anomalyco/sst · error

ErrPolicyConfigError

ErrPolicyConfigError

Error message

policy configuration error

What it means

ErrPolicyConfigError is returned by Project.Run when a policy pack was requested via --policy-path but the policy engine produced no policy events and no stack errors, while the command still exited non-zero. It signals the policy setup itself is broken (e.g. the pack could not be loaded/executed), rather than actual violations.

Source

Thrown at pkg/project/stack.go:123

	Stage   string
	Config  string
	Command string
	Version string
}

type Error struct {
	Message string   `json:"message"`
	URN     string   `json:"urn"`
	Help    []string `json:"help"`
}

var ErrStackRunFailed = fmt.Errorf("stack run had errors")
var ErrStageNotFound = fmt.Errorf("stage not found")
var ErrPassphraseInvalid = fmt.Errorf("passphrase invalid")
var ErrProtectedStage = fmt.Errorf("cannot remove protected stage")
var ErrProtectedDevStage = fmt.Errorf("cannot run sst dev on protected stage")
var ErrPolicyViolation = fmt.Errorf("policy violations detected")
var ErrPolicyConfigError = fmt.Errorf("policy configuration error")

func (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {
	var resolvedPath string
	if filepath.IsAbs(policyPath) {
		resolvedPath = policyPath
	} else {
		resolvedPath = filepath.Join(p.PathRoot(), policyPath)
	}

	if _, err := os.Stat(resolvedPath); err != nil {
		return "", fmt.Errorf("Policy pack not found in path: %v", resolvedPath)
	}

	return resolvedPath, nil
}

func (p *Project) Lock(command string) (*provider.Update, error) {
	return provider.Lock(p.home, p.Version(), command, p.app.Name, p.app.Stage)

View on GitHub (pinned to a0bd20f762)

Solutions

1. Fix the --policy-path value or move the policy pack so that <project-root>/<policyPath> exists (absolute paths are used as-is; relative paths resolve against the project root, see pkg/project/stack.go:127-131).
2. Verify the pack contains a valid PulumiPolicy.yaml and its runtime dependencies are installed (e.g. `bun install`/`npm install` inside the pack).
3. Test the pack standalone with `pulumi policy run` or a plain `sst deploy --policy-path <abs path>` to isolate the issue.
4. If the policy check is optional locally, omit --policy-path so the flag (and thus this error path) is not triggered.

Example fix

// before
sst deploy --policy-path ./policies/por
// after — corrected path to the existing pack
sst deploy --policy-path ./policies/pack

const fs = require("fs");
const path = require("path");
// Mirror ResolvePolicyPackPath: absolute used as-is, relative joined to project root
const resolved = path.isAbsolute(policyPath)
  ? policyPath
  : path.join(projectRoot, policyPath);
if (!fs.existsSync(resolved)) {
  throw new Error(`Policy pack not found: ${resolved}`);
}
if (!fs.existsSync(path.join(resolved, "PulumiPolicy.yaml"))) {
  throw new Error(`Missing PulumiPolicy.yaml in ${resolved}`);
}

err := project.Run(ctx, &project.StackInput{Command: "deploy", PolicyPath: policyPath})
if errors.Is(err, project.ErrPolicyConfigError) {
    log.Printf("policy pack configured but produced no events; check pack path '%s' and its PulumiPolicy.yaml", policyPath)
    return
} else if err != nil {
    return err
}

When it happens

Trigger: In Project.Run: hasPolicyFlag (input.PolicyPath != "") is true, hasPolicyEvents is false, len(errors) == 0, and cmd.ProcessState.ExitCode() > 0 (pkg/project/run.go:691-693). Also ResolvePolicyPackPath (pkg/project/stack.go:125-138) fails when the configured policyPath does not exist on disk after joining with the project root.

Common situations: Typo in the --policy-path argument or the pack folder moved/renamed; running sst from a different working directory so a relative policy path resolves to the wrong location; policy pack missing PulumiPolicy.yaml or an incompatible Node/Python runtime inside the pack.

Related errors

• Policy pack not found in path: %v
• Invalid function definition for the "${name}" Function
• Cannot access `nodes.loadBalancer` when no public ports are
• You must provide the ports to expose via "loadBalancer.rules
• You must provide a container name in "loadBalancer.rules" wh

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/efaae1584f4c71d5. Report an issue: GitHub.