{"record":{"id":"457d5d59308b68ee","repo":"anomalyco/sst","slug":"the-nat-type-cannot-be-managed-when-nat-ec2","errorCode":null,"errorMessage":"The \"nat.type\" cannot be \"managed\" when \"nat.ec2\" is specified.","messagePattern":"The \"nat\\.type\" cannot be \"managed\" when \"nat\\.ec2\" is specified\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/vpc.ts","lineNumber":863,"sourceCode":"            .map((_, i) => zones.names[i]),\n        );\n      });\n    }\n\n    function normalizeNat() {\n      return all([args.nat, zones]).apply(([nat, zones]) => {\n        if (nat === \"managed\") {\n          return { type: \"managed\" as const };\n        }\n        if (nat === \"ec2\") {\n          return {\n            type: \"ec2\" as const,\n            ec2: { instance: \"t4g.nano\", ami: undefined, role: undefined },\n          };\n        }\n        if (nat) {\n          if (nat.ec2 && nat.type === \"managed\")\n            throw new VisibleError(\n              `The \"nat.type\" cannot be \"managed\" when \"nat.ec2\" is specified.`,\n            );\n\n          if (!nat.type && !nat.ec2)\n            throw new VisibleError(\n              `Missing \"nat.type\" for the \"${name}\" VPC. It is required when \"nat.ec2\" is not specified.`,\n            );\n\n          if (nat.ip && nat.ip.length !== zones.length)\n            throw new VisibleError(\n              `The number of Elastic IP allocation IDs must match the number of AZs.`,\n            );\n\n          return nat.ec2 || nat.type === \"ec2\"\n            ? {\n                type: \"ec2\" as const,\n                ip: nat.ip,\n                ec2: {","sourceCodeStart":845,"sourceCodeEnd":881,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/vpc.ts#L845-L881","documentation":"Thrown by the VPC's normalizeNat when the user configures both `nat.ec2` (a custom EC2 NAT instance block) and `nat.type: \"managed\"` (AWS-managed NAT gateways). These two NAT modes are mutually exclusive: you either use managed NAT gateways or you supply your own EC2 NAT instance configuration.","triggerScenarios":"Passing an object like `{ nat: { type: \"managed\", ec2: { instance: \"t4g.nano\" } } }` to `new sst.aws.Vpc()` — setting nat.ec2 while nat.type is \"managed\".","commonSituations":"Copy-pasting NAT config examples and leaving both keys; migrating from managed NAT to EC2 NAT by adding ec2 without removing/removing type; schema confusion about which property wins.","solutions":["Remove `nat.ec2` to use managed NAT gateways.","Or change `nat.type` to \"ec2\" (or omit type) when supplying `nat.ec2`.","Use `sst.env`/config typing or IDE hints to confirm only one NAT mode is set."],"exampleFix":"// before\nnew sst.aws.Vpc(\"MyVPC\", { nat: { type: \"managed\", ec2: { instance: \"t4g.nano\" } } });\n// after\nnew sst.aws.Vpc(\"MyVPC\", { nat: { ec2: { instance: \"t4g.nano\" } } });","handlingStrategy":"validation","validationCode":"function validateNat(nat) {\n  if (nat && nat.ec2 && nat.type === \"managed\")\n    throw new Error('Remove either nat.ec2 or set nat.type to \"ec2\".');\n}\nvalidateNat(args.nat);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only set nat.ec2 OR nat.type, never both managed+ec2","When migrating from managed to EC2 NAT, delete the type field","Keep VPC config in one reviewed block to avoid duplicated/merged keys"],"tags":["vpc","nat","config-validation","aws"],"backgroundTag":"conflicting-vpc-nat-config","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}