{"record":{"id":"874ab8f881f3641f","repo":"anomalyco/sst","slug":"security-group-not-found-in-vpc-vpcid","errorCode":null,"errorMessage":"Security group not found in VPC ${vpcID}","messagePattern":"Security group not found in VPC (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"platform/src/components/aws/vpc-v1.ts","lineNumber":506,"sourceCode":"    const vpc = ec2.Vpc.get(`${name}Vpc`, vpcID);\n    const internetGateway = ec2.InternetGateway.get(\n      `${name}InstanceGateway`,\n      ec2.getInternetGatewayOutput({\n        filters: [{ name: \"attachment.vpc-id\", values: [vpc.id] }],\n      }).internetGatewayId,\n    );\n    const securityGroup = ec2.SecurityGroup.get(\n      `${name}SecurityGroup`,\n      ec2\n        .getSecurityGroupsOutput({\n          filters: [\n            { name: \"group-name\", values: [\"*SecurityGroup*\"] },\n            { name: \"vpc-id\", values: [vpc.id] },\n          ],\n        })\n        .ids.apply((ids) => {\n          if (!ids.length)\n            throw new Error(`Security group not found in VPC ${vpcID}`);\n          return ids[0];\n        }),\n    );\n    const privateSubnets = ec2\n      .getSubnetsOutput({\n        filters: [\n          { name: \"vpc-id\", values: [vpc.id] },\n          { name: \"tag:Name\", values: [\"*Private*\"] },\n        ],\n      })\n      .ids.apply((ids) =>\n        ids.map((id, i) => ec2.Subnet.get(`${name}PrivateSubnet${i + 1}`, id)),\n      );\n    const privateRouteTables = privateSubnets.apply((subnets) =>\n      subnets.map((subnet, i) =>\n        ec2.RouteTable.get(\n          `${name}PrivateRouteTable${i + 1}`,\n          ec2.getRouteTableOutput({ subnetId: subnet.id }).routeTableId,","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/vpc-v1.ts#L488-L524","documentation":"vpc-v1.ts looks up the default security group created alongside a V1 SST VPC by filtering ec2 security groups with name pattern `*SecurityGroup*` in the given VPC. When the AWS API returns no matching IDs, the `get` helper throws a plain Error, meaning the VPC being referenced no longer contains the SST-managed security group.","triggerScenarios":"Referencing (via `sst.aws.Vpc.get`) an existing VPC whose default `*SecurityGroup*` was deleted manually, created outside SST, or belongs to a VPC ID that does not match the region/account being deployed in.","commonSituations":"Someone deleted the security group in the AWS console; the VPC was created by another tool without the naming convention; deploying into the wrong AWS region or profile so the VPC/SG lookup finds nothing; a partially failed `sst remove` that deleted the SG but kept the VPC.","solutions":["Verify the VPC exists and contains a security group named like `*SecurityGroup*` in the target region (`aws ec2 describe-security-groups --filters Name=vpc-id,Values=<vpc-id>`).","Recreate the missing security group (or recreate the VPC via `sst deploy` in the stage that owns it) so the lookup succeeds.","Confirm you are deploying with the correct AWS profile/region that contains the VPC."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { EC2Client, DescribeSecurityGroupsCommand } from \"@aws-sdk/client-ec2\";\nconst sg = await new EC2Client({}).send(new DescribeSecurityGroupsCommand({\n  Filters: [\n    { Name: \"group-name\", Values: [\"*SecurityGroup*\"] },\n    { Name: \"vpc-id\", Values: [vpcId] }\n  ]\n}));\nif (!sg.SecurityGroups?.length) throw new Error(`VPC ${vpcId} lacks the SST security group; recreate the VPC stage first.`);","typeGuard":"function hasSecurityGroups(r: { SecurityGroups?: { GroupId?: string }[] | undefined }): boolean {\n  return !!r.SecurityGroups && r.SecurityGroups.length > 0;\n}","tryCatchPattern":"try {\n  const vpc = sst.aws.Vpc.get(\"Vpc\", { id: vpcId });\n} catch (e) {\n  if (String(e).includes(\"Security group not found\")) {\n    // redeploy the owning stage or recreate the SG before continuing\n  }\n  throw e;\n}","preventionTips":["Never delete the SST-created `*SecurityGroup*` from a managed VPC in the AWS console.","Always run VPC-related deploys with the same AWS profile/region used to create the VPC.","Before `Vpc.get`, verify the VPC and its SGs exist via `aws ec2 describe-security-groups`."],"tags":["vpc","aws","security-group","lookup"],"backgroundTag":"security-group-not-found","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}