{"record":{"id":"65e5f12f70ec524f","repo":"pulumi/pulumi","slug":"getting-stack-config-value-for-key-v-w","errorCode":null,"errorMessage":"getting stack config value for key '%v': %w","messagePattern":"getting stack config value for key '(.+?)': %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/workspace/config.go","lineNumber":98,"sourceCode":"\t}\n\n\tkeys := make([]string, 0, len(project.Config))\n\tfor k := range project.Config {\n\t\tkeys = append(keys, k)\n\t}\n\tsort.Strings(keys)\n\n\tfor _, projectConfigKey := range keys {\n\t\tprojectConfigType := project.Config[projectConfigKey]\n\n\t\tkey, err := parseConfigKey(project.Name.String(), projectConfigKey)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tstackValue, _, err := stackConfig.Get(key, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting stack config value for key '%v': %w\", key.String(), err)\n\t\t}\n\n\t\tif projectConfigType.IsExplicitlyTyped() {\n\t\t\t// We need to use stackValue.Value(dec) here to account for nested values.\n\t\t\t// We cannot get these from the decrypted config map as it does not handle nested values.\n\t\t\t// Uses the cached decrypted value from the batch decrypt above.\n\t\t\tdecryptedValue, err := stackValue.Value(dec)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\terr = validateStackConfigValue(stackName, projectConfigKey, projectConfigType, stackValue, decryptedValue)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/workspace/config.go#L80-L116","documentation":"This wrapped error occurs while resolving a stack config value during GetStackConfiguration: stackConfig.Get(key, true) failed for the given key. The %w wraps the underlying cause (e.g. decryption failure or malformed stored value) and the message names the config key. It indicates the stack's stored configuration for that key could not be retrieved, not that the key is absent.","triggerScenarios":"Calling code paths that fully decrypt/read stack configuration (e.g. pulumi config get, pulumi up preparing config) when the stored value for a key cannot be fetched — commonly a secret whose encryption key/secrets provider is unavailable or whose ciphertext is corrupt.","commonSituations":"Secrets provider passphrase missing or wrong (PULUMI_CONFIG_PASSPHRASE not set) so decryption fails; stack moved between backends/organizations with different secret keys; manually edited Pulumi.stack.yaml corrupting a value.","solutions":["Read the wrapped cause in the error chain and fix it (most often a decryption problem)","Ensure PULUMI_CONFIG_PASSPHRASE is set/correct when using the passphrase secrets provider","Re-set the broken value: pulumi config set <key> --secret <value> to rewrite it with valid encryption","If migrating stacks, use pulumi stack change-secrets-provider to re-encrypt values correctly"],"exampleFix":"# before: decryption fails because passphrase env var missing in CI\n$ pulumi up  # -> getting stack config value for key 'db:password': ...\n# after\n$ export PULUMI_CONFIG_PASSPHRASE=\"$SECRET_PASSPHRASE\"\n$ pulumi up","handlingStrategy":"try-catch","validationCode":"// ensure secrets provider prerequisites exist before invoking\nif (!process.env.PULUMI_CONFIG_PASSPHRASE && fs.existsSync('Pulumi.<stack>.yaml') && /secure/.test(fs.readFileSync(`Pulumi.${stack}.yaml`,'utf8'))) {\n  throw new Error('PULUMI_CONFIG_PASSPHRASE must be set for passphrase secrets provider');\n}","typeGuard":null,"tryCatchPattern":"import { errors } from 'node:util';\ntry {\n  await loadStackConfig();\n} catch (err) {\n  if (errors.unwrap(err)) {\n    console.error('Config value retrieval failed; fix underlying cause:', errors.unwrap(err));\n  }\n  throw err;\n}","preventionTips":["Always set PULUMI_CONFIG_PASSPHRASE in environments using the passphrase secrets provider","Avoid hand-editing Pulumi.<stack>.yaml secret values","Use pulumi stack change-secrets-provider when migrating between providers"],"tags":["configuration","secrets","decryption"],"backgroundTag":"config-value-decrypt-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}