anomalyco/sst · error · VisibleError

Failed to lookup secret for Redis cluster "${name}".

Error message

Failed to lookup secret for Redis cluster "${name}".

What it means

On ref lookups, the Redis (v2) component reads the cluster's CloudFormation tags to find the sst:ref:secret tag pointing at its auth-token secret. If that tag is absent, the reference() call throws this VisibleError because the secret reference cannot be reconstructed.

Source

Thrown at platform/src/components/aws/redis.ts:386

    function reference() {
      const ref = args as unknown as RedisRef;
      const cluster = elasticache.ReplicationGroup.get(
        `${name}Cluster`,
        ref.clusterId,
        undefined,
        { parent: self },
      );

      const input = cluster.tagsAll.apply((tags) => {
        registerVersion(
          tags?.["sst:component-version"]
            ? parseInt(tags["sst:component-version"])
            : undefined,
        );

        if (!tags?.["sst:ref:secret"])
          throw new VisibleError(
            `Failed to lookup secret for Redis cluster "${name}".`,
          );

        return {
          secretRef: tags?.["sst:ref:secret"],
        };
      });

      const secret = secretsmanager.getSecretVersionOutput(
        { secretId: input.secretRef },
        { parent: self },
      );
      const authToken = secret.secretString.apply((v) => {
        return JSON.parse(v).authToken as string;
      });

      return { cluster, authToken };
    }

View on GitHub (pinned to a0bd20f762)

Solutions

1. Redeploy the Redis component with the current SST version so the sst:ref:secret tag is written
2. Manually add the sst:ref:secret tag (pointing to the auth token secret ARN) to the cluster via CloudFormation/AWS console, then retry
3. If the cluster predates tagging support, recreate it under the new version and reference the new cluster

Example fix

// before
const redis = sst.aws.Redis.get("Redis", "old-cluster"); // throws: no sst:ref:secret tag
// after: upgrade & redeploy the stack owning the cluster so ref tags exist
// sst deploy (with current sst) in the source app, then:
const redis = sst.aws.Redis.get("Redis", "old-cluster");

try {
  const redis = sst.aws.Redis.get("Redis", "my-cluster");
} catch (e) {
  if (String(e).includes("Failed to lookup secret")) {
    console.error("Cluster lacks sst:ref:secret tag; redeploy with current SST or add the tag");
  }
  throw e;
}

When it happens

Trigger: Calling sst.aws.Redis.get()/reference() for a cluster whose stack tags lack "sst:ref:secret" — e.g., clusters created before that tag was introduced, modified manually, or deployed with an older SST version.

Common situations: Version migration (older clusters without ref tags); manual tag edits in AWS console; cross-app references to clusters not created with tagging enabled.

Related errors

• Failed to get auth token for Redis ${name}.
• Cannot access `nodes.cluster` in dev mode.
• Cannot access `nodes.cluster` in dev mode.
• Failed to get password for Postgres ${name}.
• Failed to get username for OpenSearch ${name}.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/b805492c45f5d96e. Report an issue: GitHub.