anomalyco/sst · error · VisibleError

Bastion instance profile must be a name, not an ARN.

Error message

Bastion instance profile must be a name, not an ARN.

What it means

Thrown in createBastion when `bastion.instanceProfileName` is given as an ARN (starts with "arn:") instead of the profile's plain name. The component calls iam.InstanceProfile.get(name, ...) which expects the profile NAME, so ARNs are explicitly rejected with a clear message.

Source

Thrown at platform/src/components/aws/vpc.ts:1374

                    fromPort: 0,
                    toPort: 0,
                    cidrBlocks: ["0.0.0.0/0"],
                  },
                ],
                tags: {
                  "sst:is-bastion-sg": "true",
                },
              },
              { parent: self },
            ),
          );

          const instanceProfile = output(
            bastion.instanceProfileName,
          ).apply((instanceProfileName) => {
            if (instanceProfileName) {
              if (instanceProfileName.startsWith("arn:")) {
                throw new VisibleError(
                  "Bastion instance profile must be a name, not an ARN.",
                );
              }

              return iam.InstanceProfile.get(
                `${name}BastionProfile`,
                instanceProfileName,
                {},
                { parent: self },
              );
            }

            const role = new iam.Role(
              `${name}BastionRole`,
              {
                assumeRolePolicy: iam.getPolicyDocumentOutput({
                  statements: [
                    {

View on GitHub (pinned to a0bd20f762)

Solutions

1. Use only the profile name, e.g. "my-profile", not the full ARN.
2. Extract the name from the ARN (the part after instance-profile/).
3. Better: reference an iam.InstanceProfile created in the same app and pass its .name output.

Example fix

// before
{ bastion: { instanceProfile: "arn:aws:iam::123456789012:instance-profile/myBastionProfile" } }
// after
{ bastion: { instanceProfile: "myBastionProfile" } }

const profile = "arn:aws:iam::123456789012:instance-profile/myBastionProfile";
const profileName = profile.includes("instance-profile/")
  ? profile.split("instance-profile/")[1]
  : profile; // pass profileName to bastion.instanceProfile

const isArn = (s: string) => s.startsWith("arn:");
const toProfileName = (s: string) => isArn(s) ? s.split("instance-profile/")[1] : s;

When it happens

Trigger: Setting `{ bastion: { instanceProfile: "arn:aws:iam::123456789012:instance-profile/my-profile" } }` in the VPC config.

Common situations: Copying the full ARN from the IAM console instead of just the profile name; generating config from CLI output that prints ARNs.

Related errors

• VPC bastion is not enabled. Enable it with "bastion: true" o
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• The "nat.type" cannot be "managed" when "nat.ec2" is specifi
• Missing "nat.type" for the "${name}" VPC. It is required whe
• The number of Elastic IP allocation IDs must match the numbe

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/83d8d0912d8f3991. Report an issue: GitHub.