{"record":{"id":"500cc45550539c9c","repo":"anomalyco/sst","slug":"vpc-bastion-is-not-enabled-enable-it-with-bastio","errorCode":null,"errorMessage":"VPC bastion is not enabled. Enable it with \"bastion: true\" or \"bastion: { instanceProfile: \\\"name\\\" }\".","messagePattern":"VPC bastion is not enabled\\. Enable it with \"bastion: true\" or \"bastion: (.+?)\"\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/vpc.ts","lineNumber":1510,"sourceCode":"    return this._privateSubnets.apply((subnets) =>\n      subnets.map((subnet) => subnet.id),\n    );\n  }\n\n  /**\n   * A list of VPC security group IDs.\n   */\n  public get securityGroups() {\n    return output(this.securityGroup).apply((v) => [v.id]);\n  }\n\n  /**\n   * The bastion instance ID.\n   */\n  public get bastion() {\n    return this.bastionInstance.apply((v) => {\n      if (!v) {\n        throw new VisibleError(\n          `VPC bastion is not enabled. Enable it with \"bastion: true\" or \"bastion: { instanceProfile: \\\"name\\\" }\".`,\n        );\n      }\n      return v.id;\n    });\n  }\n\n  /**\n   * The underlying [resources](/docs/components/#nodes) this component creates.\n   */\n  public get nodes() {\n    return {\n      /**\n       * The Amazon EC2 VPC.\n       */\n      vpc: this.vpc,\n      /**\n       * The Amazon EC2 Internet Gateway.","sourceCodeStart":1492,"sourceCodeEnd":1528,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/vpc.ts#L1492-L1528","documentation":"Accessing the VPC's `bastion` getter (used to get the bastion instance ID, e.g. to give another resource access) throws when the bastion was never enabled on the VPC. Bastions must be explicitly opted into with `bastion: true` or a config object.","triggerScenarios":"Calling `vpc.bastion` (e.g. in an EC2 component's bastion argument) while the VPC was created without a bastion option, so bastionInstance is undefined.","commonSituations":"Copying a snippet that references vpc.bastion into a VPC that lacks `bastion: true`; someone removed the bastion flag but downstream code still reads the getter.","solutions":["Add `bastion: true` to the VPC constructor args.","Or `{ bastion: { instanceProfile: \"name\" } }` if you need a custom instance profile.","Remove the code that reads vpc.bastion if a bastion is not actually needed."],"exampleFix":"// before\nconst vpc = new sst.aws.Vpc(\"MyVPC\");\nnew sst.aws.Ec2(\"Box\", { vpc, bastion: vpc.bastion });\n// after\nconst vpc = new sst.aws.Vpc(\"MyVPC\", { bastion: true });\nnew sst.aws.Ec2(\"Box\", { vpc, bastion: vpc.bastion });","handlingStrategy":"validation","validationCode":"// ensure bastion is enabled before referencing vpc.bastion\nconst vpcArgs = { bastion: true }; // required whenever vpc.bastion is read below","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set bastion: true on VPCs whose bastion getter is used elsewhere","Grep config for 'vpc.bastion' usage and verify each VPC enables bastion","Note that the getter throws at deploy time, not at config time — keep flags and usage in the same file if possible"],"tags":["vpc","bastion","config-validation","aws"],"backgroundTag":"feature-not-enabled","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}