{"record":{"id":"2eb038dae002fa5e","repo":"pulumi/pulumi","slug":"enforcementlevel-cannot-be-required-in-configschem","errorCode":null,"errorMessage":"enforcementLevel cannot be required in configSchema. enforcementLevel is a reserved property","messagePattern":"enforcementLevel cannot be required in configSchema\\. enforcementLevel is a reserved property","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/go/pulumi/policyx/policy_pack.go","lineNumber":101,"sourceCode":") (PolicyPack, error) {\n\tif name == \"\" || !policyPackNameRE.MatchString(name) {\n\t\treturn nil, fmt.Errorf(\"invalid policy pack name: %q\", name)\n\t}\n\n\tfor _, policy := range policies {\n\t\tif policy.Name() == \"all\" {\n\t\t\treturn nil, fmt.Errorf(\"invalid policy name %[1]q. %[1]q is a reserved name\", policy.Name())\n\t\t}\n\n\t\tschema := policy.ConfigSchema()\n\n\t\tif schema != nil {\n\t\t\tif _, ok := schema.Properties[\"enforcementLevel\"]; ok {\n\t\t\t\treturn nil, errors.New(\"enforcementLevel cannot be explicitly specified in configSchema properties.\" +\n\t\t\t\t\t\" enforcementLevel is a reserved property\")\n\t\t\t}\n\t\t\tif slices.Contains(schema.Required, \"enforcementLevel\") {\n\t\t\t\treturn nil, errors.New(\"enforcementLevel cannot be required in configSchema.\" +\n\t\t\t\t\t\" enforcementLevel is a reserved property\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn &policyPack{\n\t\tname:     name,\n\t\tversion:  version,\n\t\tpolicies: policies,\n\t}, nil\n}\n\nfunc (p *policyPack) Name() string { return p.name }\n\nfunc (p *policyPack) Version() semver.Version { return p.version }\n\nfunc (p *policyPack) Policies() []Policy {\n\treturn p.policies","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/go/pulumi/policyx/policy_pack.go#L83-L119","documentation":"For the same reserved-property reason, a policy config schema may not list 'enforcementLevel' among its Required fields. NewPolicyPack checks schema.Required and fails construction if it contains the reserved key.","triggerScenarios":"A Policy's ConfigSchema returns a Required slice containing \"enforcementLevel\".","commonSituations":"Building the Required list programmatically and including all properties; mistaking enforcementLevel for a user-configurable required field.","solutions":["Remove \"enforcementLevel\" from the schema's Required slice","Keep only user-defined config fields in Required","Add a test asserting Required excludes reserved keys"],"exampleFix":"// before\nschema := &policyx.PolicyConfigSchema{\n    Properties: props,\n    Required:   []string{\"enforcementLevel\", \"region\"},\n}\n// after\nschema := &policyx.PolicyConfigSchema{\n    Properties: props,\n    Required:   []string{\"region\"},\n}","handlingStrategy":"validation","validationCode":"for _, r := range schema.Required {\n    if r == \"enforcementLevel\" {\n        panic(\"enforcementLevel is reserved and cannot be required\")\n    }\n}","typeGuard":"null","tryCatchPattern":"if _, err := policyx.NewPolicyPack(name, ver, level, policies); err != nil {\n    if strings.Contains(err.Error(), \"cannot be required\") {\n        // remove enforcementLevel from Required\n    }\n}","preventionTips":["Keep Required limited to user-defined config fields","Build Required lists explicitly, not from all properties","Test schemas for reserved keys before release"],"tags":["go","policy","config-schema"],"backgroundTag":"reserved-config-property","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}