anomalyco/sst · error · VisibleError

Failed to lookup secret for Redis cluster

Error message

Failed to lookup secret for Redis cluster "${name}".

What it means

On ref lookups, the Redis (v2) component reads the cluster's CloudFormation tags to find the sst:ref:secret tag pointing at its auth-token secret. If that tag is absent, the reference() call throws this VisibleError because the secret reference cannot be reconstructed.

Solutions

1. Redeploy the Redis component with the current SST version so the sst:ref:secret tag is written
2. Manually add the sst:ref:secret tag (pointing to the auth token secret ARN) to the cluster via CloudFormation/AWS console, then retry
3. If the cluster predates tagging support, recreate it under the new version and reference the new cluster

Example fix

// before
const redis = sst.aws.Redis.get("Redis", "old-cluster"); // throws: no sst:ref:secret tag
// after: upgrade & redeploy the stack owning the cluster so ref tags exist
// sst deploy (with current sst) in the source app, then:
const redis = sst.aws.Redis.get("Redis", "old-cluster");

try {
  const redis = sst.aws.Redis.get("Redis", "my-cluster");
} catch (e) {
  if (String(e).includes("Failed to lookup secret")) {
    console.error("Cluster lacks sst:ref:secret tag; redeploy with current SST or add the tag");
  }
  throw e;
}

When it happens

Trigger: Calling sst.aws.Redis.get()/reference() for a cluster whose stack tags lack "sst:ref:secret" — e.g., clusters created before that tag was introduced, modified manually, or deployed with an older SST version.

Common situations: Version migration (older clusters without ref tags); manual tag edits in AWS console; cross-app references to clusters not created with tagging enabled.

Related errors

• Failed to get auth token for Redis
• Cannot access `nodes.cluster` in dev mode.
• Cannot access `nodes.cluster` in dev mode.
• Failed to get password for OpenSearch
• Failed to get password for Postgres

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/b805492c45f5d96e. Report an issue: GitHub.

Appendix: source

Thrown at platform/src/components/aws/redis.ts:386

    function reference() {
      const ref = args as unknown as RedisRef;
      const cluster = elasticache.ReplicationGroup.get(
        `${name}Cluster`,
        ref.clusterId,
        undefined,
        { parent: self },
      );

      const input = cluster.tagsAll.apply((tags) => {
        registerVersion(
          tags?.["sst:component-version"]
            ? parseInt(tags["sst:component-version"])
            : undefined,
        );

        if (!tags?.["sst:ref:secret"])
          throw new VisibleError(
            `Failed to lookup secret for Redis cluster "${name}".`,
          );

        return {
          secretRef: tags?.["sst:ref:secret"],
        };
      });

      const secret = secretsmanager.getSecretVersionOutput(
        { secretId: input.secretRef },
        { parent: self },
      );
      const authToken = secret.secretString.apply((v) => {
        return JSON.parse(v).authToken as string;
      });

      return { cluster, authToken };
    }

View on GitHub (pinned to a0bd20f762)