anomalyco/sst · error · VisibleError

The provided ARN "${arn}" is not a ElasticSearch domain ARN.

Error message

The provided ARN "${arn}" is not a ElasticSearch domain ARN.

What it means

parseElasticSearch extracts the domain name from an Elasticsearch domain ARN (arn:aws:es:region:account:domain/name). It throws a VisibleError when the string does not start with "arn:" or has no segment after the first "/", meaning it is not a valid ES domain ARN.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:139

    throw new VisibleError(
      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,
    );
  }

  if (!version || version === "$LATEST") {
    throw new VisibleError(
      `Lambda@Edge requires a qualified ARN (with version). Got: ${arn}`,
    );
  }

  return { functionName, region, version };
}

export function parseElasticSearch(arn: string) {
  // arn:aws:es:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a ElasticSearch domain ARN.`,
    );
  return { tableName };
}

export function parseOpenSearch(arn: string) {
  // arn:aws:opensearch:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a OpenSearch domain ARN.`,
    );
  return { tableName };
}

export function parseDsqlPublicEndpoint(arn: string) {
  const parts = arn.split(":");
  const region = parts[3];

View on GitHub (pinned to a0bd20f762)

Solutions

Copy the full domain ARN from the AWS Elasticsearch console (starts with arn:aws:es:...:domain/name)
Verify the ARN contains a "/" followed by the domain name
Use the SST resource's .arn output instead of a hand-typed value

Example fix

// before
const es = "https://search-mydomain-abc.us-east-1.es.amazonaws.com"
// after
const es = "arn:aws:es:us-east-1:123456789012:domain/mydomain"

Defensive patterns

Strategy: validation

Validate before calling

function isEsDomainArn(arn: string) {
  return arn.startsWith("arn:") && !!arn.split("/")[1];
}

Type guard

const isEsDomainArn = (arn: string): boolean => /^arn:aws:es:[^:]+:[^:]+:domain\/.+/.test(arn);

Try / catch

try { const { tableName } = parseElasticSearch(arn); } catch (e) { /* fall back to prompting for a valid ARN */ }

Prevention

Copy ARNs from console, not endpoint URLs
Use SST resource .arn outputs
Regex-validate ARNs in config

When it happens

Trigger: Passing a non-ARN string, a malformed ARN, or an ARN of a different resource type (e.g. missing the domain/ suffix) where an Elasticsearch domain ARN is expected.

Common situations: Pasting a domain endpoint URL (https://search-xxx.es.amazonaws.com) instead of the ARN; typos truncating the /domain-name part; using a plain Lambda ARN by mistake.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/8c7e423fc671e66e. Report an issue: GitHub.