{"record":{"id":"7dd7202cb1c3339e","repo":"pulumi/pulumi","slug":"getting-secrets-manager-for-stack-q-w","errorCode":null,"errorMessage":"getting secrets manager for stack %q: %w","messagePattern":"getting secrets manager for stack %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/logs/decrypt.go","lineNumber":157,"sourceCode":"\t\tstackName = stackNameFromFilename(filepath.Base(f.Name()))\n\t}\n\tif stackName == \"\" {\n\t\treturn fmt.Errorf(\"cannot determine stack from filename %q; use --stack to specify\", filepath.Base(f.Name()))\n\t}\n\n\topts := display.Options{Color: cmdutil.GetGlobalColorization()}\n\ts, err := cmdStack.RequireStack(\n\t\tctx, cmdutil.Diag(), ws,\n\t\tcmdBackend.DefaultLoginManager,\n\t\tstackName, cmdStack.LoadOnly, opts, \"\",\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"loading stack %q for decryption: %w\", stackName, err)\n\t}\n\n\tsm, err := secretsManagerFromStack(ctx, s)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting secrets manager for stack %q: %w\", stackName, err)\n\t}\n\n\treader, err := encryptedlog.NewReader(ctx, f, sm.Decrypter())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decrypting log: %w\", err)\n\t}\n\n\treturn formatLogRecords(reader, out, false)\n}\n\n// stackNameFromFilename extracts the stack name from a log filename.\n// Files are named \"<stack>-<timestamp>[-<updateid>].log\" where \"/\" in\n// stack names is replaced with \"+\".\nfunc stackNameFromFilename(name string) string {\n\tloc := logTimestampRe.FindStringIndex(name)\n\tif loc == nil {\n\t\treturn \"\"\n\t}","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/logs/decrypt.go#L139-L175","documentation":"Wraps a failure from secretsManagerFromStack during `pulumi logs --decrypt` (pkg/cmd/pulumi/logs/decrypt.go:157). After the stack is loaded, its secrets manager must be constructed to get a decrypter for the encrypted log; failures here are typically about secrets provider configuration or credentials rather than the log file itself.","triggerScenarios":"The stack uses a cloud secrets provider whose credentials are missing or wrong (PULUMI_CONFIG_PASSPHRASE unset for passphrase stacks, missing PULUMI_ACCESS_TOKEN for the pulumi.com provider, absent KMS/Azure Key Vault/GCP KMS credentials or roles, unreadable/wrong --secrets-provider key), or the stack's secrets provider configuration in Pulumi.<stack>.yaml is malformed.","commonSituations":"Decrypting logs in CI where PULUMI_CONFIG_PASSPHRASE is not exported; switching machines without copying the passphrase; IAM changes removing access to a cloud KMS key; hand-edited secretsprovider settings in the stack config file.","solutions":["For passphrase stacks, export the same passphrase used to create the stack: `export PULUMI_CONFIG_PASSPHRASE=...` (or pass --password where supported) and retry","For cloud key providers (AWS KMS, Azure Key Vault, GCP KMS), refresh credentials (`aws login`/`az login`/gcloud auth) and verify IAM permissions on the key","For the pulumi.com secrets provider, ensure a valid `pulumi login` and PULUMI_ACCESS_TOKEN with access to the stack's organization","Inspect `config.secretsprovider` in Pulumi.<stack>.yaml and correct malformed or moved key references; test decryption with `pulumi config get <key> --show-secrets`"],"exampleFix":"// before\n$ pulumi logs --decrypt   # passphrase stack, no passphrase in env\n// after\n$ export PULUMI_CONFIG_PASSPHRASE='same-passphrase-as-stack'\n$ pulumi logs --decrypt --stack myorg/myproject/dev","handlingStrategy":"try-catch","validationCode":"pulumi config get someSecretKey --show-secrets --stack org/proj/dev \\\n  || { echo 'secrets manager unavailable; check passphrase/KMS credentials'; exit 1; }\npulumi logs --decrypt --stack org/proj/dev","typeGuard":null,"tryCatchPattern":"// shell\nif ! pulumi logs --decrypt \"$LOG\" --stack \"$STACK\" 2>err.txt; then\n  grep -q 'getting secrets manager' err.txt && \\\n    echo 'Fix secrets config: set PULUMI_CONFIG_PASSPHRASE or refresh cloud KMS credentials' >&2\n  exit 1\nfi","preventionTips":["Store PULUMI_CONFIG_PASSPHRASE in the environment/secret store wherever decryption runs","Test secret decryption (`pulumi config get --show-secrets`) before relying on log decryption","Keep cloud KMS credentials and IAM roles valid for the stack's secrets provider","Do not hand-edit config.secretsprovider; change it only via `pulumi stack change-secrets-provider`"],"tags":["cli","secrets","encryption"],"backgroundTag":"secrets-manager-init-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}