anomalyco/sst · error · VisibleError

The "vpc.subnets" property has been renamed to "vpc.privateS

Error message

The "vpc.subnets" property has been renamed to "vpc.privateSubnets". Update your code to use "vpc.privateSubnets" instead.

What it means

The Function component's `vpc` option renamed `subnets` to `privateSubnets` in a breaking change. normalizeVpc() detects the old key and throws a VisibleError telling you to update your code, rather than silently misconfiguring VPC placement.

Source

Thrown at platform/src/components/aws/function.ts:2060

        };
        return all([
          args.vpc.id,
          args.vpc.nodes.natGateways,
          args.vpc.nodes.natInstances,
        ]).apply(([id, natGateways, natInstances]) => {
          if (natGateways.length === 0 && natInstances.length === 0) {
            warnOnce(
              `\nWarning: One or more functions are deployed in the "${id}" VPC, which does not have a NAT gateway. As a result, these functions cannot access the internet. If your functions need internet access, enable it by setting the "nat" prop on the "Vpc" component.\n`,
            );
          }
          return result;
        });
      }

      return output(args.vpc).apply((vpc) => {
        // "vpc" is object
        if (vpc.subnets) {
          throw new VisibleError(
            `The "vpc.subnets" property has been renamed to "vpc.privateSubnets". Update your code to use "vpc.privateSubnets" instead.`,
          );
        }

        return vpc;
      });
    }

    function normalizeDurable() {
      if (!args.durable) return;
      const config = args.durable === true ? {} : args.durable;
      return {
        timeout: output(config.timeout).apply((v) =>
          toSeconds(v ?? "14 days"),
        ),
        retention: output(config.retention).apply((v) =>
          toDays(v ?? "30 days"),
        ),

View on GitHub (pinned to a0bd20f762)

Solutions

Rename `subnets` to `privateSubnets` in the vpc object
Check the SST migration guide for other vpc-related renames (e.g. placement of securityGroups)
Pin your previous SST version only as a temporary measure while migrating

Example fix

// before
vpc: { subnets: privateSubnetIds }
// after
vpc: { privateSubnets: privateSubnetIds }

Defensive patterns

Strategy: validation

Validate before calling

if (args.vpc && typeof args.vpc === "object" && "subnets" in args.vpc)
  throw new Error('vpc.subnets renamed to vpc.privateSubnets — update your config');

Type guard

function usesRenamedSubnets(vpc: unknown): boolean {
  return !!vpc && typeof vpc === "object" && "subnets" in vpc;
}

Try / catch

try {
  new sst.aws.Function("Fn", args);
} catch (e) {
  if ((e as Error).message.includes("privateSubnets")) {
    console.error("Rename vpc.subnets to vpc.privateSubnets");
  }
  throw e;
}

Prevention

After SST upgrades, run sst dev once and fix all VisibleError migration messages
Read the SST changelog/migration guide for breaking config renames
Use TypeScript types on args so unknown keys like `subnets` fail typecheck first

When it happens

Trigger: Passing vpc: { subnets: [...] } (with securityGroups or as an object) to new sst.aws.Function in a version of SST that expects vpc.privateSubnets.

Common situations: Upgrading SST across a major version and keeping old vpc config; copy-pasting VPC snippets from older blog posts or repos.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/c59230b4f765350c. Report an issue: GitHub.