{"record":{"id":"68241ad049bd3503","repo":"anomalyco/sst","slug":"the-vpc-endpoint-has-no-dns-entries","errorCode":null,"errorMessage":"The VPC endpoint has no DNS entries.","messagePattern":"The VPC endpoint has no DNS entries\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/helpers/arn.ts","lineNumber":178,"sourceCode":"    throw new VisibleError(\n      `The provided ARN \"${arn}\" is not a DSQL cluster ARN.`,\n    );\n  return `${clusterId}.dsql.${region}.on.aws`;\n}\n\nexport function parseDsqlPrivateEndpoint(\n  clusterArn: string,\n  dnsEntries: { dnsName?: string }[],\n) {\n  const clusterId = clusterArn.split(\":\")[5]?.split(\"/\")[1];\n  if (!clusterArn.startsWith(\"arn:\") || !clusterId)\n    throw new VisibleError(\n      `The provided ARN \"${clusterArn}\" is not a DSQL cluster ARN.`,\n    );\n  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith(\"*.\"));\n  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;\n  if (!privateDnsName)\n    throw new VisibleError(\n      `The VPC endpoint has no DNS entries.`,\n    );\n  return privateDnsName.replace(\"*\", clusterId);\n}\n","sourceCodeStart":160,"sourceCodeEnd":183,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/helpers/arn.ts#L160-L183","documentation":"After validating the cluster ARN, parseDsqlPrivateEndpoint picks a private DNS name from the VPC endpoint's dnsEntries (preferring a wildcard entry). It throws a VisibleError when no entry has a dnsName, so a private hostname cannot be constructed.","triggerScenarios":"Calling parseDsqlPrivateEndpoint with an empty dnsEntries array, or entries whose dnsName fields are undefined (e.g. the VPC endpoint service has no DNS names registered).","commonSituations":"Querying the VPC endpoint before its DNS entries are populated; capturing the wrong endpoint's data; regional service endpoints without private DNS names.","solutions":["Verify the VPC endpoint (describe_vpc_endpoints) actually has DnsEntries populated before wiring it","Wait for the endpoint to finish creating / enable private DNS on the service","Pass the endpoint's dnsEntries output directly from the resource rather than a manual copy"],"exampleFix":"// before\nparseDsqlPrivateEndpoint(clusterArn, [])\n// after\nconst ep = await aws.ec2.getVpcEndpoint({ vpcEndpointId: id })\nparseDsqlPrivateEndpoint(clusterArn, ep.dnsEntries)","handlingStrategy":"validation","validationCode":"function assertDnsEntries(dnsEntries: { dnsName?: string }[]) {\n  if (!dnsEntries.some((e) => e.dnsName)) throw new Error(\"VPC endpoint has no DNS entries\");\n}","typeGuard":"const hasDnsEntries = (e: { dnsName?: string }[]): e is { dnsName: string }[] => e.some((x) => !!x.dnsName);","tryCatchPattern":"try { const name = parseDsqlPrivateEndpoint(clusterArn, dnsEntries); } catch (e) { /* retry after endpoint is ready */ }","preventionTips":["Wait for VPC endpoint to be available before reading DNS entries","Enable private DNS on the endpoint service","Assert non-empty dnsEntries before calling"],"tags":["dsql","dns","vpc-endpoint"],"backgroundTag":"missing-dns-configuration","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}