anomalyco/sst · error · VisibleError

The number of Elastic IP allocation IDs must match the numbe

Error message

The number of Elastic IP allocation IDs must match the number of AZs.

What it means

Thrown by normalizeNat when `nat.ip` (an array of Elastic IP allocation IDs for NAT gateways) does not have exactly one allocation ID per availability zone in the VPC. Each AZ's NAT gateway needs its own EIP, so the lengths must match.

Source

Thrown at platform/src/components/aws/vpc.ts:873

        if (nat === "ec2") {
          return {
            type: "ec2" as const,
            ec2: { instance: "t4g.nano", ami: undefined, role: undefined },
          };
        }
        if (nat) {
          if (nat.ec2 && nat.type === "managed")
            throw new VisibleError(
              `The "nat.type" cannot be "managed" when "nat.ec2" is specified.`,
            );

          if (!nat.type && !nat.ec2)
            throw new VisibleError(
              `Missing "nat.type" for the "${name}" VPC. It is required when "nat.ec2" is not specified.`,
            );

          if (nat.ip && nat.ip.length !== zones.length)
            throw new VisibleError(
              `The number of Elastic IP allocation IDs must match the number of AZs.`,
            );

          return nat.ec2 || nat.type === "ec2"
            ? {
                type: "ec2" as const,
                ip: nat.ip,
                ec2: {
                  instance: nat.ec2?.instance ?? "t4g.nano",
                  ami: nat.ec2?.ami,
                  role: nat.ec2?.role,
                },
              }
            : {
                type: "managed" as const,
                ip: nat.ip,
              };
        }

View on GitHub (pinned to a0bd20f762)

Solutions

1. Count the AZs (zones array length) and provide exactly one EIP allocation ID per zone.
2. Create additional Elastic IPs in EC2 and add their allocation IDs to nat.ip.
3. Reduce the number of zones if you intentionally want fewer NAT gateways.

Example fix

// before (3 zones, 2 EIPs)
new sst.aws.Vpc("MyVPC", { zones: 3, nat: { type: "managed", ip: ["eipalloc-1", "eipalloc-2"] } });
// after
new sst.aws.Vpc("MyVPC", { zones: 3, nat: { type: "managed", ip: ["eipalloc-1", "eipalloc-2", "eipalloc-3"] } });

const zoneCount = args.zones ?? 2;
if (args.nat?.ip && args.nat.ip.length !== zoneCount)
  throw new Error(`nat.ip needs exactly ${zoneCount} EIP allocation IDs (one per AZ).`);

When it happens

Trigger: Creating a multi-AZ VPC (e.g. 3 zones) with `{ nat: { ip: ["eipalloc-1", "eipalloc-2"] } }` (2 IPs), or specifying IPs for a single-AZ VPC count mismatch.

Common situations: Hard-coding IPs from a previous 2-AZ config then adding a zone; typos or duplicate entries in the allocation ID array; forgetting to add an EIP after increasing the zones count.

Related errors

• The "nat.type" cannot be "managed" when "nat.ec2" is specifi
• Missing "nat.type" for the "${name}" VPC. It is required whe
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• Bastion instance profile must be a name, not an ARN.
• VPC bastion is not enabled. Enable it with "bastion: true" o

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/caabebe3c44f7cde. Report an issue: GitHub.