanager.getSecretValue({ SecretId: secretName }); // throws if missing

try {
  const redis = sst.aws.Redis.get("Redis", "my-cluster");
} catch (e) {
  if (String(e).includes("auth token")) console.error("Recreate the auth token secret or redeploy the owning stack");
  throw e;
}

When it happens

Trigger: Calling Redis.get(name, ...) for an existing cluster where the referenced secret's secretString is empty or fails to resolve (secret deleted/rotated).

Common situations: Secret removed from state or region mismatch; manual secret deletion; referencing a cluster in a different app/stage where the secret doesn't exist.

Related errors

• Failed to lookup secret for Redis cluster "${name}".
• Cannot access `nodes.cluster` in dev mode.
• Cannot access `nodes.cluster` in dev mode.
• ${this._name}

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/bde45656d1e7b692. Report an issue: GitHub.