{"record":{"id":"2a59b4aecc626dd6","repo":"anomalyco/sst","slug":"failed-to-get-password-for-postgres-name-2a59b4","errorCode":null,"errorMessage":"Failed to get password for Postgres ${name}.","messagePattern":"Failed to get password for Postgres (.+?)\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/postgres.ts","lineNumber":562,"sourceCode":"        );\n\n        return {\n          proxyId: output(ref.proxyId),\n          passwordTag: tags?.[\"sst:lookup:password\"],\n        };\n      });\n\n      const proxy = input.proxyId.apply((proxyId) =>\n        proxyId\n          ? rds.Proxy.get(`${name}Proxy`, proxyId, undefined, {\n              parent: self,\n            })\n          : undefined,\n      );\n\n      const password = input.passwordTag.apply((passwordTag) => {\n        if (!passwordTag)\n          throw new VisibleError(\n            `Failed to get password for Postgres ${name}.`,\n          );\n\n        const secret = secretsmanager.getSecretVersionOutput(\n          { secretId: passwordTag },\n          { parent: self },\n        );\n        return $jsonParse(secret.secretString).apply(\n          (v) => v.password as string,\n        );\n      });\n\n      return { instance, proxy, password };\n    }\n\n    function registerVersion(overrideVersion?: number) {\n      self.registerVersion({\n        new: _version,","sourceCodeStart":544,"sourceCodeEnd":580,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/postgres.ts#L544-L580","documentation":"When reconstructing a referenced Postgres database, SST reads a password tag that points to a Secrets Manager secret ID. If that password tag is missing from the referenced database's tags, SST cannot retrieve the password and throws this VisibleError.","triggerScenarios":"Calling sst.aws.Postgres.ref() on a database whose tags lack the SST password reference tag — the DB wasn't created by SST's Postgres component, or its tags were stripped/edited.","commonSituations":"Importing a database created manually or by another tool; console/CLI tag cleanup removed sst:ref tags; copying the DB out-of-band.","solutions":["Reference a database originally created by the SST Postgres component","Restore the SST password reference tag on the database","Create the database in SST instead of referencing an external one"],"exampleFix":"// before\nconst db = sst.aws.Postgres.ref(\"arn:aws:rds:us-east-1:123:db/external-db\");\n// after\nconst db = new sst.aws.Postgres(\"MyPostgres\", { /* created in SST so ref tags exist */ });","handlingStrategy":"validation","validationCode":"const tags = await rds.send(new ListTagsForResourceCommand({ ResourceName: dbArn }));\nif (!tags.TagList?.some(t => t.Key === \"sst:ref:password\"))\n  throw new Error(\"Database lacks SST password reference tag — cannot be referenced\");","typeGuard":"function hasPasswordRefTag(tags: Record<string, string> | undefined): tags is Record<string, string> & { \"sst:ref:password\": string } {\n  return !!tags?.[\"sst:ref:password\"];\n}","tryCatchPattern":"try {\n  const db = sst.aws.Postgres.ref(dbArn);\n} catch (e) {\n  if (String(e).includes(\"Failed to get password\")) {\n    console.error(\"sst:ref:password tag missing — only ref SST-created databases\");\n  }\n  throw e;\n}","preventionTips":["Only use Postgres.ref() on databases originally created by SST","Never strip sst:ref:* tags from SST-managed RDS resources","Check tags with `aws rds list-tags-for-resource` before referencing"],"tags":["postgres","reference","tags","secrets-manager","credentials"],"backgroundTag":"missing-resource-reference-tags","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}