{"record":{"id":"bcf7f0a98c241e7b","repo":"anomalyco/sst","slug":"failed-to-get-password-for-postgres-name","errorCode":null,"errorMessage":"Failed to get password for Postgres ${name}.","messagePattern":"Failed to get password for Postgres (.+?)\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/aurora.ts","lineNumber":755,"sourceCode":"            { parent: self },\n          )\n          .instanceIdentifiers.apply((ids) => {\n            if (!ids.length) {\n              throw new VisibleError(\n                `Database instance not found in cluster ${cluster.id}`,\n              );\n            }\n            return ids[0];\n          }),\n        undefined,\n        { parent: self },\n      );\n\n      const secretId = cluster.tagsAll\n        .apply((tags) => tags?.[\"sst:ref:password\"])\n        .apply((passwordTag) => {\n          if (!passwordTag)\n            throw new VisibleError(\n              `Failed to get password for Postgres ${name}.`,\n            );\n          return passwordTag;\n        });\n\n      const secret = secretsmanager.Secret.get(\n        `${name}ProxySecret`,\n        secretId,\n        undefined,\n        { parent: self },\n      );\n      const secretVersion = secretsmanager.getSecretVersionOutput(\n        { secretId },\n        { parent: self },\n      );\n      const password = $jsonParse(secretVersion.secretString).apply(\n        (v) => v.password as string,\n      );","sourceCodeStart":737,"sourceCodeEnd":773,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/aurora.ts#L737-L773","documentation":"To let other apps link to an existing Aurora (Postgres) database, SST stores the RDS master password in a secret tagged on the cluster with `sst:ref:password`. When building a reference, the component reads that tag; if it's missing it cannot locate the password secret and throws, since it refuses to expose/derive the password any other way.","triggerScenarios":"Calling `.ref` on an Aurora Postgres instance whose underlying RDS cluster lacks the `sst:ref:password` tag — e.g. the cluster was created by SST before the ref/password-tag feature, created outside SST, or the tags were stripped (IAM policy denying TagResources, manual tag edits).","commonSituations":"Referencing a database migrated from an older SST version; importing a manually created RDS cluster into SST; org policies or terraform/pulumi external management that removes tags; referencing across stages where the target was redeployed without tags.","solutions":["Redeploy the Aurora component (sst deploy) so SST re-applies the `sst:ref:password` tag, then reference it","Verify the cluster's tags in AWS: `aws rds list-tags-for-resource --resource-name arn:aws:rds:...:cluster:...` and confirm `sst:ref:password` points to a valid secretsmanager secret","If the cluster was created manually/imported, recreate it through SST (or set the tag to the ARN of the secret containing the password)"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":null,"tryCatchPattern":"try {\n  const db = sst.aws.AuroraPostgres.get(\"DbRef\", { clusterArn, databaseName });\n  return db.ref;\n} catch (e) {\n  if (String(e).includes(\"Failed to get password\")) {\n    throw new Error(\"Target cluster is missing the sst:ref:password tag — redeploy the Aurora component so SST re-applies it, or pass password explicitly\");\n  }\n  throw e;\n}","preventionTips":["Ensure IAM/policies allow RDS tagging so SST can apply sst:ref:password","Avoid manually editing or stripping RDS tags managed by SST","Prefer referencing databases created by the same SST version; redeploy after upgrades","Verify with `aws rds list-tags-for-resource` that sst:ref:password exists before wiring refs"],"tags":["aurora","postgres","secrets","tags","reference"],"backgroundTag":"missing-resource-tag","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}