anomalyco/sst · error

ErrPassphraseInvalid

ErrPassphraseInvalid

Error message

passphrase invalid

What it means

ErrPassphraseInvalid is returned by Project.Run when the Pulumi secrets passphrase fails to decrypt existing state secrets. Run converts the underlying Pulumi decryption failure into this sentinel (pkg/project/run.go:231,239) so callers can detect a wrong or missing PULUMI_CONFIG_PASSPHRASE.

Source

Thrown at pkg/project/stack.go:119

}

type StackCommandEvent struct {
	App     string
	Stage   string
	Config  string
	Command string
	Version string
}

type Error struct {
	Message string   `json:"message"`
	URN     string   `json:"urn"`
	Help    []string `json:"help"`
}

var ErrStackRunFailed = fmt.Errorf("stack run had errors")
var ErrStageNotFound = fmt.Errorf("stage not found")
var ErrPassphraseInvalid = fmt.Errorf("passphrase invalid")
var ErrProtectedStage = fmt.Errorf("cannot remove protected stage")
var ErrProtectedDevStage = fmt.Errorf("cannot run sst dev on protected stage")
var ErrPolicyViolation = fmt.Errorf("policy violations detected")
var ErrPolicyConfigError = fmt.Errorf("policy configuration error")

func (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {
	var resolvedPath string
	if filepath.IsAbs(policyPath) {
		resolvedPath = policyPath
	} else {
		resolvedPath = filepath.Join(p.PathRoot(), policyPath)
	}

	if _, err := os.Stat(resolvedPath); err != nil {
		return "", fmt.Errorf("Policy pack not found in path: %v", resolvedPath)
	}

	return resolvedPath, nil

View on GitHub (pinned to a0bd20f762)

Solutions

1. Set PULUMI_CONFIG_PASSPHRASE to the exact passphrase used when the stack was first deployed (check CI secrets config vs local env).
2. Ensure the env var is actually exported in the environment running sst (a missing var can surface as decryption failure).
3. If the original passphrase is lost, the encrypted secrets cannot be recovered — recreate the stack or replace encrypted secret values with a new passphrase.
4. Standardize passphrase delivery (e.g. shared secret manager) so all environments use the same value.

Example fix

// before
cmd.Env = os.Environ() // PULUMI_CONFIG_PASSPHRASE missing

// after
if os.Getenv("PULUMI_CONFIG_PASSPHRASE") == "" {
	os.Setenv("PULUMI_CONFIG_PASSPHRASE", os.Getenv("SST_PASSPHRASE_FROM_SECRET_MANAGER"))
}

if os.Getenv("PULUMI_CONFIG_PASSPHRASE") == "" {
	return fmt.Errorf("PULUMI_CONFIG_PASSPHRASE must be set to decrypt stack secrets")
}

err := project.Run(ctx, input)
if errors.Is(err, stack.ErrPassphraseInvalid) {
	log.Error("secrets passphrase does not match the one used at first deploy; check PULUMI_CONFIG_PASSPHRASE")
	return err
}

When it happens

Trigger: Running any command that must decrypt secrets in existing state (e.g. Run at pkg/project/run.go:124 getCompletedEvent or secret setup) with a PULUMI_CONFIG_PASSPHRASE that differs from the one used when the stack's secrets were encrypted.

Common situations: Missing or different PULUMI_CONFIG_PASSPHRASE env var in CI vs. local; a teammate each set their own passphrase; passphrase set after the stack was first deployed with a different one; secrets manager/passphrase provider misconfigured between environments.

Related errors

• Failed to get password for Postgres ${name}.
• ErrStateNotFound
• ErrStackRunFailed
• ErrStageNotFound

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/0ac317af53b39f47. Report an issue: GitHub.