anomalyco/sst · error · VisibleError

Failed to get password for Postgres ${name}.

Error message

Failed to get password for Postgres ${name}.

What it means

To let other apps link to an existing Aurora (Postgres) database, SST stores the RDS master password in a secret tagged on the cluster with `sst:ref:password`. When building a reference, the component reads that tag; if it's missing it cannot locate the password secret and throws, since it refuses to expose/derive the password any other way.

Source

Thrown at platform/src/components/aws/aurora.ts:755

            { parent: self },
          )
          .instanceIdentifiers.apply((ids) => {
            if (!ids.length) {
              throw new VisibleError(
                `Database instance not found in cluster ${cluster.id}`,
              );
            }
            return ids[0];
          }),
        undefined,
        { parent: self },
      );

      const secretId = cluster.tagsAll
        .apply((tags) => tags?.["sst:ref:password"])
        .apply((passwordTag) => {
          if (!passwordTag)
            throw new VisibleError(
              `Failed to get password for Postgres ${name}.`,
            );
          return passwordTag;
        });

      const secret = secretsmanager.Secret.get(
        `${name}ProxySecret`,
        secretId,
        undefined,
        { parent: self },
      );
      const secretVersion = secretsmanager.getSecretVersionOutput(
        { secretId },
        { parent: self },
      );
      const password = $jsonParse(secretVersion.secretString).apply(
        (v) => v.password as string,
      );

View on GitHub (pinned to a0bd20f762)

Solutions

1. Redeploy the Aurora component (sst deploy) so SST re-applies the `sst:ref:password` tag, then reference it
2. Verify the cluster's tags in AWS: `aws rds list-tags-for-resource --resource-name arn:aws:rds:...:cluster:...` and confirm `sst:ref:password` points to a valid secretsmanager secret
3. If the cluster was created manually/imported, recreate it through SST (or set the tag to the ARN of the secret containing the password)

Example fix

null

null

try {
  const db = sst.aws.AuroraPostgres.get("DbRef", { clusterArn, databaseName });
  return db.ref;
} catch (e) {
  if (String(e).includes("Failed to get password")) {
    throw new Error("Target cluster is missing the sst:ref:password tag — redeploy the Aurora component so SST re-applies it, or pass password explicitly");
  }
  throw e;
}

When it happens

Trigger: Calling `.ref` on an Aurora Postgres instance whose underlying RDS cluster lacks the `sst:ref:password` tag — e.g. the cluster was created by SST before the ref/password-tag feature, created outside SST, or the tags were stripped (IAM policy denying TagResources, manual tag edits).

Common situations: Referencing a database migrated from an older SST version; importing a manually created RDS cluster into SST; org policies or terraform/pulumi external management that removes tags; referencing across stages where the target was redeployed without tags.

Related errors

• Failed to get password for Postgres ${name}.
• Database instance not found in cluster ${cluster.id}
• Failed to get username for OpenSearch ${name}.
• Failed to get password for OpenSearch ${name}.
• No instance found for cluster ${clusterID}

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/bcf7f0a98c241e7b. Report an issue: GitHub.