anomalyco/sst · error · VisibleError

Failed to get username for OpenSearch ${name}.

Error message

Failed to get username for OpenSearch ${name}.

What it means

When importing an existing OpenSearch domain by reference, SST looks for the sst:ref:username tag on the domain (read via tagsAll) to reconstruct the credentials. If the tag is absent it cannot build a reference to the domain and throws this VisibleError.

Source

Thrown at platform/src/components/aws/open-search.ts:322

    this._username = username;
    this._password = password;
    this.registerOutputs({
      _hint: this.url,
    });

    function reference() {
      const ref = args as unknown as OpenSearchRef;
      // Note: passing in `parent` causes Pulumi to lookup the current component's
      //       generated ID for the Domain. Not the one passed int. Need to look into
      //       this.
      //const domain = opensearch.Domain.get(`${name}Domain`, ref.id, undefined, {
      //  parent: self,
      //});
      const domain = opensearch.Domain.get(`${name}Domain`, ref.id);

      const input = domain.tagsAll.apply((tags) => {
        if (!tags?.["sst:ref:username"])
          throw new VisibleError(
            `Failed to get username for OpenSearch ${name}.`,
          );
        if (!tags?.["sst:ref:password"])
          throw new VisibleError(
            `Failed to get password for OpenSearch ${name}.`,
          );

        return {
          username: tags["sst:ref:username"],
          password: tags["sst:ref:password"],
        };
      });

      const secret = secretsmanager.getSecretVersionOutput(
        { secretId: input.password },
        { parent: self },
      );
      const password = $jsonParse(secret.secretString).apply(

View on GitHub (pinned to a0bd20f762)

Solutions

1. Reference a domain originally created by the SST OpenSearch component so the sst:ref:* tags exist
2. Re-add the sst:ref:username (and sst:ref:password) tags on the existing domain via the AWS console or CLI
3. If the domain is external, configure the connection credentials manually instead of using ref()

Example fix

// before
const search = sst.aws.OpenSearch.ref("arn:aws:es:us-east-1:123:domain/external-domain");
// after
const search = new sst.aws.OpenSearch("MySearch", { /* create it in SST so ref tags exist */ });

import { DescribeDomainsCommand, OpenSearchClient, ListTagsCommand } from "@aws-sdk/client-opensearch";
const client = new OpenSearchClient({ region: "us-east-1" });
const domain = await client.send(new DescribeDomainsCommand({ DomainNames: ["my-domain"] }));
const tags = await client.send(new ListTagsCommand({ ARN: domain.DomainStatusList[0].ARN }));
if (!tags.TagList?.some(t => t.Key === "sst:ref:username")) throw new Error("Domain lacks sst:ref:username tag — cannot be referenced");

function hasRefUsernameTags(tags: Record<string, string> | undefined): tags is Record<string, string> & { "sst:ref:username": string } {
  return !!tags?.["sst:ref:username"];
}

try {
  const search = sst.aws.OpenSearch.ref(domainArn);
} catch (e) {
  if (String(e).includes("Failed to get username")) {
    console.error("Domain is not an SST-managed OpenSearch domain (missing ref tags)");
  }
  throw e;
}

When it happens

Trigger: Calling the static `OpenSearch.ref(...)` (which invokes reference()) on a domain whose tags do not include `sst:ref:username` — i.e. the domain was not created by SST's OpenSearch component or its reference tags were removed/modified.

Common situations: Pointing at a manually-created AWS OpenSearch domain, importing a domain created by a different IaC tool, or someone stripped/edited tags in the AWS console.

Related errors

• Failed to get password for OpenSearch ${name}.
• Failed to get password for Postgres ${name}.
• Failed to get password for Postgres ${name}.
• Database instance not found in cluster ${cluster.id}
• The provided ARN "${arn}" is not a OpenSearch domain ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/d1972bb35bf04161. Report an issue: GitHub.