{"record":{"id":"d1972bb35bf04161","repo":"anomalyco/sst","slug":"failed-to-get-username-for-opensearch-name","errorCode":null,"errorMessage":"Failed to get username for OpenSearch ${name}.","messagePattern":"Failed to get username for OpenSearch (.+?)\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/open-search.ts","lineNumber":322,"sourceCode":"    this._username = username;\n    this._password = password;\n    this.registerOutputs({\n      _hint: this.url,\n    });\n\n    function reference() {\n      const ref = args as unknown as OpenSearchRef;\n      // Note: passing in `parent` causes Pulumi to lookup the current component's\n      //       generated ID for the Domain. Not the one passed int. Need to look into\n      //       this.\n      //const domain = opensearch.Domain.get(`${name}Domain`, ref.id, undefined, {\n      //  parent: self,\n      //});\n      const domain = opensearch.Domain.get(`${name}Domain`, ref.id);\n\n      const input = domain.tagsAll.apply((tags) => {\n        if (!tags?.[\"sst:ref:username\"])\n          throw new VisibleError(\n            `Failed to get username for OpenSearch ${name}.`,\n          );\n        if (!tags?.[\"sst:ref:password\"])\n          throw new VisibleError(\n            `Failed to get password for OpenSearch ${name}.`,\n          );\n\n        return {\n          username: tags[\"sst:ref:username\"],\n          password: tags[\"sst:ref:password\"],\n        };\n      });\n\n      const secret = secretsmanager.getSecretVersionOutput(\n        { secretId: input.password },\n        { parent: self },\n      );\n      const password = $jsonParse(secret.secretString).apply(","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/open-search.ts#L304-L340","documentation":"When importing an existing OpenSearch domain by reference, SST looks for the sst:ref:username tag on the domain (read via tagsAll) to reconstruct the credentials. If the tag is absent it cannot build a reference to the domain and throws this VisibleError.","triggerScenarios":"Calling the static `OpenSearch.ref(...)` (which invokes reference()) on a domain whose tags do not include `sst:ref:username` — i.e. the domain was not created by SST's OpenSearch component or its reference tags were removed/modified.","commonSituations":"Pointing at a manually-created AWS OpenSearch domain, importing a domain created by a different IaC tool, or someone stripped/edited tags in the AWS console.","solutions":["Reference a domain originally created by the SST OpenSearch component so the sst:ref:* tags exist","Re-add the sst:ref:username (and sst:ref:password) tags on the existing domain via the AWS console or CLI","If the domain is external, configure the connection credentials manually instead of using ref()"],"exampleFix":"// before\nconst search = sst.aws.OpenSearch.ref(\"arn:aws:es:us-east-1:123:domain/external-domain\");\n// after\nconst search = new sst.aws.OpenSearch(\"MySearch\", { /* create it in SST so ref tags exist */ });","handlingStrategy":"validation","validationCode":"import { DescribeDomainsCommand, OpenSearchClient, ListTagsCommand } from \"@aws-sdk/client-opensearch\";\nconst client = new OpenSearchClient({ region: \"us-east-1\" });\nconst domain = await client.send(new DescribeDomainsCommand({ DomainNames: [\"my-domain\"] }));\nconst tags = await client.send(new ListTagsCommand({ ARN: domain.DomainStatusList[0].ARN }));\nif (!tags.TagList?.some(t => t.Key === \"sst:ref:username\")) throw new Error(\"Domain lacks sst:ref:username tag — cannot be referenced\");","typeGuard":"function hasRefUsernameTags(tags: Record<string, string> | undefined): tags is Record<string, string> & { \"sst:ref:username\": string } {\n  return !!tags?.[\"sst:ref:username\"];\n}","tryCatchPattern":"try {\n  const search = sst.aws.OpenSearch.ref(domainArn);\n} catch (e) {\n  if (String(e).includes(\"Failed to get username\")) {\n    console.error(\"Domain is not an SST-managed OpenSearch domain (missing ref tags)\");\n  }\n  throw e;\n}","preventionTips":["Only ref() domains created by the SST OpenSearch component","Never remove or edit sst:ref:* tags on SST-managed domains","Audit tags with the AWS CLI before referencing an imported domain"],"tags":["opensearch","reference","tags","credentials"],"backgroundTag":"missing-resource-reference-tags","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}