{"record":{"id":"14d178bd453f7002","repo":"anomalyco/sst","slug":"errpolicyviolation","errorCode":"ErrPolicyViolation","errorMessage":"policy violations detected","messagePattern":"policy violations detected","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/stack.go","lineNumber":122,"sourceCode":"\tApp     string\n\tStage   string\n\tConfig  string\n\tCommand string\n\tVersion string\n}\n\ntype Error struct {\n\tMessage string   `json:\"message\"`\n\tURN     string   `json:\"urn\"`\n\tHelp    []string `json:\"help\"`\n}\n\nvar ErrStackRunFailed = fmt.Errorf(\"stack run had errors\")\nvar ErrStageNotFound = fmt.Errorf(\"stage not found\")\nvar ErrPassphraseInvalid = fmt.Errorf(\"passphrase invalid\")\nvar ErrProtectedStage = fmt.Errorf(\"cannot remove protected stage\")\nvar ErrProtectedDevStage = fmt.Errorf(\"cannot run sst dev on protected stage\")\nvar ErrPolicyViolation = fmt.Errorf(\"policy violations detected\")\nvar ErrPolicyConfigError = fmt.Errorf(\"policy configuration error\")\n\nfunc (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {\n\tvar resolvedPath string\n\tif filepath.IsAbs(policyPath) {\n\t\tresolvedPath = policyPath\n\t} else {\n\t\tresolvedPath = filepath.Join(p.PathRoot(), policyPath)\n\t}\n\n\tif _, err := os.Stat(resolvedPath); err != nil {\n\t\treturn \"\", fmt.Errorf(\"Policy pack not found in path: %v\", resolvedPath)\n\t}\n\n\treturn resolvedPath, nil\n}\n\nfunc (p *Project) Lock(command string) (*provider.Update, error) {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/stack.go#L104-L140","documentation":"ErrPolicyViolation is returned by Project.Run when the stack operation finished with a non-zero exit code AND the Pulumi policy pack reported violations during the run. It means deployed changes were rejected by the org's policy-as-code rules (e.g. forbidden instance types, missing tags, public buckets).","triggerScenarios":"Project.Run runs the Pulumi CLI with `--policy-pack` (input.PolicyPath set, hasPolicyFlag true) and hasPolicyEvents is true when cmd.ProcessState.ExitCode() > 0 (pkg/project/run.go:687-690) — i.e. `sst deploy`/`sst remove` with a policy pack attached and the policy engine emitted violations.","commonSituations":"Team enforces tagging/cost/security policies via a Pulumi policy pack and a new resource violates them; an outdated policy pack flags previously-valid resources; local deploy without the usual policy skip flags.","solutions":["Read the policy violation details in the Pulumi logs (sst.json / pulumi log files) and change the offending resource definition to comply.","If the resource is intentionally non-compliant, add a policy exception/`remediation` or mark it as an approved exemption in the policy pack.","Ensure the correct policy pack version is being used — a stale pack may flag valid code.","Only if you have authority, deploy without the --policy-path flag (though CI may enforce it)."],"exampleFix":"// before (sst.config.ts / resource definition)\nnew sst.aws.Bucket(\"Data\", { public: true });\n// after — satisfy the no-public-buckets policy\nnew sst.aws.Bucket(\"Data\", { public: false });","handlingStrategy":"try-catch","validationCode":"// Pre-flight: run diff with the policy pack to surface violations before deploy\n// sst diff --policy-path ./policies/pack --stage <stage>\n// Non-zero exit + violation output means deploy would return ErrPolicyViolation","typeGuard":null,"tryCatchPattern":"err := project.Run(ctx, &project.StackInput{Command: \"deploy\", PolicyPath: policyPath})\nswitch {\ncase errors.Is(err, project.ErrPolicyViolation):\n    log.Printf(\"deploy blocked by policy; see policy violation details in logs\")\n    // inspect sst.json / pulumi logs for the specific violating resources\n    return\ncase err != nil:\n    return err\n}","preventionTips":["Run `sst diff` with the same policy pack in CI before every deploy.","Keep policy pack rules and resource templates in sync; review policy pack updates in PRs.","Add policy-compliant resource presets (tagged, private-by-default) to your platform components.","Document exemption workflow so teams do not weaken policies ad hoc."],"tags":["sst","policy","compliance","infrastructure"],"backgroundTag":"policy-violation-detected","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}