{"record":{"id":"3d8378ab4a60884b","repo":"pulumi/pulumi","slug":"opening-esc-environments-for-policy-pack-q-w","errorCode":null,"errorMessage":"opening ESC environments for policy pack %q: %w","messagePattern":"opening ESC environments for policy pack %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/backend/httpstate/policypack.go","lineNumber":140,"sourceCode":"\treturn installRequiredPolicy(ctx, policyPackPath, content, stdout, stderr)\n}\n\nfunc (rp *cloudRequiredPolicy) Config() map[string]*json.RawMessage { return rp.RequiredPolicy.Config }\n\n// ResolveEnvironments opens any referenced ESC environments and returns resolved\n// config (from policyConfig) and environment variables. Returns nil if no environments are referenced.\nfunc (rp *cloudRequiredPolicy) ResolveEnvironments(ctx context.Context) (*engine.ResolvedPolicyEnvironment, error) {\n\tif len(rp.Environments) == 0 {\n\t\treturn nil, nil\n\t}\n\n\t// Build a synthetic environment that imports all referenced environments.\n\t// This reuses the same path as stack ESC resolution.\n\tyaml := workspace.NewEnvironment(rp.Environments).Definition()\n\n\tenv, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"opening ESC environments for policy pack %q: %w\", rp.RequiredPolicy.Name, err)\n\t}\n\tif len(diags) != 0 {\n\t\tvar diagMsgs strings.Builder\n\t\tfor _, d := range diags {\n\t\t\tfmt.Fprintf(&diagMsgs, \"  %s\\n\", d.Summary)\n\t\t}\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"opening ESC environments for policy pack %q:\\n%s\", rp.RequiredPolicy.Name, diagMsgs.String())\n\t}\n\n\tresult := &engine.ResolvedPolicyEnvironment{}\n\n\t// Extract policyConfig from the resolved environment.\n\tif policyConfigVal, ok := env.Properties[\"policyConfig\"]; ok {\n\t\tpolicyConfig, err := escValueToConfigMap(policyConfigVal)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"extracting policyConfig from ESC environment for %q: %w\", rp.RequiredPolicy.Name, err)\n\t\t}","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/backend/httpstate/policypack.go#L122-L158","documentation":"Raised in PolicyPack.ResolveEnvironments when opening the synthetic ESC environment (built from the policy pack's required environments) via OpenYAMLEnvironment fails. This mirrors stack ESC resolution: the policy pack declares Pulumi Cloud environments, and the ESC engine could not open/import them. Diagnostics are handled separately; only the hard open failure is wrapped here.","triggerScenarios":"A policy pack references ESC environments that don't exist, were deleted/renamed, aren't readable by the current token, contain invalid YAML/ESC definitions, or the ESC service call fails (network, 401/403, org mismatch).","commonSituations":"Environment deleted after being added to a policy pack's required policies config; token lacks read access to another team's environment; circular environment imports; typo in environment names in policy pack configuration; org renamed.","solutions":["Check the policy pack's environments list and confirm each named environment exists in the org (Pulumi Cloud ESC console).","Grant the current token/user read access to every referenced environment (check ESC environment permissions).","Open the environments in `pulumi esc` to surface YAML/definition errors (invalid syntax, circular imports).","Remove stale environment references from the policy pack configuration after renames or deletions."],"exampleFix":"// before (pulumi policy config)\nenvironments:\n  - prod/secrets-env   // deleted, causes open failure\n// after\nenvironments:\n  - prod/policy-config  // verified to exist and be readable\n// code path\nenv, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)\nif err != nil {\n\treturn nil, fmt.Errorf(\"check ESC environments exist and are accessible for %q: %w\", rp.RequiredPolicy.Name, err)\n}","handlingStrategy":"validation","validationCode":"for _, envName := range rp.Environments {\n\tif _, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName,\n\t\tworkspace.NewEnvironment([]string{envName}).Definition(), time.Minute, nil); err != nil {\n\t\treturn fmt.Errorf(\"ESC environment %q missing or unreadable: %w\", envName, err)\n\t}\n}","typeGuard":"func hasDiagnostics(diags []encoding.Diagnostic) bool {\n\treturn len(diags) > 0\n}","tryCatchPattern":"env, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)\nif err != nil {\n\treturn nil, fmt.Errorf(\"ESC environments for policy pack %q must exist and be readable: %w\", rp.RequiredPolicy.Name, err)\n}\nif hasDiagnostics(diags) {\n\t// surface diags before proceeding\n}","preventionTips":["Verify every ESC environment referenced by a policy pack exists and is readable by the deploying identity.","Use `pulumi esc open` locally to validate environments before wiring them into policy packs.","Update policy pack configuration whenever environments are renamed or deleted.","Grant ESC read permissions to CI tokens used for policy evaluation."],"tags":["esc","policy-pack","pulumi-cloud","environment-resolution"],"backgroundTag":"esc-environment-open-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}