{"record":{"id":"184242870e634b08","repo":"anomalyco/sst","slug":"set-vpc-publicsubnets-on-the-cluster-to-use-pub","errorCode":null,"errorMessage":"Set \"vpc.publicSubnets\" on the Cluster to use \"public\" on the \"${name}\" Task.","messagePattern":"Set \"vpc\\.publicSubnets\" on the Cluster to use \"public\" on the \"(.+?)\" Task\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/task.ts","lineNumber":417,"sourceCode":"      // \"vpc\" is a Vpc component\n      if (args.cluster.vpc instanceof Vpc) {\n        const vpc = args.cluster.vpc;\n        return {\n          id: vpc.id,\n          isSstVpc: true,\n          publicSubnets: vpc.publicSubnets,\n          containerSubnets: vpc.publicSubnets,\n          securityGroups: vpc.securityGroups,\n        };\n      }\n\n      // \"vpc\" is object\n      return {\n        id: output(args.cluster.vpc).apply((v) => v.id),\n        isSstVpc: false,\n        publicSubnets: output(args.cluster.vpc).apply((v) => {\n          if (isPublic && !v.publicSubnets?.length)\n            throw new VisibleError(\n              `Set \"vpc.publicSubnets\" on the Cluster to use \"public\" on the \"${name}\" Task.`,\n            );\n          return (v.publicSubnets ?? []).map((v) => output(v));\n        }),\n        containerSubnets: output(args.cluster.vpc).apply((v) =>\n          v.containerSubnets.map((v) => output(v)),\n        ),\n        securityGroups: output(args.cluster.vpc).apply((v) =>\n          v.securityGroups.map((v) => output(v)),\n        ),\n      };\n    }\n\n\n    function createPublicSecurityGroup() {\n      if (!isPublic) return;\n      return new ec2.SecurityGroup(\n        `${name}PublicSecurityGroup`,","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/task.ts#L399-L435","documentation":"When a Task is attached to an existing Cluster and marked `public: true`, the task's ENIs must land in public subnets so they get internet-facing IPs. normalizeVpc inspects the cluster's `vpc.publicSubnets` list and throws if it is empty or undefined, because a public task cannot be scheduled correctly in a VPC without public subnets.","triggerScenarios":"Creating `new sst.aws.Task(\"X\", { cluster: <a cluster whose vpc has no publicSubnets>, public: true })`, or pointing the task at a Cluster built from a `vpc` object literal that omits `publicSubnets`.","commonSituations":"Using a VPC created with only private subnets (default NAT-less setup), referencing an external/pre-existing VPC whose `publicSubnets` array was not provided to the Cluster, or forgetting to add public subnets after enabling `public: true` on a previously private task.","solutions":["Set `publicSubnets` on the Cluster's `vpc` argument to an array of public subnet IDs.","If the VPC is an SST `sst.aws.Vpc` reference, recreate/update it with `publicSubnets` configured and redeploy, then redeploy the app.","If the task does not actually need to be public, set `public: false` so it can use private/container subnets."],"exampleFix":"// before\nnew sst.aws.Cluster(\"Cluster\", {\n  vpc: { id: \"vpc-123\", containerSubnets: [\"subnet-a\"], privateSubnets: [\"subnet-b\"] }\n});\nnew sst.aws.Task(\"Task\", { cluster: cluster, public: true });\n// after\nnew sst.aws.Cluster(\"Cluster\", {\n  vpc: {\n    id: \"vpc-123\",\n    containerSubnets: [\"subnet-a\"],\n    privateSubnets: [\"subnet-b\"],\n    publicSubnets: [\"subnet-c\"]\n  }\n});\nnew sst.aws.Task(\"Task\", { cluster: cluster, public: true });","handlingStrategy":"validation","validationCode":"const clusterVpc = { id: \"vpc-123\", publicSubnets: [], containerSubnets: [\"subnet-a\"] };\nif (isPublicTask && (!clusterVpc.publicSubnets || clusterVpc.publicSubnets.length === 0)) {\n  throw new Error(\"Cluster vpc must define publicSubnets for tasks with public: true\");\n}","typeGuard":"function hasPublicSubnets(v: { publicSubnets?: string[] }): v is { publicSubnets: string[] } {\n  return Array.isArray(v.publicSubnets) && v.publicSubnets.length > 0;\n}","tryCatchPattern":null,"preventionTips":["When enabling `public: true` on a Task, immediately add `publicSubnets` to the Cluster's vpc config.","Prefer referencing an `sst.aws.Vpc` component (which manages subnets) over hand-written vpc object literals.","Document required subnet roles (public/private/container) in your infra config module."],"tags":["vpc","network","ecs","subnet"],"backgroundTag":"missing-public-subnet","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}