{"record":{"id":"8e8be1ff7ec0d0a1","repo":"hashicorp/terraform","slug":"action-s-has-config-values-with-unsupported-marks","errorCode":null,"errorMessage":"action %s has config values with unsupported marks: %v","messagePattern":"action (.+?) has config values with unsupported marks: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/jsonplan/action_invocations.go","lineNumber":165,"sourceCode":"\t\t\tai.InvokeActionTrigger.CallingResourceAddress = at.CallingResourceAddr.String()\n\t\t}\n\tdefault:\n\t\treturn ai, fmt.Errorf(\"unsupported action trigger type: %T\", at)\n\t}\n\n\tvar config []byte\n\tvar sensitive []byte\n\tvar unknown []byte\n\n\tif actionDec.ConfigValue != cty.NilVal {\n\t\tunmarkedValue, pvms := actionDec.ConfigValue.UnmarkDeepWithPaths()\n\t\tsensitivePaths, otherMarks := marks.PathsWithMark(pvms, marks.Sensitive)\n\t\tephemeralPaths, otherMarks := marks.PathsWithMark(otherMarks, marks.Ephemeral)\n\t\tif len(ephemeralPaths) > 0 {\n\t\t\treturn ai, fmt.Errorf(\"action %s has ephemeral config values, which are not supported in action invocations\", action.Addr)\n\t\t}\n\t\tif len(otherMarks) > 0 {\n\t\t\treturn ai, fmt.Errorf(\"action %s has config values with unsupported marks: %v\", action.Addr, otherMarks)\n\t\t}\n\n\t\tunknownValue := unknownAsBool(unmarkedValue)\n\t\tunknown, err = ctyjson.Marshal(unknownValue, unknownValue.Type())\n\t\tif err != nil {\n\t\t\treturn ai, err\n\t\t}\n\n\t\tconfigValue := omitUnknowns(unmarkedValue)\n\t\tconfig, err = ctyjson.Marshal(configValue, configValue.Type())\n\t\tif err != nil {\n\t\t\treturn ai, err\n\t\t}\n\n\t\tsensitivePaths = append(sensitivePaths, schema.ConfigSchema.SensitivePaths(unmarkedValue, nil)...)\n\t\tcs := jsonstate.SensitiveAsBool(marks.MarkPaths(unmarkedValue, marks.Sensitive, sensitivePaths))\n\t\tsensitive, err = ctyjson.Marshal(cs, cs.Type())\n\t\tif err != nil {","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/jsonplan/action_invocations.go#L147-L183","documentation":"After stripping both sensitive and ephemeral marks from the action config value, any remaining marks are unrecognized by the renderer. Only those two mark kinds are handled, so leftover marks indicate a mark type the JSON format cannot faithfully represent, and serialization is aborted.","triggerScenarios":"len(otherMarks) > 0 after marks.PathsWithMark(pvms, marks.Sensitive) and then marks.PathsWithMark(otherMarks, marks.Ephemeral). A custom or newly introduced cty mark is attached to the decoded ConfigValue.","commonSituations":"A custom Terraform fork adding a new mark kind; a plan from a newer version that introduced a mark this binary does not know about; experimental/internal marks leaking into action config.","solutions":["Inspect the %v output to identify which mark is present, then strip it before marshaling or add a handler in action_invocations.go:159.","Use a Terraform build consistent with the plan artifact (no version skew).","Report as a bug if the mark is a standard Terraform mark the renderer should support."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// After stripping sensitive and ephemeral, fail fast on any remaining mark.\nfor _, a := range plan.Changes.ActionInvocations {\n    sch := schemas.ActionTypeConfig(a.ProviderAddr.Provider, a.Addr.Action.Action.Type)\n    dec, err := a.Decode(&sch)\n    if err != nil || dec.ConfigValue == cty.NilVal {\n        continue\n    }\n    unmarked, pvms := dec.ConfigValue.UnmarkDeepWithPaths()\n    _, other := marks.PathsWithMark(pvms, marks.Sensitive)\n    _, other = marks.PathsWithMark(other, marks.Ephemeral)\n    if len(other) > 0 {\n        return fmt.Errorf(\"action %s carries unsupported marks: %v\", a.Addr, other)\n    }\n    _ = unmarked\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid applying custom cty marks to values that flow into action config.","Keep plan producers and consumers on the same Terraform version so the mark vocabulary matches.","If you maintain a fork adding a mark, handle it in action_invocations.go:159."],"tags":["actions","marks","internal"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}