anomalyco/sst · error · VisibleError

The ALB VPC "${albVpcId}" does not match the cluster VPC "${

Error message

The ALB VPC "${albVpcId}" does not match the cluster VPC "${clusterVpcId}" in Service "${name}". The ALB and cluster must be in the same VPC.

What it means

When a `Service` is attached to an external ALB (`albAttachment`), SST validates at deploy time that the ALB's VPC matches the ECS cluster's VPC, since target groups cannot register targets across VPCs. If the IDs differ, a `VisibleError` naming both VPC IDs and the service is thrown.

Source

Thrown at platform/src/components/aws/service.ts:1830

      architecture,
      cpu,
      memory,
      storage,
      taskRole,
      executionRole,
    );
    let loadBalancer: lb.LoadBalancer | undefined;
    let targetGroups: ReturnType<typeof createTargets>;
    let targetEntries: Output<{ targetGroup: lb.TargetGroup; containerName: string; containerPort: number }[]>;
    let effectiveLbArn: Output<string> | undefined;
    let effectiveDomain: Output<string | undefined>;
    let effectiveDnsName: Output<string> | undefined;
    const certificateArn = albAttachment ? output(undefined) : createSsl();
    if (albAttachment) {
      all([albAttachment.instance._vpc, vpc.id]).apply(
        ([albVpcId, clusterVpcId]) => {
          if (albVpcId !== clusterVpcId) {
            throw new VisibleError(
              `The ALB VPC "${albVpcId}" does not match the cluster VPC "${clusterVpcId}" in Service "${name}". The ALB and cluster must be in the same VPC.`,
            );
          }
        },
      );
      const { targets: albTargets, entries: albEntries } = createAlbTargetsAndEntries(albAttachment);
      targetGroups = output(albTargets);
      targetEntries = albEntries;
      createAlbListenerRules(albAttachment, albTargets);
      effectiveLbArn = albAttachment.instance.arn;
      effectiveDomain = output(undefined);
      effectiveDnsName = albAttachment.instance.dnsName;
    } else {
      loadBalancer = createLoadBalancer();
      targetGroups = createTargets();
      targetEntries = computeTargetEntries();
      createListeners();
      createDnsRecords();

View on GitHub (pinned to a0bd20f762)

Solutions

1. Recreate the LoadBalancer (or Service) in the same VPC as the cluster — pass the same `vpc` component to both.
2. Verify `albAttachment.instance._vpc` and the Service's `vpc.id` come from the same VPC resource; fix any hardcoded or default VPC usage.
3. If they must stay separate, put a peering/TGW in place and use an internal LB per VPC — cross-VPC target registration is not supported.

Example fix

// before
const cluster = new sst.aws.Cluster("Cluster", { vpc });
const lb = new sst.aws.LoadBalancer("Lb", { vpc: otherVpc });
const svc = new sst.aws.Service("Svc", { cluster, loadBalancer: lb });

// after
const lb = new sst.aws.LoadBalancer("Lb", { vpc }); // same VPC as cluster
const svc = new sst.aws.Service("Svc", { cluster, loadBalancer: lb });

// assert same VPC component is used for cluster and load balancer before constructing
if (clusterVpc !== lbVpc) {
  throw new Error("Cluster and LoadBalancer must share the same VPC");
}
const svc = new sst.aws.Service("Svc", { cluster, loadBalancer: lb, vpc: clusterVpc });

function sameVpc(a: { node: unknown }, b: { node: unknown }): boolean {
  return a.node === b.node; // same VPC component instance
}

try {
  const svc = new sst.aws.Service("Svc", { cluster, loadBalancer: lb });
} catch (e) {
  if (e instanceof VisibleError && e.message.includes("same VPC")) {
    // rebuild lb in cluster's VPC
  } else throw e;
}

When it happens

Trigger: Creating `new sst.aws.Service(...)` with a `loadBalancer` (ALB attachment) where the `Cluster` and the attached `sst.aws.LoadBalancer` were built in different VPCs (e.g. different `vpc` components, different `vpc.id` outputs).

Common situations: Attaching a service in a new VPC (often a fresh default VPC) to an ALB created in an older VPC; copying example code where the cluster and LB use different VPC props; multi-environment refactors that changed one VPC but not the other.

Related errors

• Cannot access `nodes.loadBalancer` in dev mode.
• Cannot access `nodes.loadBalancer` when no public ports are
• Request count scaling is only supported for http/https proto
• You must provide the ports to expose via "loadBalancer.rules
• You must provide a container name in "loadBalancer.rules" wh

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/9b0663dc1fcf2c44. Report an issue: GitHub.