{"record":{"id":"d444c1520699f8c1","repo":"pulumi/pulumi","slug":"invalid-configuration-key-w-d444c1","errorCode":null,"errorMessage":"invalid configuration key: %w","messagePattern":"invalid configuration key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/config/io.go","lineNumber":298,"sourceCode":"\t}\n\treturn overrides, nil\n}\n\nfunc copySingleConfigKey(\n\tctx context.Context,\n\tssml cmdStack.SecretsManagerLoader,\n\tconfigKey string,\n\tpath bool,\n\tcurrentStack backend.Stack,\n\tcurrentProjectStack *workspace.ProjectStack,\n\tdestinationStack backend.Stack,\n\tdestinationProjectStack *workspace.ProjectStack,\n\tconfigFile string,\n) error {\n\tvar decrypter config.Decrypter\n\tkey, err := ParseConfigKey(pkgWorkspace.Instance, configKey, path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid configuration key: %w\", err)\n\t}\n\n\tv, ok, err := currentProjectStack.Config.Get(key, path)\n\tif err != nil {\n\t\treturn err\n\t} else if !ok {\n\t\treturn fmt.Errorf(\"configuration key '%s' not found for stack '%s'\", PrettyKey(key), currentStack.Ref())\n\t}\n\n\tif v.Secure() {\n\t\tvar err error\n\t\tvar state cmdStack.SecretsManagerState\n\t\tif decrypter, state, err = ssml.GetDecrypter(ctx, currentStack, currentProjectStack); err != nil {\n\t\t\treturn fmt.Errorf(\"could not create a decrypter: %w\", err)\n\t\t}\n\t\tcontract.Assertf(\n\t\t\tstate == cmdStack.SecretsManagerUnchanged,\n\t\t\t\"We're reading a secure value so the encryption information must be present already\",","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/config/io.go#L280-L316","documentation":"`pulumi config cp` copies a single configuration key between stacks. Before reading the value, it parses the user-supplied key string into a config.Key via ParseConfigKey; this error wraps any parse failure (missing `:` separator, invalid namespace, or inability to determine the default project namespace). The copy is aborted before any value is read or written.","triggerScenarios":"Running `pulumi config cp` (or `config cp --path`) with a malformed key argument, e.g. a key without a namespace colon when not using --path, or an empty/garbage key string.","commonSituations":"Typos like `pulumi config cp aws:region dest` where the source key lacks `namespace:key` form; forgetting `--path` when the key contains dots/colons that are meant literally; running outside a project directory so the default namespace cannot be resolved.","solutions":["Pass the key in valid `namespace:key` form, e.g. `aws:region`","If the key is a literal path key, add `--path` so the colon requirement is relaxed","Verify you are in a directory containing a valid Pulumi.yaml so the project-name default namespace can be resolved","Run `pulumi config` to list keys and copy the exact spelling"],"exampleFix":"// before\npulumi config cp region staging\n// after\npulumi config cp aws:region staging","handlingStrategy":"validation","validationCode":"if !strings.Contains(key, \":\") && !pathMode {\n    return fmt.Errorf(\"key %q must be namespace:key (or pass --path)\", key)\n}","typeGuard":null,"tryCatchPattern":"if err := runConfigCopy(key, dest); err != nil {\n    if strings.Contains(err.Error(), \"invalid configuration key\") {\n        // prompt user for correct namespace:key form\n    }\n}","preventionTips":["Always use namespace:key form unless --path is intended","Run config commands from a directory with a valid Pulumi.yaml","Use `pulumi config` output to copy exact key spellings"],"tags":["cli","config","parsing"],"backgroundTag":"invalid-config-key","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}