🚨 AWS Error: 'The security group does not exist in VPC' (InvalidGroup.NotFound) — Cause, Fix, and Troubleshooting Guide

Overview

Security groups are scoped to a single VPC and region. When you reference a security group by an ID that doesn’t exist, was deleted, or belongs to a different VPC than the one you’re launching into, EC2 rejects the call with InvalidGroup.NotFound. The error explicitly names the group and the VPC it couldn’t find it in, which is the key to diagnosing it.

You will see it surface from the CLI, an SDK, or Terraform:

An error occurred (InvalidGroup.NotFound) when calling the RunInstances operation: The security group 'sg-0abc123REDACTED' does not exist in VPC 'vpc-0def456REDACTED'

It occurs when a launch, ENI creation, or resource update references a security group that isn’t valid for the target VPC/region — commonly after an SG is recreated with a new ID, or when a launch template/AMI carries a stale group.

Symptoms

• RunInstances, CreateNetworkInterface, ModifyInstanceAttribute, or an Auto Scaling launch fails with InvalidGroup.NotFound.
• Terraform apply fails referencing an sg-... that “was there yesterday.”
• A launch template that worked before now fails after the referenced SG was replaced.
• The same SG ID works in one account/region but not another.

aws ec2 run-instances --image-id ami-REDACTED --instance-type t3.micro \
  --security-group-ids sg-0abc123REDACTED --subnet-id subnet-REDACTED

An error occurred (InvalidGroup.NotFound) when calling the RunInstances operation: The security group 'sg-0abc123REDACTED' does not exist in VPC 'vpc-0def456REDACTED'

Common Root Causes

1. The security group is in a different VPC

You’re launching into subnet-... (in one VPC) but the SG belongs to another VPC. Security groups cannot span VPCs.

2. The SG was deleted and recreated with a new ID

Infrastructure was rebuilt; the old sg-... no longer exists and a new ID replaced it, but a template/config still points at the old one.

3. Wrong region

The SG exists, but in a different region than the one your CLI/SDK is targeting.

4. Using a group name where an ID is required

In a non-default VPC you must use --security-group-ids (the sg-... ID), not --security-groups (names); a name is only valid for EC2-Classic/default VPC.

5. Stale IaC state or a hardcoded ID

Terraform state, a launch template, or a hardcoded pipeline variable references an SG that has since changed.

How to diagnose

Step 1: Confirm the SG exists and note its VPC

aws ec2 describe-security-groups --group-ids sg-0abc123REDACTED \
  --query 'SecurityGroups[].[GroupId,VpcId]' --output text

An error here means the ID is gone or in another region; a VpcId that differs from your subnet’s VPC is the mismatch.

Step 2: Find the VPC of the subnet you’re launching into

aws ec2 describe-subnets --subnet-ids subnet-REDACTED \
  --query 'Subnets[].VpcId' --output text

Compare with Step 1 — they must match.

Step 3: Rule out a region mismatch

aws configure get region
aws ec2 describe-security-groups --filters "Name=group-name,Values=app-sg" \
  --query 'SecurityGroups[].[GroupId,VpcId]' --output table

Fixes

Reference an SG that belongs to the target VPC

Find (or create) the correct group in the launch VPC and use its ID:

aws ec2 describe-security-groups \
  --filters "Name=vpc-id,Values=vpc-0def456REDACTED" "Name=group-name,Values=app-sg" \
  --query 'SecurityGroups[0].GroupId' --output text

Update stale templates / IaC to the current ID

Refresh the launch template version or Terraform state so it references the live sg-...:

aws ec2 create-launch-template-version --launch-template-id lt-REDACTED \
  --source-version 1 --launch-template-data '{"SecurityGroupIds":["sg-NEWid"]}'

Set the correct region

aws ec2 run-instances --region eu-west-1 --security-group-ids sg-0abc123REDACTED ...

What to watch out for

• The error message already tells you the VPC it searched — compare that to your subnet’s VPC first.
• Reference security groups by attribute (name + VPC) in IaC rather than hardcoded IDs so a recreate doesn’t strand consumers.
• In non-default VPCs, always pass --security-group-ids, never --security-groups.
• An SG recreated by Terraform gets a new ID; downstream launch templates/ASGs need updating in the same apply.

Related

• AWS Error: ‘InvalidSubnetID.NotFound’ — the sibling error for a missing subnet.
• AWS Error: ‘DependencyViolation’ — why a security group can’t be deleted (and gets recreated with a new ID).
• AWS Error: ‘UnauthorizedOperation’ on EC2 — permission failures on the same EC2 launch calls.