{"record":{"id":"5ee24923d5715fce","repo":"pulumi/pulumi","slug":"invalid-enforcement-level-q-5ee249","errorCode":null,"errorMessage":"invalid enforcement level %q","messagePattern":"invalid enforcement level %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/go/common/resource/plugin/analyzer_plugin.go","lineNumber":624,"sourceCode":"\treturn PluginInfo{\n\t\tVersion: version,\n\t}, nil\n}\n\nfunc (a *analyzer) Configure(ctx context.Context, policyConfig map[string]AnalyzerPolicyConfig) error {\n\tlabel := a.label() + \".Configure(...)\"\n\tlogging.V(7).Infof(\"%s executing\", label)\n\n\tif len(policyConfig) == 0 {\n\t\tlogging.V(7).Infof(\"%s returning early, no config specified\", label)\n\t\treturn nil\n\t}\n\n\tc := make(map[string]*pulumirpc.PolicyConfig)\n\n\tfor k, v := range policyConfig {\n\t\tif !v.EnforcementLevel.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid enforcement level %q\", v.EnforcementLevel)\n\t\t}\n\n\t\tprops, err := structpb.NewStruct(v.Properties)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"marshalling properties: %w\", err)\n\t\t}\n\n\t\tc[k] = &pulumirpc.PolicyConfig{\n\t\t\tEnforcementLevel: marshalEnforcementLevel(v.EnforcementLevel),\n\t\t\tProperties:       props,\n\t\t}\n\t}\n\n\t_, err := a.client.Configure(ctx, &pulumirpc.ConfigureAnalyzerRequest{\n\t\tPolicyConfig: c,\n\t})\n\tif err != nil {\n\t\trpcError := rpcerror.Convert(err)","sourceCodeStart":606,"sourceCodeEnd":642,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/go/common/resource/plugin/analyzer_plugin.go#L606-L642","documentation":"When configuring a policy pack (ConfigureAnalyzer path), each policy config entry's EnforcementLevel is validated against apitype enforcement levels before being sent to the analyzer plugin. An unrecognized level string produces \"invalid enforcement level %q\".","triggerScenarios":"Calling ConfigureAnalyzer with policyConfig map entries whose EnforcementLevel field holds a value not in {Advisory, Mandatory, Remediate, Disabled} (apitype.EnforcementLevel.IsValid() == false).","commonSituations":"Typo'd enforcement level in PulumiPolicy.yaml or CLI flags (e.g. \"manditory\", \"advisory \" with whitespace, lowercase \"mandatory\"); hand-edited policy config files; version drift where a level name was renamed.","solutions":["Use one of the exact valid values: advisory, mandatory, remediate, disabled (correct case) in the policy config source.","Fix the enforcement level in PulumiPolicy.yaml or the --policy-config input rather than hand-editing serialized config.","Validate config with `pulumi policy validate` or the pack's own linting before running.","If the level comes from a newer CLI, upgrade the CLI/policy SDK so both recognize the value."],"exampleFix":"// before\npolicyConfig[\"aws-s3-no-public-read\"] = AnalyzerPolicyConfig{EnforcementLevel: apitype.EnforcementLevel(\"MANDATORY\")}\n// after\npolicyConfig[\"aws-s3-no-public-read\"] = AnalyzerPolicyConfig{EnforcementLevel: apitype.Mandatory}","handlingStrategy":"validation","validationCode":"// Go: validate enforcement levels before building policy config\nvalid := map[apitype.EnforcementLevel]bool{\n    apitype.Advisory: true, apitype.Mandatory: true,\n    apitype.Remediate: true, apitype.Disabled: true,\n}\nfor k, v := range policyConfig {\n    if !valid[v.EnforcementLevel] {\n        return fmt.Errorf(\"policy %q: invalid enforcement level %q (use advisory|mandatory|remediate|disabled)\", k, v.EnforcementLevel)\n    }\n}","typeGuard":"func isValidEnforcementLevel(l apitype.EnforcementLevel) bool {\n    return l.IsValid()\n}","tryCatchPattern":"if err := configureAnalyzer(policyConfig); err != nil {\n    if strings.Contains(err.Error(), \"invalid enforcement level\") {\n        // normalize: trim, lowercase, retry once\n        return retryWithNormalizedLevels(policyConfig)\n    }\n    return err\n}","preventionTips":["Always use apitype constants (apitype.Mandatory, etc.) instead of raw strings","Validate PulumiPolicy.yaml against the schema before deployment","Trim and normalize level strings parsed from user input/YAML","Add a unit test covering each enforcement level constant"],"tags":["go","pulumi-engine","policy-packs","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}