oven-sh/bun · error

Failed to get password data for instance: ${instanceId}

Error message

Failed to get password data for instance: ${instanceId}

What it means

getPasswordData() polls `ec2 get-password-data` for a Windows instance (15 attempts with 60s*i growing backoff when passwordOptions.wait is set, otherwise 1) and throws when PasswordData is still empty after the last attempt — i.e. Windows never made the admin password retrievable in time.

Source

Thrown at scripts/machine.mjs:197

  /**
   * @param {string} instanceId
   * @param {string} privateKeyPath
   * @param {object} [passwordOptions]
   * @param {boolean} [passwordOptions.wait]
   * @returns {Promise<string | undefined>}
   * @link https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/get-password-data.html
   */
  async getPasswordData(instanceId, privateKeyPath, passwordOptions = {}) {
    const attempts = passwordOptions.wait ? 15 : 1;
    for (let i = 0; i < attempts; i++) {
      const { PasswordData } = await aws.spawn($`ec2 get-password-data --instance-id ${instanceId}`);
      if (PasswordData) {
        return decryptPassword(PasswordData, privateKeyPath);
      }
      await new Promise(resolve => setTimeout(resolve, 60000 * i));
    }
    throw new Error(`Failed to get password data for instance: ${instanceId}`);
  },

  /**
   * @typedef AwsImage
   * @property {string} ImageId
   * @property {string} Name
   * @property {string} State
   * @property {string} CreationDate
   */

  /**
   * @param {Record<string, string | undefined>} [options]
   * @returns {Promise<AwsImage[]>}
   * @link https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html
   */
  async describeImages(options = {}) {
    const { ["owner-alias"]: owners, ...filterOptions } = options;
    const filters = aws.getFilters(filterOptions);

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Wait a few minutes and re-run the operation — the password often appears late in boot
2. Pass passwordOptions.wait = true to use all 15 backoff attempts
3. Verify the instance is Windows and was launched with the same key pair whose private key you are decrypting with
4. Check the instance's console screenshot / system log for boot failure if it never succeeds

Example fix

// before
const password = await aws.getPasswordData(instanceId, privateKeyPath);

// after
const password = await aws.getPasswordData(instanceId, privateKeyPath, { wait: true });

// Only Windows instances launched with a key pair ever return password data
const desc = await $`aws ec2 describe-images --image-ids ${resolvedAmi} --query 'Images[0].Platform'`.text();
if (desc.trim() !== 'windows') throw new Error('getPasswordData only works for Windows instances');

When it happens

Trigger: Windows still sysprepping/booting past the total wait window; the instance was launched without a key pair so no encrypted password is ever produced; instance boot failure (host issue) so the agent never runs; calling with a non-Windows instanceId.

Common situations: Slow or overloaded EC2 host making first boot exceed an hour; image bake where getSecret key path and instance key pair don't correspond; passing wait:false and calling too early.

Related errors

• Failed to run instances: ${inspect(instanceOptions)}
• Failed to import key pair: ${keyName}
• Failed to find available image: ${imageId}
• Unsupported platform: ${inspect(options)}
• No base image found: ${inspect(options)}

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/eaa9843974b5b5ac. Report an issue: GitHub.