anomalyco/sst · error · VisibleError

The VPC endpoint has no DNS entries.

Error message

The VPC endpoint has no DNS entries.

What it means

After validating the cluster ARN, parseDsqlPrivateEndpoint picks a private DNS name from the VPC endpoint's dnsEntries (preferring a wildcard entry). It throws a VisibleError when no entry has a dnsName, so a private hostname cannot be constructed.

Source

Thrown at platform/src/components/aws/helpers/arn.ts:178

    throw new VisibleError(
      `The provided ARN "${arn}" is not a DSQL cluster ARN.`,
    );
  return `${clusterId}.dsql.${region}.on.aws`;
}

export function parseDsqlPrivateEndpoint(
  clusterArn: string,
  dnsEntries: { dnsName?: string }[],
) {
  const clusterId = clusterArn.split(":")[5]?.split("/")[1];
  if (!clusterArn.startsWith("arn:") || !clusterId)
    throw new VisibleError(
      `The provided ARN "${clusterArn}" is not a DSQL cluster ARN.`,
    );
  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith("*."));
  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;
  if (!privateDnsName)
    throw new VisibleError(
      `The VPC endpoint has no DNS entries.`,
    );
  return privateDnsName.replace("*", clusterId);
}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Verify the VPC endpoint (describe_vpc_endpoints) actually has DnsEntries populated before wiring it
2. Wait for the endpoint to finish creating / enable private DNS on the service
3. Pass the endpoint's dnsEntries output directly from the resource rather than a manual copy

Example fix

// before
parseDsqlPrivateEndpoint(clusterArn, [])
// after
const ep = await aws.ec2.getVpcEndpoint({ vpcEndpointId: id })
parseDsqlPrivateEndpoint(clusterArn, ep.dnsEntries)

function assertDnsEntries(dnsEntries: { dnsName?: string }[]) {
  if (!dnsEntries.some((e) => e.dnsName)) throw new Error("VPC endpoint has no DNS entries");
}

const hasDnsEntries = (e: { dnsName?: string }[]): e is { dnsName: string }[] => e.some((x) => !!x.dnsName);

try { const name = parseDsqlPrivateEndpoint(clusterArn, dnsEntries); } catch (e) { /* retry after endpoint is ready */ }

When it happens

Trigger: Calling parseDsqlPrivateEndpoint with an empty dnsEntries array, or entries whose dnsName fields are undefined (e.g. the VPC endpoint service has no DNS names registered).

Common situations: Querying the VPC endpoint before its DNS entries are populated; capturing the wrong endpoint's data; regional service endpoints without private DNS names.

Related errors

• Need to provide a validated certificate via "cert" when DNS
• Need to provide a validated certificate via "cert" when DNS
• Need to provide a validated certificate via "cert" when DNS
• The DNS record "${partial.name}" cannot be created because t
• The provided ARN "${arn}" is not a DSQL cluster ARN.

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/68241ad049bd3503. Report an issue: GitHub.