{"record":{"id":"610dd65ff8da894c","repo":"anomalyco/sst","slug":"failed-to-get-password-for-opensearch-name","errorCode":null,"errorMessage":"Failed to get password for OpenSearch ${name}.","messagePattern":"Failed to get password for OpenSearch (.+?)\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/open-search.ts","lineNumber":326,"sourceCode":"    });\n\n    function reference() {\n      const ref = args as unknown as OpenSearchRef;\n      // Note: passing in `parent` causes Pulumi to lookup the current component's\n      //       generated ID for the Domain. Not the one passed int. Need to look into\n      //       this.\n      //const domain = opensearch.Domain.get(`${name}Domain`, ref.id, undefined, {\n      //  parent: self,\n      //});\n      const domain = opensearch.Domain.get(`${name}Domain`, ref.id);\n\n      const input = domain.tagsAll.apply((tags) => {\n        if (!tags?.[\"sst:ref:username\"])\n          throw new VisibleError(\n            `Failed to get username for OpenSearch ${name}.`,\n          );\n        if (!tags?.[\"sst:ref:password\"])\n          throw new VisibleError(\n            `Failed to get password for OpenSearch ${name}.`,\n          );\n\n        return {\n          username: tags[\"sst:ref:username\"],\n          password: tags[\"sst:ref:password\"],\n        };\n      });\n\n      const secret = secretsmanager.getSecretVersionOutput(\n        { secretId: input.password },\n        { parent: self },\n      );\n      const password = $jsonParse(secret.secretString).apply(\n        (v) => v.password as string,\n      );\n\n      return { domain, username: input.username, password };","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/open-search.ts#L308-L344","documentation":"Same reference flow as the username check: OpenSearch.ref() reads the sst:ref:password tag from the existing domain via tagsAll to recover connection credentials. A missing password tag makes the reference incomplete, so SST throws this VisibleError.","triggerScenarios":"Calling OpenSearch.ref() on a domain that has sst:ref:username but is missing the sst:ref:password tag, typically because the tags were partially removed or edited after creation.","commonSituations":"Tag cleanup scripts or console edits deleted the password tag; importing domains created by other tooling that copied only some SST tags.","solutions":["Re-add the sst:ref:password tag to the domain in AWS","Redeploy the domain through SST so all reference tags are written consistently","Avoid manually editing SST-managed tags on the domain"],"exampleFix":"// before\n// domain tagged with sst:ref:username but sst:ref:password removed\n// after\naws opensearch add-tags --arn <domain-arn> --tag-list Key=sst:ref:password,Value=<password-secret-ref>","handlingStrategy":"validation","validationCode":"const tags = await client.send(new ListTagsCommand({ ARN: domainArn }));\nconst keys = new Set(tags.TagList?.map(t => t.Key));\nfor (const required of [\"sst:ref:username\", \"sst:ref:password\"]) {\n  if (!keys.has(required)) throw new Error(`Missing ${required} tag — cannot reference domain`);\n}","typeGuard":"function hasRefPasswordTags(tags: Record<string, string> | undefined): tags is Record<string, string> & { \"sst:ref:password\": string } {\n  return !!tags?.[\"sst:ref:password\"];\n}","tryCatchPattern":"try {\n  const search = sst.aws.OpenSearch.ref(domainArn);\n} catch (e) {\n  if (String(e).includes(\"Failed to get password\")) {\n    console.error(\"sst:ref:password tag missing on domain — restore it via `aws opensearch add-tags`\");\n  }\n  throw e;\n}","preventionTips":["Treat sst:ref:* tags as infrastructure metadata — never delete them","Re-apply tags atomically (username + password together)","Verify both ref tags exist before calling OpenSearch.ref()"],"tags":["opensearch","reference","tags","credentials"],"backgroundTag":"missing-resource-reference-tags","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}