anomalyco/sst · error · VisibleError

The VPC configured for the service does not have NAT enabled

Error message

The VPC configured for the service does not have NAT enabled. Enable NAT by configuring "nat" on the "sst.aws.Vpc" component.

What it means

The `sst.aws.Service` component requires its private subnets to have outbound internet access via NAT gateways. During `normalizeVpc`, SST inspects the referenced Vpc's `nodes.natGateways`; if the list is empty, the service would deploy but never pull images or reach the internet, so it throws instead.

Source

Thrown at platform/src/components/aws/service-v1.ts:153

          ([domain, loadBalancer]) =>
            domain ? `https://${domain}/` : `http://${loadBalancer}`,
        );

    registerHint();
    registerReceiver();

    function normalizeVpc() {
      // "vpc" is a Vpc component
      if (args.vpc instanceof Vpc) {
        const result = {
          id: args.vpc.id,
          publicSubnets: args.vpc.publicSubnets,
          privateSubnets: args.vpc.privateSubnets,
          securityGroups: args.vpc.securityGroups,
        };
        return args.vpc.nodes.natGateways.apply((natGateways) => {
          if (natGateways.length === 0)
            throw new VisibleError(
              `The VPC configured for the service does not have NAT enabled. Enable NAT by configuring "nat" on the "sst.aws.Vpc" component.`,
            );
          return result;
        });
      }

      // "vpc" is object
      return output(args.vpc);
    }

    function normalizeRegion() {
      return getRegionOutput(undefined, { parent: self }).region;
    }

    function normalizeArchitecture() {
      return output(args.architecture ?? "x86_64").apply((v) => v);
    }

View on GitHub (pinned to a0bd20f762)

Solutions

Add NAT to the VPC: set `nat: { name: "NAT" }` (or per-AZ NATs) on the `sst.aws.Vpc` component and redeploy
Use a different VPC that has NAT enabled for this service
If the service truly needs no outbound access, use a VPC component/config that supports it or pre-bake the image without runtime pulls — but the component still requires NAT, so enabling NAT is the fix

Example fix

// before
const vpc = new sst.aws.Vpc("Vpc", { nat: { name: "none" } });
new sst.aws.Service("Api", { vpc });
// after
const vpc = new sst.aws.Vpc("Vpc", { nat: { name: "NAT" } });
new sst.aws.Service("Api", { vpc });

Defensive patterns

Strategy: validation

Validate before calling

// ensure VPC has NAT before creating the service
if (!vpcArgs.nat || vpcArgs.nat.name === "none") {
  throw new Error("Service requires a VPC with NAT enabled.");
}

Prevention

Always set `nat: { name: "NAT" }` on VPCs used by services
Keep a shared VPC component for NAT-enabled networking
Budget for NAT gateway cost upfront to avoid later removals

When it happens

Trigger: Passing a `vpc` created with `sst.aws.Vpc` where `nat: { name: "none" }` (or default with no NAT) while deploying a Service into it; referencing a VPC whose NAT gateways haven't been created.

Common situations: Cost-saving VPC configs without NAT; reusing a VPC built for bastion/internal workloads; forgetting `nat` args when migrating from a VPC that had NAT.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/bd3d122c2c4e034f. Report an issue: GitHub.