anomalyco/sst · critical · Error

Security group not found in VPC ${vpcID}

Error message

Security group not found in VPC ${vpcID}

What it means

vpc-v1.ts looks up the default security group created alongside a V1 SST VPC by filtering ec2 security groups with name pattern `*SecurityGroup*` in the given VPC. When the AWS API returns no matching IDs, the `get` helper throws a plain Error, meaning the VPC being referenced no longer contains the SST-managed security group.

Source

Thrown at platform/src/components/aws/vpc-v1.ts:506

    const vpc = ec2.Vpc.get(`${name}Vpc`, vpcID);
    const internetGateway = ec2.InternetGateway.get(
      `${name}InstanceGateway`,
      ec2.getInternetGatewayOutput({
        filters: [{ name: "attachment.vpc-id", values: [vpc.id] }],
      }).internetGatewayId,
    );
    const securityGroup = ec2.SecurityGroup.get(
      `${name}SecurityGroup`,
      ec2
        .getSecurityGroupsOutput({
          filters: [
            { name: "group-name", values: ["*SecurityGroup*"] },
            { name: "vpc-id", values: [vpc.id] },
          ],
        })
        .ids.apply((ids) => {
          if (!ids.length)
            throw new Error(`Security group not found in VPC ${vpcID}`);
          return ids[0];
        }),
    );
    const privateSubnets = ec2
      .getSubnetsOutput({
        filters: [
          { name: "vpc-id", values: [vpc.id] },
          { name: "tag:Name", values: ["*Private*"] },
        ],
      })
      .ids.apply((ids) =>
        ids.map((id, i) => ec2.Subnet.get(`${name}PrivateSubnet${i + 1}`, id)),
      );
    const privateRouteTables = privateSubnets.apply((subnets) =>
      subnets.map((subnet, i) =>
        ec2.RouteTable.get(
          `${name}PrivateRouteTable${i + 1}`,
          ec2.getRouteTableOutput({ subnetId: subnet.id }).routeTableId,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Verify the VPC exists and contains a security group named like `*SecurityGroup*` in the target region (`aws ec2 describe-security-groups --filters Name=vpc-id,Values=<vpc-id>`).
2. Recreate the missing security group (or recreate the VPC via `sst deploy` in the stage that owns it) so the lookup succeeds.
3. Confirm you are deploying with the correct AWS profile/region that contains the VPC.

import { EC2Client, DescribeSecurityGroupsCommand } from "@aws-sdk/client-ec2";
const sg = await new EC2Client({}).send(new DescribeSecurityGroupsCommand({
  Filters: [
    { Name: "group-name", Values: ["*SecurityGroup*"] },
    { Name: "vpc-id", Values: [vpcId] }
  ]
}));
if (!sg.SecurityGroups?.length) throw new Error(`VPC ${vpcId} lacks the SST security group; recreate the VPC stage first.`);

function hasSecurityGroups(r: { SecurityGroups?: { GroupId?: string }[] | undefined }): boolean {
  return !!r.SecurityGroups && r.SecurityGroups.length > 0;
}

try {
  const vpc = sst.aws.Vpc.get("Vpc", { id: vpcId });
} catch (e) {
  if (String(e).includes("Security group not found")) {
    // redeploy the owning stage or recreate the SG before continuing
  }
  throw e;
}

When it happens

Trigger: Referencing (via `sst.aws.Vpc.get`) an existing VPC whose default `*SecurityGroup*` was deleted manually, created outside SST, or belongs to a VPC ID that does not match the region/account being deployed in.

Common situations: Someone deleted the security group in the AWS console; the VPC was created by another tool without the naming convention; deploying into the wrong AWS region or profile so the VPC/SG lookup finds nothing; a partially failed `sst remove` that deleted the SG but kept the VPC.

Related errors

• Security group not found in VPC ${vpcId}
• You are using the "Vpc.v1" component. Please migrate to the
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• Missing "vpc.containerSubnets" for the "${name}" Cluster com
• The "vpc.subnets" property has been renamed to "vpc.privateS

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/874ab8f881f3641f. Report an issue: GitHub.