anomalyco/sst · error · VisibleError

Cloud Map namespace not found for VPC ${vpcId}

Error message

Cloud Map namespace not found for VPC ${vpcId}

What it means

This SST VPC component error is thrown when SST tries to look up the Cloud Map (servicediscovery) PrivateDnsNamespace associated with the VPC but cannot find its ID by parsing the linked service discovery description. It means the VPC's Cloud Map namespace resource is missing, was created outside SST, or the expected namespace link description does not contain a namespace ID of the form ns-*.

Source

Thrown at platform/src/components/aws/vpc.ts:742

      // }).id;
      // ```
      // but if user deployed multiple VPCs into the same account. This will error because
      // there are multiple results. Even though `getDnsNamespaceOutput()` takes tags in args,
      // the tags are not used for lookup.
      const zone = output(vpcId).apply((vpcId) =>
        route53.getZone(
          {
            name: "sst",
            privateZone: true,
            vpcId,
          },
          { parent: self },
        ),
      );
      const namespaceId = zone.linkedServiceDescription.apply((description) => {
        const match = description.match(/:namespace\/(ns-[a-z1-9]*)/)?.[1];
        if (!match) {
          throw new VisibleError(
            `Cloud Map namespace not found for VPC ${vpcId}`,
          );
        }
        return match;
      });
      const cloudmapNamespace = servicediscovery.PrivateDnsNamespace.get(
        `${name}CloudmapNamespace`,
        namespaceId,
        { vpc: vpcId },
        { parent: self },
      );

      const privateKeyValue = bastionInstance.apply((v) => {
        if (!v) return;
        const param = ssm.Parameter.get(
          `${name}PrivateKeyValue`,
          interpolate`/sst/vpc/${vpcId}/private-key-value`,
          undefined,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Verify the Cloud Map Private DNS namespace still exists in the AWS console for this VPC and starts with 'ns-'.
2. If it was deleted out-of-band, remove and redeploy the VPC component so SST recreates the namespace.
3. If importing an existing VPC, create/import a servicediscovery.PrivateDnsNamespace and link it so the description matches ':namespace/ns-...'.
4. Refresh state (sst refresh / pulumi refresh) to reconcile drift, then redeploy.

Example fix

// before: namespace deleted manually, SST can't find it
const vpc = new sst.aws.Vpc("MyVPC");
// after: remove from state and redeploy so the namespace is recreated
// sst remove MyVPC && sst deploy  (or refresh state first)

// before deploying, verify the namespace exists in the target VPC
import { ServiceDiscoveryClient, ListNamespacesCommand } from "@aws-sdk/client-servicediscovery";
const ns = await sd.send(new ListNamespacesCommand({})).then(r =>
  r.Namespaces?.find(n => n.Properties?.Vpc === vpcId));
if (!ns) throw new Error(`No Cloud Map namespace found for VPC ${vpcId}; recreate the VPC via SST first.`);

When it happens

Trigger: Referencing a VPC component (via `ref`) whose linkedServiceDescription does not match the regex /:namespace\/(ns-[a-z1-9]*)/, e.g. the PrivateDnsNamespace was deleted out-of-band, was imported manually, or the VPC was created without a Cloud Map namespace.

Common situations: Manual deletion or recreation of the Cloud Map namespace in the AWS console while the Pulumi state still references it; importing an existing VPC that has no private DNS namespace; drift between SST state and actual AWS resources.

Related errors

• You are using the "Vpc.v1" component. Please migrate to the
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• Missing "vpc.containerSubnets" for the "${name}" Cluster com
• You must provide both "vpc.cloudmapNamespaceId" and "vpc.clo
• The "vpc.subnets" property has been renamed to "vpc.privateS

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/f62614d84e988078. Report an issue: GitHub.