{"record":{"id":"f104d396a8272462","repo":"anomalyco/sst","slug":"security-group-not-found-in-vpc-vpcid-f104d3","errorCode":null,"errorMessage":"Security group not found in VPC ${vpcId}","messagePattern":"Security group not found in VPC (.+?)","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"critical","filePath":"platform/src/components/aws/vpc.ts","lineNumber":521,"sourceCode":"      );\n      const securityGroup = ec2.SecurityGroup.get(\n        `${name}SecurityGroup`,\n        all([\n          ec2\n            .getSecurityGroupsOutput(\n              {\n                filters: [\n                  { name: \"group-name\", values: [\"default\"] },\n                  { name: \"vpc-id\", values: [vpcId] },\n                ],\n              },\n              { parent: self },\n            )\n            .ids,\n          vpcId,\n        ]).apply(([ids, vpcId]) => {\n          if (!ids.length) {\n            throw new VisibleError(\n              `Security group not found in VPC ${vpcId}`,\n            );\n          }\n          return ids[0];\n        }),\n        undefined,\n        { parent: self },\n      );\n      const privateSubnets = ec2\n        .getSubnetsOutput(\n          {\n            filters: [\n              { name: \"vpc-id\", values: [vpcId] },\n              { name: \"tag:Name\", values: [\"*Private*\"] },\n            ],\n          },\n          { parent: self },\n        )","sourceCodeStart":503,"sourceCodeEnd":539,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/vpc.ts#L503-L539","documentation":"The V2 `Vpc.reference` path (platform/src/components/aws/vpc.ts:521) resolves the SST-managed security group(s) in the referenced VPC by ID lookup, then throws a VisibleError if the returned `ids` array is empty. Like error 187, it means the referenced VPC has no security group that SST can adopt for the consuming components.","triggerScenarios":"Calling `sst.aws.Vpc.get(name, { vpc: ... })` (or `ref`) for a VPC whose security groups were deleted, renamed to not match the SST filter, or when the vpcId is wrong/absent in the target region.","commonSituations":"Manual cleanup in the AWS console removed the SST security group; referencing a bare AWS-provided VPC not created by SST; wrong region/profile; the `sst:component-version` upgrade path left the VPC without expected SGs.","solutions":["Check the referenced VPC for its security groups (`aws ec2 describe-security-groups --filters Name=vpc-id,Values=<vpcId>`) and recreate any that were deleted.","Redeploy the stage that owns the VPC with SST so the security group is recreated, then redeploy this stage.","Confirm the region/profile and the vpcId passed to `Vpc.get` point at the intended SST-created VPC."],"exampleFix":"// before\nconst vpc = sst.aws.Vpc.get(\"Vpc\", { id: \"vpc-123\" }); // SG deleted manually -> throws\n// after\n// redeploy the owning stage to recreate SGs, then:\nconst vpc = sst.aws.Vpc.get(\"Vpc\", { id: \"vpc-123\" });","handlingStrategy":"validation","validationCode":"import { EC2Client, DescribeSecurityGroupsCommand } from \"@aws-sdk/client-ec2\";\nconst res = await new EC2Client({}).send(new DescribeSecurityGroupsCommand({\n  Filters: [{ Name: \"vpc-id\", Values: [vpcId] }]\n}));\nif (!res.SecurityGroups?.length) throw new Error(`VPC ${vpcId} has no security groups; recreate via SST before referencing.`);","typeGuard":"function vpcHasSecurityGroups(groups: { GroupId?: string }[] | undefined): groups is { GroupId: string }[] {\n  return Array.isArray(groups) && groups.length > 0;\n}","tryCatchPattern":"try {\n  const vpc = sst.aws.Vpc.get(\"Vpc\", { id: vpcId });\n} catch (e) {\n  if (String(e).includes(\"Security group not found\")) {\n    // recreate the security group or redeploy the VPC-owning stage\n  }\n  throw e;\n}","preventionTips":["Do not delete security groups in a referenced VPC outside of SST.","Verify the VPC was created by SST (it should carry sst:* tags) before calling Vpc.get.","Check region/profile consistency before deploying stages that reference the VPC."],"tags":["vpc","aws","security-group","reference"],"backgroundTag":"security-group-not-found","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}