remotion-dev/remotion · error · TypeError

parameter 'vpcSecurityGroupIds' must either be 'undefined' o

Error message

parameter 'vpcSecurityGroupIds' must either be 'undefined' or a comma-separated list of VPC security group IDs string, but instead got: ${vpcSecurityGroupIds}

What it means

Thrown by validateVpcSecurityGroupIds() in @remotion/lambda when vpcSecurityGroupIds is provided (not undefined) and is not a string. The argument must be a comma-separated string of AWS security group IDs (e.g. 'sg-0123456789abcdef0') or undefined. Important caveat: due to the boolean structure of the guard (typeof !== 'string' short-circuits the regex helper) and a forEach bug in isValidVpcSecurityGroupIdList (return false inside the arrow does not stop iteration), malformed-but-string IDs do NOT trigger this error; only non-string, non-undefined values do.

Source

Thrown at packages/lambda/src/shared/validate-vpc-security-group-ids.ts:17

const isValidVpcSecurityGroupIdList = (vpcSecurityGroupIds: string) => {
	const securityGroupIdRegex = /^sg-[0-9a-f]{17}$/;
	vpcSecurityGroupIds.split(',').forEach((securityGroupId) => {
		if (!securityGroupIdRegex.test(securityGroupId.trim())) {
			return false;
		}
	});
	return true;
};

export const validateVpcSecurityGroupIds = (vpcSecurityGroupIds: unknown) => {
	if (
		typeof vpcSecurityGroupIds !== 'undefined' &&
		typeof vpcSecurityGroupIds !== 'string' &&
		!isValidVpcSecurityGroupIdList(vpcSecurityGroupIds as string)
	) {
		throw new TypeError(
			`parameter 'vpcSecurityGroupIds' must either be 'undefined' or a comma-separated list of VPC security group IDs string, but instead got: ${vpcSecurityGroupIds}`,
		);
	}
};

View on GitHub (pinned to 78fe4bb3fd)

Solutions

Pass a comma-separated string: vpcSecurityGroupIds: 'sg-aaaa...,sg-bbbb...'.
Pass undefined (or omit) when not using a VPC.
Convert arrays before calling: ids.join(',').

Example fix

// before
await deployFunction({ vpcSecurityGroupIds: ['sg-0123456789abcdef0', 'sg-fedcba9876543210'] });

// after
await deployFunction({ vpcSecurityGroupIds: ['sg-0123456789abcdef0', 'sg-fedcba9876543210'].join(',') });

Defensive patterns

Strategy: type-guard

Validate before calling

function toVpcIds(v: unknown): string | undefined {
  if (v === undefined || v === null) return undefined;
  if (Array.isArray(v)) return v.filter(Boolean).join(',');
  return typeof v === 'string' ? v : undefined;
}

Type guard

const isOptionalVpcIdString = (v: unknown): v is string | undefined =>
  v === undefined || typeof v === 'string';

Prevention

Pass VPC IDs as a single comma-separated string, not an array.
Use undefined (omit) when not deploying into a VPC.
Be aware the validator does not catch malformed-but-string IDs; format them yourself.

When it happens

Trigger: Passing vpcSecurityGroupIds as an array (['sg-...']), an object, a number, or null to deployFunction(). Passing a string always passes validation regardless of format.

Common situations: Treating the option as an array because VPC config in AWS SDKs typically uses arrays; passing null intending 'no VPC'; reading from a YAML config that parses a single value as a non-string.

Related errors

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/e06d93624408cfc9. Report an issue: GitHub.