anomalyco/sst · error · VisibleError

The provided ARN "${clusterArn}" is not a DSQL cluster ARN.

Error message

The provided ARN "${clusterArn}" is not a DSQL cluster ARN.

What it means

parseDsqlPrivateEndpoint validates the cluster ARN before building a private endpoint hostname. It throws a VisibleError when the ARN does not start with "arn:" or the cluster id cannot be extracted from the cluster/<id> segment.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:172

export function parseDsqlPublicEndpoint(arn: string) {
  const parts = arn.split(":");
  const region = parts[3];
  const clusterId = parts[5]?.split("/")[1];
  if (!arn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${arn}" is not a DSQL cluster ARN.`,
    );
  return `${clusterId}.dsql.${region}.on.aws`;
}

export function parseDsqlPrivateEndpoint(
  clusterArn: string,
  dnsEntries: { dnsName?: string }[],
) {
  const clusterId = clusterArn.split(":")[5]?.split("/")[1];
  if (!clusterArn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${clusterArn}" is not a DSQL cluster ARN.`,
    );
  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith("*."));
  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;
  if (!privateDnsName)
    throw new VisibleError(
      `The VPC endpoint has no DNS entries.`,
    );
  return privateDnsName.replace("*", clusterId);
}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Pass the actual DSQL cluster ARN (arn:aws:dsql:<region>:<account>:cluster/<id>)
2. Do not substitute the VPC endpoint ARN for the cluster ARN
3. Reference the Dsql component's arn output in code

Example fix

// before
parseDsqlPrivateEndpoint(endpointArn, dnsEntries)
// after
parseDsqlPrivateEndpoint(cluster.arn, dnsEntries)

function assertClusterArn(clusterArn: string) {
  if (!clusterArn.startsWith("arn:") || !clusterArn.split(":")[5]?.split("/")[1])
    throw new Error("not a DSQL cluster ARN");
}

const isDsqlClusterArn = (arn: string): boolean => /^arn:aws:dsql:[^:]+:[^:]+:cluster\/.+/.test(arn);

try { const dns = parseDsqlPrivateEndpoint(clusterArn, dnsEntries); } catch (e) { /* log and abort endpoint wiring */ }

When it happens

Trigger: Providing a malformed clusterArn to the function along with the VPC endpoint's dnsEntries; an ARN of the wrong shape or another resource type.

Common situations: Hand-typing the cluster ARN; mixing up the VPC endpoint ARN with the cluster ARN; older tooling producing non-ARN identifiers.

Related errors

• The provided ARN "${arn}" is not a DSQL cluster ARN.
• The provided ARN "${arn}" is not a Lambda function ARN.
• The provided ARN "${arn}" is not an S3 bucket ARN.
• The provided ARN "${arn}" is not an SNS Topic ARN.
• The provided ARN "${arn}" is not an SQS Queue ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/c334477cb1cc3a25. Report an issue: GitHub.