如何在SST中引用Terraform管理的现有VPC且无需重新部署？

执行sst deploy --stage dev部署时遇到报错：

There have been some minor changes to the "Vpc" component that's being referenced by "MyVPC".

To update, you'll need to redeploy the stage where the VPC was created. And then redeploy this stage.

我的VPC完全由Terraform管理，未通过SST创建。原本尝试通过以下代码引用该VPC并关联到Lambda：

const myVpc = sst.aws.Vpc.get("MyVPC", vpcId);

const myLambda = new sst.aws.Function(
  `${stage.toUpperCase()}-StreamConsumer`,
  {
    name: `${stage}-fun-sst-stream-consumer`,
    handler: "functions/consumer.main",
    runtime: "nodejs22.x",
    timeout: "60 seconds",
    vpc: myVpc,
    permissions: [
      {
        actions: [
          "kinesis:GetRecords",
          "kinesis:GetShardIterator",
          "kinesis:DescribeStream",
          "kinesis:DescribeStreamSummary",
          "kinesis:ListShards",
          "kinesis:ListStreams",
        ],
        resources: [streamArn],
      },
    ],
  }
);

期望Lambda部署到现有VPC中，且SST不管理或重新部署该VPC，但部署失败，报错要求重新部署VPC所在环境。

问题出在使用了sst.aws.Vpc.get方法，这个方法是用来引用SST自身创建并管理的VPC组件实例，会让SST试图跟踪该VPC的状态变更，而你的VPC由Terraform管理，不属于SST的组件范围，因此触发了错误提示。

正确的引用方式有两种：

方式1：直接在Function的vpc配置中指定VPC ID #

不需要创建Vpc实例，直接在Function的vpc字段里传入VPC ID，还可按需指定子网和安全组：

const myLambda = new sst.aws.Function(
  `${stage.toUpperCase()}-StreamConsumer`,
  {
    name: `${stage}-fun-sst-stream-consumer`,
    handler: "functions/consumer.main",
    runtime: "nodejs22.x",
    timeout: "60 seconds",
    vpc: {
      id: vpcId,
      // 可选：指定子网（若需要限定Lambda部署的子网）
      // subnets: ["subnet-xxxxxx", "subnet-yyyyyy"],
      // 可选：指定安全组（若需要自定义网络访问规则）
      // securityGroups: ["sg-xxxxxx"]
    },
    permissions: [
      {
        actions: [
          "kinesis:GetRecords",
          "kinesis:GetShardIterator",
          "kinesis:DescribeStream",
          "kinesis:DescribeStreamSummary",
          "kinesis:ListShards",
          "kinesis:ListStreams",
        ],
        resources: [streamArn],
      },
    ],
  }
);

方式2：使用sst.aws.Vpc.fromLookup引用外部VPC #

如果需要复用VPC配置，可通过fromLookup方法获取外部VPC的信息，该方法仅查询现有VPC的元数据，不会让SST试图管理它：

const myVpc = sst.aws.Vpc.fromLookup("MyVPC", {
  vpcId: vpcId
});

const myLambda = new sst.aws.Function(
  `${stage.toUpperCase()}-StreamConsumer`,
  {
    name: `${stage}-fun-sst-stream-consumer`,
    handler: "functions/consumer.main",
    runtime: "nodejs22.x",
    timeout: "60 seconds",
    vpc: myVpc,
    permissions: [
      {
        actions: [
          "kinesis:GetRecords",
          "kinesis:GetShardIterator",
          "kinesis:DescribeStream",
          "kinesis:DescribeStreamSummary",
          "kinesis:ListShards",
          "kinesis:ListStreams",
        ],
        resources: [streamArn],
      },
    ],
  }
);

两种方式都能让SST仅将Lambda关联到现有VPC，不会试图管理或重新部署该VPC，解决部署报错问题。

内容的提问来源于stack exchange，提问作者K Chandrasekar