anomalyco/sst · error · VisibleError

Failed to get password for OpenSearch ${name}.

Error message

Failed to get password for OpenSearch ${name}.

What it means

Same reference flow as the username check: OpenSearch.ref() reads the sst:ref:password tag from the existing domain via tagsAll to recover connection credentials. A missing password tag makes the reference incomplete, so SST throws this VisibleError.

Source

Thrown at platform/src/components/aws/open-search.ts:326

    });

    function reference() {
      const ref = args as unknown as OpenSearchRef;
      // Note: passing in `parent` causes Pulumi to lookup the current component's
      //       generated ID for the Domain. Not the one passed int. Need to look into
      //       this.
      //const domain = opensearch.Domain.get(`${name}Domain`, ref.id, undefined, {
      //  parent: self,
      //});
      const domain = opensearch.Domain.get(`${name}Domain`, ref.id);

      const input = domain.tagsAll.apply((tags) => {
        if (!tags?.["sst:ref:username"])
          throw new VisibleError(
            `Failed to get username for OpenSearch ${name}.`,
          );
        if (!tags?.["sst:ref:password"])
          throw new VisibleError(
            `Failed to get password for OpenSearch ${name}.`,
          );

        return {
          username: tags["sst:ref:username"],
          password: tags["sst:ref:password"],
        };
      });

      const secret = secretsmanager.getSecretVersionOutput(
        { secretId: input.password },
        { parent: self },
      );
      const password = $jsonParse(secret.secretString).apply(
        (v) => v.password as string,
      );

      return { domain, username: input.username, password };

View on GitHub (pinned to a0bd20f762)

Solutions

1. Re-add the sst:ref:password tag to the domain in AWS
2. Redeploy the domain through SST so all reference tags are written consistently
3. Avoid manually editing SST-managed tags on the domain

Example fix

// before
// domain tagged with sst:ref:username but sst:ref:password removed
// after
aws opensearch add-tags --arn <domain-arn> --tag-list Key=sst:ref:password,Value=<password-secret-ref>

const tags = await client.send(new ListTagsCommand({ ARN: domainArn }));
const keys = new Set(tags.TagList?.map(t => t.Key));
for (const required of ["sst:ref:username", "sst:ref:password"]) {
  if (!keys.has(required)) throw new Error(`Missing ${required} tag — cannot reference domain`);
}

function hasRefPasswordTags(tags: Record<string, string> | undefined): tags is Record<string, string> & { "sst:ref:password": string } {
  return !!tags?.["sst:ref:password"];
}

try {
  const search = sst.aws.OpenSearch.ref(domainArn);
} catch (e) {
  if (String(e).includes("Failed to get password")) {
    console.error("sst:ref:password tag missing on domain — restore it via `aws opensearch add-tags`");
  }
  throw e;
}

When it happens

Trigger: Calling OpenSearch.ref() on a domain that has sst:ref:username but is missing the sst:ref:password tag, typically because the tags were partially removed or edited after creation.

Common situations: Tag cleanup scripts or console edits deleted the password tag; importing domains created by other tooling that copied only some SST tags.

Related errors

• Failed to get username for OpenSearch ${name}.
• Failed to get password for Postgres ${name}.
• Failed to get password for Postgres ${name}.
• Database instance not found in cluster ${cluster.id}
• The provided ARN "${arn}" is not a OpenSearch domain ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/610dd65ff8da894c. Report an issue: GitHub.