anomalyco/sst · error

ErrPolicyViolation

ErrPolicyViolation

Error message

policy violations detected

What it means

ErrPolicyViolation is returned by Project.Run when the stack operation finished with a non-zero exit code AND the Pulumi policy pack reported violations during the run. It means deployed changes were rejected by the org's policy-as-code rules (e.g. forbidden instance types, missing tags, public buckets).

Source

Thrown at pkg/project/stack.go:122

	App     string
	Stage   string
	Config  string
	Command string
	Version string
}

type Error struct {
	Message string   `json:"message"`
	URN     string   `json:"urn"`
	Help    []string `json:"help"`
}

var ErrStackRunFailed = fmt.Errorf("stack run had errors")
var ErrStageNotFound = fmt.Errorf("stage not found")
var ErrPassphraseInvalid = fmt.Errorf("passphrase invalid")
var ErrProtectedStage = fmt.Errorf("cannot remove protected stage")
var ErrProtectedDevStage = fmt.Errorf("cannot run sst dev on protected stage")
var ErrPolicyViolation = fmt.Errorf("policy violations detected")
var ErrPolicyConfigError = fmt.Errorf("policy configuration error")

func (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {
	var resolvedPath string
	if filepath.IsAbs(policyPath) {
		resolvedPath = policyPath
	} else {
		resolvedPath = filepath.Join(p.PathRoot(), policyPath)
	}

	if _, err := os.Stat(resolvedPath); err != nil {
		return "", fmt.Errorf("Policy pack not found in path: %v", resolvedPath)
	}

	return resolvedPath, nil
}

func (p *Project) Lock(command string) (*provider.Update, error) {

View on GitHub (pinned to a0bd20f762)

Solutions

1. Read the policy violation details in the Pulumi logs (sst.json / pulumi log files) and change the offending resource definition to comply.
2. If the resource is intentionally non-compliant, add a policy exception/`remediation` or mark it as an approved exemption in the policy pack.
3. Ensure the correct policy pack version is being used — a stale pack may flag valid code.
4. Only if you have authority, deploy without the --policy-path flag (though CI may enforce it).

Example fix

// before (sst.config.ts / resource definition)
new sst.aws.Bucket("Data", { public: true });
// after — satisfy the no-public-buckets policy
new sst.aws.Bucket("Data", { public: false });

// Pre-flight: run diff with the policy pack to surface violations before deploy
// sst diff --policy-path ./policies/pack --stage <stage>
// Non-zero exit + violation output means deploy would return ErrPolicyViolation

err := project.Run(ctx, &project.StackInput{Command: "deploy", PolicyPath: policyPath})
switch {
case errors.Is(err, project.ErrPolicyViolation):
    log.Printf("deploy blocked by policy; see policy violation details in logs")
    // inspect sst.json / pulumi logs for the specific violating resources
    return
case err != nil:
    return err
}

When it happens

Trigger: Project.Run runs the Pulumi CLI with `--policy-pack` (input.PolicyPath set, hasPolicyFlag true) and hasPolicyEvents is true when cmd.ProcessState.ExitCode() > 0 (pkg/project/run.go:687-690) — i.e. `sst deploy`/`sst remove` with a policy pack attached and the policy engine emitted violations.

Common situations: Team enforces tagging/cost/security policies via a Pulumi policy pack and a new resource violates them; an outdated policy pack flags previously-valid resources; local deploy without the usual policy skip flags.

Related errors

• ErrProtectedStage
• ErrProtectedDevStage
• ErrPolicyConfigError
• Policy pack not found in path: %v
• Invalid function definition for the "${name}" Function

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/14d178bd453f7002. Report an issue: GitHub.