{"record":{"id":"9b0663dc1fcf2c44","repo":"anomalyco/sst","slug":"the-alb-vpc-albvpcid-does-not-match-the-clust","errorCode":null,"errorMessage":"The ALB VPC \"${albVpcId}\" does not match the cluster VPC \"${clusterVpcId}\" in Service \"${name}\". The ALB and cluster must be in the same VPC.","messagePattern":"The ALB VPC \"(.+?)\" does not match the cluster VPC \"(.+?)\" in Service \"(.+?)\"\\. The ALB and cluster must be in the same VPC\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/service.ts","lineNumber":1830,"sourceCode":"      architecture,\n      cpu,\n      memory,\n      storage,\n      taskRole,\n      executionRole,\n    );\n    let loadBalancer: lb.LoadBalancer | undefined;\n    let targetGroups: ReturnType<typeof createTargets>;\n    let targetEntries: Output<{ targetGroup: lb.TargetGroup; containerName: string; containerPort: number }[]>;\n    let effectiveLbArn: Output<string> | undefined;\n    let effectiveDomain: Output<string | undefined>;\n    let effectiveDnsName: Output<string> | undefined;\n    const certificateArn = albAttachment ? output(undefined) : createSsl();\n    if (albAttachment) {\n      all([albAttachment.instance._vpc, vpc.id]).apply(\n        ([albVpcId, clusterVpcId]) => {\n          if (albVpcId !== clusterVpcId) {\n            throw new VisibleError(\n              `The ALB VPC \"${albVpcId}\" does not match the cluster VPC \"${clusterVpcId}\" in Service \"${name}\". The ALB and cluster must be in the same VPC.`,\n            );\n          }\n        },\n      );\n      const { targets: albTargets, entries: albEntries } = createAlbTargetsAndEntries(albAttachment);\n      targetGroups = output(albTargets);\n      targetEntries = albEntries;\n      createAlbListenerRules(albAttachment, albTargets);\n      effectiveLbArn = albAttachment.instance.arn;\n      effectiveDomain = output(undefined);\n      effectiveDnsName = albAttachment.instance.dnsName;\n    } else {\n      loadBalancer = createLoadBalancer();\n      targetGroups = createTargets();\n      targetEntries = computeTargetEntries();\n      createListeners();\n      createDnsRecords();","sourceCodeStart":1812,"sourceCodeEnd":1848,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/service.ts#L1812-L1848","documentation":"When a `Service` is attached to an external ALB (`albAttachment`), SST validates at deploy time that the ALB's VPC matches the ECS cluster's VPC, since target groups cannot register targets across VPCs. If the IDs differ, a `VisibleError` naming both VPC IDs and the service is thrown.","triggerScenarios":"Creating `new sst.aws.Service(...)` with a `loadBalancer` (ALB attachment) where the `Cluster` and the attached `sst.aws.LoadBalancer` were built in different VPCs (e.g. different `vpc` components, different `vpc.id` outputs).","commonSituations":"Attaching a service in a new VPC (often a fresh default VPC) to an ALB created in an older VPC; copying example code where the cluster and LB use different VPC props; multi-environment refactors that changed one VPC but not the other.","solutions":["Recreate the LoadBalancer (or Service) in the same VPC as the cluster — pass the same `vpc` component to both.","Verify `albAttachment.instance._vpc` and the Service's `vpc.id` come from the same VPC resource; fix any hardcoded or default VPC usage.","If they must stay separate, put a peering/TGW in place and use an internal LB per VPC — cross-VPC target registration is not supported."],"exampleFix":"// before\nconst cluster = new sst.aws.Cluster(\"Cluster\", { vpc });\nconst lb = new sst.aws.LoadBalancer(\"Lb\", { vpc: otherVpc });\nconst svc = new sst.aws.Service(\"Svc\", { cluster, loadBalancer: lb });\n\n// after\nconst lb = new sst.aws.LoadBalancer(\"Lb\", { vpc }); // same VPC as cluster\nconst svc = new sst.aws.Service(\"Svc\", { cluster, loadBalancer: lb });","handlingStrategy":"validation","validationCode":"// assert same VPC component is used for cluster and load balancer before constructing\nif (clusterVpc !== lbVpc) {\n  throw new Error(\"Cluster and LoadBalancer must share the same VPC\");\n}\nconst svc = new sst.aws.Service(\"Svc\", { cluster, loadBalancer: lb, vpc: clusterVpc });","typeGuard":"function sameVpc(a: { node: unknown }, b: { node: unknown }): boolean {\n  return a.node === b.node; // same VPC component instance\n}","tryCatchPattern":"try {\n  const svc = new sst.aws.Service(\"Svc\", { cluster, loadBalancer: lb });\n} catch (e) {\n  if (e instanceof VisibleError && e.message.includes(\"same VPC\")) {\n    // rebuild lb in cluster's VPC\n  } else throw e;\n}","preventionTips":["Always pass the same `vpc` component instance to Cluster, LoadBalancer, and Service.","Avoid mixing hardcoded default VPC IDs with custom VPC components.","When creating a new VPC, recreate dependent ALBs in it."],"tags":["aws","vpc","alb","ecs","sst"],"backgroundTag":"vpc-mismatch","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}