anomalyco/sst · error · VisibleError

Failed to get password for Postgres ${name}.

Error message

Failed to get password for Postgres ${name}.

What it means

When reconstructing a referenced Postgres database, SST reads a password tag that points to a Secrets Manager secret ID. If that password tag is missing from the referenced database's tags, SST cannot retrieve the password and throws this VisibleError.

Source

Thrown at platform/src/components/aws/postgres.ts:562

        );

        return {
          proxyId: output(ref.proxyId),
          passwordTag: tags?.["sst:lookup:password"],
        };
      });

      const proxy = input.proxyId.apply((proxyId) =>
        proxyId
          ? rds.Proxy.get(`${name}Proxy`, proxyId, undefined, {
              parent: self,
            })
          : undefined,
      );

      const password = input.passwordTag.apply((passwordTag) => {
        if (!passwordTag)
          throw new VisibleError(
            `Failed to get password for Postgres ${name}.`,
          );

        const secret = secretsmanager.getSecretVersionOutput(
          { secretId: passwordTag },
          { parent: self },
        );
        return $jsonParse(secret.secretString).apply(
          (v) => v.password as string,
        );
      });

      return { instance, proxy, password };
    }

    function registerVersion(overrideVersion?: number) {
      self.registerVersion({
        new: _version,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Reference a database originally created by the SST Postgres component
2. Restore the SST password reference tag on the database
3. Create the database in SST instead of referencing an external one

Example fix

// before
const db = sst.aws.Postgres.ref("arn:aws:rds:us-east-1:123:db/external-db");
// after
const db = new sst.aws.Postgres("MyPostgres", { /* created in SST so ref tags exist */ });

const tags = await rds.send(new ListTagsForResourceCommand({ ResourceName: dbArn }));
if (!tags.TagList?.some(t => t.Key === "sst:ref:password"))
  throw new Error("Database lacks SST password reference tag — cannot be referenced");

function hasPasswordRefTag(tags: Record<string, string> | undefined): tags is Record<string, string> & { "sst:ref:password": string } {
  return !!tags?.["sst:ref:password"];
}

try {
  const db = sst.aws.Postgres.ref(dbArn);
} catch (e) {
  if (String(e).includes("Failed to get password")) {
    console.error("sst:ref:password tag missing — only ref SST-created databases");
  }
  throw e;
}

When it happens

Trigger: Calling sst.aws.Postgres.ref() on a database whose tags lack the SST password reference tag — the DB wasn't created by SST's Postgres component, or its tags were stripped/edited.

Common situations: Importing a database created manually or by another tool; console/CLI tag cleanup removed sst:ref tags; copying the DB out-of-band.

Related errors

• Failed to get password for Postgres ${name}.
• Failed to get username for OpenSearch ${name}.
• Failed to get password for OpenSearch ${name}.
• No instance found for cluster ${clusterID}
• Database instance not found in cluster ${cluster.id}

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/2a59b4aecc626dd6. Report an issue: GitHub.