{"record":{"id":"c334477cb1cc3a25","repo":"anomalyco/sst","slug":"the-provided-arn-clusterarn-is-not-a-dsql-clu","errorCode":null,"errorMessage":"The provided ARN \"${clusterArn}\" is not a DSQL cluster ARN.","messagePattern":"The provided ARN \"(.+?)\" is not a DSQL cluster ARN\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/helpers/arn.ts","lineNumber":172,"sourceCode":"\nexport function parseDsqlPublicEndpoint(arn: string) {\n  const parts = arn.split(\":\");\n  const region = parts[3];\n  const clusterId = parts[5]?.split(\"/\")[1];\n  if (!arn.startsWith(\"arn:\") || !clusterId)\n    throw new VisibleError(\n      `The provided ARN \"${arn}\" is not a DSQL cluster ARN.`,\n    );\n  return `${clusterId}.dsql.${region}.on.aws`;\n}\n\nexport function parseDsqlPrivateEndpoint(\n  clusterArn: string,\n  dnsEntries: { dnsName?: string }[],\n) {\n  const clusterId = clusterArn.split(\":\")[5]?.split(\"/\")[1];\n  if (!clusterArn.startsWith(\"arn:\") || !clusterId)\n    throw new VisibleError(\n      `The provided ARN \"${clusterArn}\" is not a DSQL cluster ARN.`,\n    );\n  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith(\"*.\"));\n  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;\n  if (!privateDnsName)\n    throw new VisibleError(\n      `The VPC endpoint has no DNS entries.`,\n    );\n  return privateDnsName.replace(\"*\", clusterId);\n}\n","sourceCodeStart":154,"sourceCodeEnd":183,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/helpers/arn.ts#L154-L183","documentation":"parseDsqlPrivateEndpoint validates the cluster ARN before building a private endpoint hostname. It throws a VisibleError when the ARN does not start with \"arn:\" or the cluster id cannot be extracted from the cluster/<id> segment.","triggerScenarios":"Providing a malformed clusterArn to the function along with the VPC endpoint's dnsEntries; an ARN of the wrong shape or another resource type.","commonSituations":"Hand-typing the cluster ARN; mixing up the VPC endpoint ARN with the cluster ARN; older tooling producing non-ARN identifiers.","solutions":["Pass the actual DSQL cluster ARN (arn:aws:dsql:<region>:<account>:cluster/<id>)","Do not substitute the VPC endpoint ARN for the cluster ARN","Reference the Dsql component's arn output in code"],"exampleFix":"// before\nparseDsqlPrivateEndpoint(endpointArn, dnsEntries)\n// after\nparseDsqlPrivateEndpoint(cluster.arn, dnsEntries)","handlingStrategy":"validation","validationCode":"function assertClusterArn(clusterArn: string) {\n  if (!clusterArn.startsWith(\"arn:\") || !clusterArn.split(\":\")[5]?.split(\"/\")[1])\n    throw new Error(\"not a DSQL cluster ARN\");\n}","typeGuard":"const isDsqlClusterArn = (arn: string): boolean => /^arn:aws:dsql:[^:]+:[^:]+:cluster\\/.+/.test(arn);","tryCatchPattern":"try { const dns = parseDsqlPrivateEndpoint(clusterArn, dnsEntries); } catch (e) { /* log and abort endpoint wiring */ }","preventionTips":["Keep cluster ARN and endpoint ARN distinct variables","Use component outputs","Validate inputs at config boundary"],"tags":["arn","dsql","validation"],"backgroundTag":"invalid-arn-format","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}