{"record":{"id":"bd3d122c2c4e034f","repo":"anomalyco/sst","slug":"the-vpc-configured-for-the-service-does-not-have-n","errorCode":null,"errorMessage":"The VPC configured for the service does not have NAT enabled. Enable NAT by configuring \"nat\" on the \"sst.aws.Vpc\" component.","messagePattern":"The VPC configured for the service does not have NAT enabled\\. Enable NAT by configuring \"nat\" on the \"sst\\.aws\\.Vpc\" component\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/service-v1.ts","lineNumber":153,"sourceCode":"          ([domain, loadBalancer]) =>\n            domain ? `https://${domain}/` : `http://${loadBalancer}`,\n        );\n\n    registerHint();\n    registerReceiver();\n\n    function normalizeVpc() {\n      // \"vpc\" is a Vpc component\n      if (args.vpc instanceof Vpc) {\n        const result = {\n          id: args.vpc.id,\n          publicSubnets: args.vpc.publicSubnets,\n          privateSubnets: args.vpc.privateSubnets,\n          securityGroups: args.vpc.securityGroups,\n        };\n        return args.vpc.nodes.natGateways.apply((natGateways) => {\n          if (natGateways.length === 0)\n            throw new VisibleError(\n              `The VPC configured for the service does not have NAT enabled. Enable NAT by configuring \"nat\" on the \"sst.aws.Vpc\" component.`,\n            );\n          return result;\n        });\n      }\n\n      // \"vpc\" is object\n      return output(args.vpc);\n    }\n\n    function normalizeRegion() {\n      return getRegionOutput(undefined, { parent: self }).region;\n    }\n\n    function normalizeArchitecture() {\n      return output(args.architecture ?? \"x86_64\").apply((v) => v);\n    }\n","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/service-v1.ts#L135-L171","documentation":"The `sst.aws.Service` component requires its private subnets to have outbound internet access via NAT gateways. During `normalizeVpc`, SST inspects the referenced Vpc's `nodes.natGateways`; if the list is empty, the service would deploy but never pull images or reach the internet, so it throws instead.","triggerScenarios":"Passing a `vpc` created with `sst.aws.Vpc` where `nat: { name: \"none\" }` (or default with no NAT) while deploying a Service into it; referencing a VPC whose NAT gateways haven't been created.","commonSituations":"Cost-saving VPC configs without NAT; reusing a VPC built for bastion/internal workloads; forgetting `nat` args when migrating from a VPC that had NAT.","solutions":["Add NAT to the VPC: set `nat: { name: \"NAT\" }` (or per-AZ NATs) on the `sst.aws.Vpc` component and redeploy","Use a different VPC that has NAT enabled for this service","If the service truly needs no outbound access, use a VPC component/config that supports it or pre-bake the image without runtime pulls — but the component still requires NAT, so enabling NAT is the fix"],"exampleFix":"// before\nconst vpc = new sst.aws.Vpc(\"Vpc\", { nat: { name: \"none\" } });\nnew sst.aws.Service(\"Api\", { vpc });\n// after\nconst vpc = new sst.aws.Vpc(\"Vpc\", { nat: { name: \"NAT\" } });\nnew sst.aws.Service(\"Api\", { vpc });","handlingStrategy":"validation","validationCode":"// ensure VPC has NAT before creating the service\nif (!vpcArgs.nat || vpcArgs.nat.name === \"none\") {\n  throw new Error(\"Service requires a VPC with NAT enabled.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set `nat: { name: \"NAT\" }` on VPCs used by services","Keep a shared VPC component for NAT-enabled networking","Budget for NAT gateway cost upfront to avoid later removals"],"tags":["vpc","nat","network","ecs"],"backgroundTag":"vpc-missing-nat","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}