anomalyco/sst · error · VisibleError

The provided ARN "${arn}" is not a DSQL cluster ARN.

Error message

The provided ARN "${arn}" is not a DSQL cluster ARN.

What it means

parseDsqlPublicEndpoint builds the public DSQL endpoint hostname from a cluster ARN by extracting the cluster id (field after domain/ in the 6th colon segment). It throws a VisibleError if the string is not an arn: or the cluster id cannot be found.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:160

  return { tableName };
}

export function parseOpenSearch(arn: string) {
  // arn:aws:opensearch:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a OpenSearch domain ARN.`,
    );
  return { tableName };
}

export function parseDsqlPublicEndpoint(arn: string) {
  const parts = arn.split(":");
  const region = parts[3];
  const clusterId = parts[5]?.split("/")[1];
  if (!arn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a DSQL cluster ARN.`,
    );
  return `${clusterId}.dsql.${region}.on.aws`;
}

export function parseDsqlPrivateEndpoint(
  clusterArn: string,
  dnsEntries: { dnsName?: string }[],
) {
  const clusterId = clusterArn.split(":")[5]?.split("/")[1];
  if (!clusterArn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${clusterArn}" is not a DSQL cluster ARN.`,
    );
  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith("*."));
  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;
  if (!privateDnsName)
    throw new VisibleError(

View on GitHub (pinned to a0bd20f762)

Solutions

1. Copy the full cluster ARN (arn:aws:dsql:<region>:<account>:cluster/<id>) from the AWS DSQL console
2. Ensure the ARN contains cluster/ followed by the cluster id
3. Use the sst.aws.Dsql resource's arn output instead of manual strings

Example fix

// before
const arn = "abc123.dsql.us-east-1.on.aws"
// after
const arn = "arn:aws:dsql:us-east-1:123456789012:cluster/abc123"

function isDsqlClusterArn(arn: string) {
  return arn.startsWith("arn:") && !!arn.split(":")[5]?.split("/")[1];
}

const isDsqlClusterArn = (arn: string): boolean => /^arn:aws:dsql:[^:]+:[^:]+:cluster\/.+/.test(arn);

try { const host = parseDsqlPublicEndpoint(arn); } catch (e) { /* request correct cluster ARN */ }

When it happens

Trigger: Passing a non-ARN value, a wrong-region-format ARN, or an ARN without cluster/<id> in the resource segment to a DSQL link/endpoint configuration.

Common situations: Pasting the DSQL connection hostname instead of the ARN; copying a partial ARN; using another resource type's ARN by mistake.

Related errors

• The provided ARN "${clusterArn}" is not a DSQL cluster ARN.
• The provided ARN "${arn}" is not a Lambda function ARN.
• The provided ARN "${arn}" is not an S3 bucket ARN.
• The provided ARN "${arn}" is not an SNS Topic ARN.
• The provided ARN "${arn}" is not an SQS Queue ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/cb4b09029b486db6. Report an issue: GitHub.