{"record":{"id":"406bafcf675ab240","repo":"pulumi/pulumi","slug":"alias-parent-urn-must-not-be-secret","errorCode":null,"errorMessage":"alias parent urn must not be secret","messagePattern":"alias parent urn must not be secret","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/go/pulumi/context.go","lineNumber":2503,"sourceCode":"\t\t}\n\t\tspec.Parent = &pulumirpc.Alias_Spec_NoParent{\n\t\t\tNoParent: noParent.(bool),\n\t\t}\n\t\t// We're done here.\n\t\treturn nil\n\t}\n\n\tresolvedParentURN, known, secret, err := parentURN.awaitURN(ctx.Context())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"alias parent could not be resolved: %w\", err)\n\t}\n\n\tif !known {\n\t\treturn errors.New(\"alias parent urn must be known\")\n\t}\n\n\tif secret {\n\t\treturn errors.New(\"alias parent urn must not be secret\")\n\t}\n\n\tspec.Parent = &pulumirpc.Alias_Spec_ParentUrn{\n\t\tParentUrn: string(resolvedParentURN),\n\t}\n\n\treturn nil\n}\n\n// mapAliases maps a list of aliases coming from resource options\n// to their RPC representation which the engine understands.\nfunc (ctx *Context) mapAliases(aliases []Alias,\n\tresourceType string,\n\tname string,\n\tparent Resource,\n) ([]*pulumirpc.Alias, error) {\n\taliasSpecs := slice.Prealloc[*pulumirpc.Alias](len(aliases))\n\tawait := func(input StringInput) (string, error) {","sourceCodeStart":2485,"sourceCodeEnd":2521,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/go/pulumi/context.go#L2485-L2521","documentation":"Alias parent URNs are treated as non-secret identifiers; if awaitURN reports the parent URN Output as secret, the SDK rejects the alias with this error because secret values cannot be embedded in alias specs sent to the engine.","triggerScenarios":"Alias{ParentURN: <output>} where the URN output became secret - typically because the parent's URN passed through a secret-holding Output (e.g. derived inside ApplyT from a secret, or wrapped via pulumi.Secret/ToSecret).","commonSituations":"Chain of ApplyT calls over secret outputs accidentally capturing the URN; wrapping whole resource-output structs in secrets and then extracting URN; using secret config to select a parent resource.","solutions":["Keep the parent URN out of secret transformations - alias against the resource object (Alias{Parent: res}) instead of a secret-tainted URN output","Unwrap the URN from the secret computation so it is a plain URNOutput","Refactor so secrets are handled in dedicated outputs, not in the value feeding ParentURN"],"exampleFix":"// before\nurnOut := pulumi.Secret(parent.URN()).(pulumi.URNOutput)\nalias := pulumi.Alias{ParentURN: urnOut} // secret -> rejected\n\n// after\nalias := pulumi.Alias{Parent: parent} // plain resource reference, not secret","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never route parent URNs through pulumi.Secret or secret ApplyT chains","Alias with resource objects rather than extracted URN outputs","Keep secrets in dedicated outputs isolated from alias metadata"],"tags":["go","alias","secret","urn"],"backgroundTag":"alias-resolution-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}