anomalyco/sst · error · VisibleError

VPC bastion is not enabled. Enable it with "bastion: true" o

Error message

VPC bastion is not enabled. Enable it with "bastion: true" or "bastion: { instanceProfile: \"name\" }".

What it means

Accessing the VPC's `bastion` getter (used to get the bastion instance ID, e.g. to give another resource access) throws when the bastion was never enabled on the VPC. Bastions must be explicitly opted into with `bastion: true` or a config object.

Source

Thrown at platform/src/components/aws/vpc.ts:1510

    return this._privateSubnets.apply((subnets) =>
      subnets.map((subnet) => subnet.id),
    );
  }

  /**
   * A list of VPC security group IDs.
   */
  public get securityGroups() {
    return output(this.securityGroup).apply((v) => [v.id]);
  }

  /**
   * The bastion instance ID.
   */
  public get bastion() {
    return this.bastionInstance.apply((v) => {
      if (!v) {
        throw new VisibleError(
          `VPC bastion is not enabled. Enable it with "bastion: true" or "bastion: { instanceProfile: \"name\" }".`,
        );
      }
      return v.id;
    });
  }

  /**
   * The underlying [resources](/docs/components/#nodes) this component creates.
   */
  public get nodes() {
    return {
      /**
       * The Amazon EC2 VPC.
       */
      vpc: this.vpc,
      /**
       * The Amazon EC2 Internet Gateway.

View on GitHub (pinned to a0bd20f762)

Solutions

1. Add `bastion: true` to the VPC constructor args.
2. Or `{ bastion: { instanceProfile: "name" } }` if you need a custom instance profile.
3. Remove the code that reads vpc.bastion if a bastion is not actually needed.

Example fix

// before
const vpc = new sst.aws.Vpc("MyVPC");
new sst.aws.Ec2("Box", { vpc, bastion: vpc.bastion });
// after
const vpc = new sst.aws.Vpc("MyVPC", { bastion: true });
new sst.aws.Ec2("Box", { vpc, bastion: vpc.bastion });

// ensure bastion is enabled before referencing vpc.bastion
const vpcArgs = { bastion: true }; // required whenever vpc.bastion is read below

When it happens

Trigger: Calling `vpc.bastion` (e.g. in an EC2 component's bastion argument) while the VPC was created without a bastion option, so bastionInstance is undefined.

Common situations: Copying a snippet that references vpc.bastion into a VPC that lacks `bastion: true`; someone removed the bastion flag but downstream code still reads the getter.

Related errors

• Bastion instance profile must be a name, not an ARN.
• You cannot provide both "vpc.containerSubnets" and "vpc.serv
• The "nat.type" cannot be "managed" when "nat.ec2" is specifi
• Missing "nat.type" for the "${name}" VPC. It is required whe
• The number of Elastic IP allocation IDs must match the numbe

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/500cc45550539c9c. Report an issue: GitHub.