anomalyco/sst · error · VisibleError

You cannot provide both "vpc.containerSubnets" and "vpc.serv

Error message

You cannot provide both "vpc.containerSubnets" and "vpc.serviceSubnets" in the "${name}" Cluster component. The "serviceSubnets" property has been deprecated. Use "containerSubnets" instead.

What it means

The Cluster's vpc config originally used serviceSubnets to place ECS services; it was deprecated and renamed to containerSubnets. Providing both is ambiguous, so SST throws instead of guessing which to use.

Source

Thrown at platform/src/components/aws/cluster.ts:281

    }

    function normalizeVpc() {
      // "vpc" is a Vpc.v1 component
      if (args.vpc instanceof VpcV1) {
        throw new VisibleError(
          `You are using the "Vpc.v1" component. Please migrate to the latest "Vpc" component.`,
        );
      }

      // "vpc" is a Vpc component
      if (args.vpc instanceof Vpc) {
        return args.vpc;
      }

      // "vpc" is object
      return output(args.vpc).apply((vpc) => {
        if (vpc.containerSubnets && vpc.serviceSubnets)
          throw new VisibleError(
            `You cannot provide both "vpc.containerSubnets" and "vpc.serviceSubnets" in the "${name}" Cluster component. The "serviceSubnets" property has been deprecated. Use "containerSubnets" instead.`,
          );
        if (!vpc.containerSubnets && !vpc.serviceSubnets)
          throw new VisibleError(
            `Missing "vpc.containerSubnets" for the "${name}" Cluster component.`,
          );

        if (
          (vpc.cloudmapNamespaceId && !vpc.cloudmapNamespaceName) ||
          (!vpc.cloudmapNamespaceId && vpc.cloudmapNamespaceName)
        )
          throw new VisibleError(
            `You must provide both "vpc.cloudmapNamespaceId" and "vpc.cloudmapNamespaceName" for the "${name}" Cluster component.`,
          );

        return {
          ...vpc,
          containerSubnets: (vpc.containerSubnets ?? vpc.serviceSubnets)!,

View on GitHub (pinned to a0bd20f762)

Solutions

1. Remove vpc.serviceSubnets and keep only vpc.containerSubnets.
2. If your intention was container placement, rename serviceSubnets to containerSubnets.
3. Re-run sst deploy after the config change.

Example fix

// before
vpc: { containerSubnets: [...], serviceSubnets: privateSubnets }
// after
vpc: { containerSubnets: privateSubnets }

function validateClusterVpc(vpc) {
  if (vpc?.containerSubnets && vpc?.serviceSubnets)
    throw new Error('Use only vpc.containerSubnets (serviceSubnets is deprecated)');
}
validateClusterVpc(vpcConfig);

When it happens

Trigger: new sst.aws.Cluster('X', { vpc: { containerSubnets: [...], serviceSubnets: [...] } }) — both keys set on the vpc object in normalizeVpc.

Common situations: Merging an older config (serviceSubnets) with newer examples (containerSubnets); an editor/auto-complete adding the new key while the old key remains.

Related errors

• Missing "vpc.containerSubnets" for the "${name}" Cluster com
• You must provide both "vpc.cloudmapNamespaceId" and "vpc.clo
• The ALB VPC "${albVpcId}" does not match the cluster VPC "${
• The "nat.type" cannot be "managed" when "nat.ec2" is specifi
• Missing "nat.type" for the "${name}" VPC. It is required whe

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/39b564d826647483. Report an issue: GitHub.