anomalyco/sst · error · VisibleError

The provided ARN "${arn}" is not a OpenSearch domain ARN.

Error message

The provided ARN "${arn}" is not a OpenSearch domain ARN.

What it means

parseOpenSearch extracts the domain name from an OpenSearch domain ARN (arn:aws:opensearch:region:account:domain/name). It throws a VisibleError when the input does not start with "arn:" or lacks a segment after the first "/".

Source

Thrown at platform/src/components/aws/helpers/arn.ts:149

  return { functionName, region, version };
}

export function parseElasticSearch(arn: string) {
  // arn:aws:es:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a ElasticSearch domain ARN.`,
    );
  return { tableName };
}

export function parseOpenSearch(arn: string) {
  // arn:aws:opensearch:region:account-id:domain/domain-name
  const tableName = arn.split("/")[1];
  if (!arn.startsWith("arn:") || !tableName)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a OpenSearch domain ARN.`,
    );
  return { tableName };
}

export function parseDsqlPublicEndpoint(arn: string) {
  const parts = arn.split(":");
  const region = parts[3];
  const clusterId = parts[5]?.split("/")[1];
  if (!arn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a DSQL cluster ARN.`,
    );
  return `${clusterId}.dsql.${region}.on.aws`;
}

export function parseDsqlPrivateEndpoint(
  clusterArn: string,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Use the full OpenSearch domain ARN of the form arn:aws:opensearch:<region>:<account>:domain/<name>
2. Confirm the resource is an OpenSearch domain, not a serverless collection
3. Reference the SST resource's .arn output programmatically

Example fix

// before
const os = "arn:aws:opensearch:us-east-1:123456789012:domain"
// after
const os = "arn:aws:opensearch:us-east-1:123456789012:domain/movies"

function isOpenSearchDomainArn(arn: string) {
  return arn.startsWith("arn:") && !!arn.split("/")[1];
}

const isOpenSearchDomainArn = (arn: string): boolean => /^arn:aws:opensearch:[^:]+:[^:]+:domain\/.+/.test(arn);

try { const { tableName } = parseOpenSearch(arn); } catch (e) { /* surface invalid ARN to user */ }

When it happens

Trigger: Supplying a malformed string, a non-ARN endpoint URL, or an ARN without the domain/<name> suffix where an OpenSearch domain ARN is required.

Common situations: Using the OpenSearch collection ARN (serverless) instead of a domain ARN; pasting the dashboard endpoint URL; truncating the ARN when copying from the console.

Related errors

• The provided ARN "${arn}" is not a Lambda function ARN.
• The provided ARN "${arn}" is not an S3 bucket ARN.
• The provided ARN "${arn}" is not an SNS Topic ARN.
• The provided ARN "${arn}" is not an SQS Queue ARN.
• The provided ARN "${arn}" is not a DynamoDB table ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/ad281f1c4c96c235. Report an issue: GitHub.