anomalyco/sst · error · VisibleError

Failed to get password for MySQL ${name}.

Error message

Failed to get password for MySQL ${name}.

What it means

When referencing an existing MySQL database via sst.aws.MySql.get/ref, SST resolves the database password from Secrets Manager using the resource's password tag. If the passwordTag is absent or unresolvable, SST cannot fetch the password and throws this VisibleError instead of failing deep inside Pulumi.

Source

Thrown at platform/src/components/aws/mysql.ts:547

      const input = instance.tagsAll.apply((tags) => {
        return {
          proxyId: output(ref.proxyId),
          passwordTag: tags?.["sst:ref:password"],
        };
      });

      const proxy = input.proxyId.apply((proxyId) =>
        proxyId
          ? rds.Proxy.get(`${name}Proxy`, proxyId, undefined, {
              parent: self,
            })
          : undefined,
      );

      const password = input.passwordTag.apply((passwordTag) => {
        if (!passwordTag)
          throw new VisibleError(`Failed to get password for MySQL ${name}.`);

        const secret = secretsmanager.getSecretVersionOutput(
          { secretId: passwordTag },
          { parent: self },
        );
        return $jsonParse(secret.secretString).apply(
          (v) => v.password as string,
        );
      });

      return { instance, proxy, password };
    }

    function normalizeStorage() {
      return output(args.storage ?? "20 GB").apply((v) => {
        const size = toGBs(v);
        if (size < 20) {
          throw new VisibleError(

View on GitHub (pinned to a0bd20f762)

Solutions

1. Ensure the referenced MySQL resource is the SST-managed component with its password secret intact in Secrets Manager
2. Re-deploy the original MySQL component so the passwordTag is written, then reference it again
3. If the DB was created outside SST, create a new sst.aws.MySql component and migrate data instead of referencing it

Example fix

// before
const db = sst.aws.MySql.get("db", { id: existingId });
// after — reference a component deployed by this SST app so passwordTag exists
const db = new sst.aws.MySql("MyDb", { ... });

// Before referencing, confirm the component is SST-managed and secret exists
const db = sst.aws.MySql.get("db", { id });
if (!db.passwordTag) throw new Error("Referenced MySQL has no password secret");

When it happens

Trigger: Calling sst.aws.MySql.get(...) or the ref path for a MySQL component whose underlying RDS-managed secret tag is missing, or whose passwordTag output resolves to undefined at reference time.

Common situations: Referencing a MySQL database created by an older SST version without password tagging; the resource was modified in the console so the secret tag was dropped; importing a database created outside SST.

Related errors

• Storage must be at least 20 GB for the ${name} MySQL databas
• Storage cannot be greater than 65536 GB (64 TB) for the ${na
• You are using the "Vpc.v1" component. Please migrate to the
• Proxy is not enabled. Enable it with "proxy: true".
• Reader endpoint is not currently supported for RDS Proxy. Pl

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/0aedfae9d9a59c34. Report an issue: GitHub.