anomalyco/sst · critical · VisibleError

Security group not found in VPC ${vpcId}

Error message

Security group not found in VPC ${vpcId}

What it means

The V2 `Vpc.reference` path (platform/src/components/aws/vpc.ts:521) resolves the SST-managed security group(s) in the referenced VPC by ID lookup, then throws a VisibleError if the returned `ids` array is empty. Like error 187, it means the referenced VPC has no security group that SST can adopt for the consuming components.

Source

Thrown at platform/src/components/aws/vpc.ts:521

      );
      const securityGroup = ec2.SecurityGroup.get(
        `${name}SecurityGroup`,
        all([
          ec2
            .getSecurityGroupsOutput(
              {
                filters: [
                  { name: "group-name", values: ["default"] },
                  { name: "vpc-id", values: [vpcId] },
                ],
              },
              { parent: self },
            )
            .ids,
          vpcId,
        ]).apply(([ids, vpcId]) => {
          if (!ids.length) {
            throw new VisibleError(
              `Security group not found in VPC ${vpcId}`,
            );
          }
          return ids[0];
        }),
        undefined,
        { parent: self },
      );
      const privateSubnets = ec2
        .getSubnetsOutput(
          {
            filters: [
              { name: "vpc-id", values: [vpcId] },
              { name: "tag:Name", values: ["*Private*"] },
            ],
          },
          { parent: self },
        )

View on GitHub (pinned to a0bd20f762)

Solutions

1. Check the referenced VPC for its security groups (`aws ec2 describe-security-groups --filters Name=vpc-id,Values=<vpcId>`) and recreate any that were deleted.
2. Redeploy the stage that owns the VPC with SST so the security group is recreated, then redeploy this stage.
3. Confirm the region/profile and the vpcId passed to `Vpc.get` point at the intended SST-created VPC.

Example fix

// before
const vpc = sst.aws.Vpc.get("Vpc", { id: "vpc-123" }); // SG deleted manually -> throws
// after
// redeploy the owning stage to recreate SGs, then:
const vpc = sst.aws.Vpc.get("Vpc", { id: "vpc-123" });

import { EC2Client, DescribeSecurityGroupsCommand } from "@aws-sdk/client-ec2";
const res = await new EC2Client({}).send(new DescribeSecurityGroupsCommand({
  Filters: [{ Name: "vpc-id", Values: [vpcId] }]
}));
if (!res.SecurityGroups?.length) throw new Error(`VPC ${vpcId} has no security groups; recreate via SST before referencing.`);

function vpcHasSecurityGroups(groups: { GroupId?: string }[] | undefined): groups is { GroupId: string }[] {
  return Array.isArray(groups) && groups.length > 0;
}

try {
  const vpc = sst.aws.Vpc.get("Vpc", { id: vpcId });
} catch (e) {
  if (String(e).includes("Security group not found")) {
    // recreate the security group or redeploy the VPC-owning stage
  }
  throw e;
}

When it happens

Trigger: Calling `sst.aws.Vpc.get(name, { vpc: ... })` (or `ref`) for a VPC whose security groups were deleted, renamed to not match the SST filter, or when the vpcId is wrong/absent in the target region.

Common situations: Manual cleanup in the AWS console removed the SST security group; referencing a bare AWS-provided VPC not created by SST; wrong region/profile; the `sst:component-version` upgrade path left the VPC without expected SGs.

Related errors

• Security group not found in VPC ${vpcID}
• You are using the "Vpc.v1" component. Please migrate to the
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• Missing "vpc.containerSubnets" for the "${name}" Cluster com
• The "vpc.subnets" property has been renamed to "vpc.privateS

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/f104d396a8272462. Report an issue: GitHub.