{"record":{"id":"d4fe723bb1ba93c6","repo":"pulumi/pulumi","slug":"the-provider-command-does-not-accept-versions","errorCode":null,"errorMessage":"the provider command does not accept versions","messagePattern":"the provider command does not accept versions","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/esc/cli/env_provider_aws_login.go","lineNumber":78,"sourceCode":"\t\t\t\"Writes an `fn::open::aws-login` block with static credentials at the configured\\n\" +\n\t\t\t\"path under `values`. The secret access key and session token, if any, are\\n\" +\n\t\t\t\"wrapped in `fn::secret`. If a block already exists at the path it is replaced.\\n\" +\n\t\t\t\"\\n\" +\n\t\t\t\"See https://www.pulumi.com/docs/esc/integrations/dynamic-login-credentials/aws-login/\\n\" +\n\t\t\t\"for the full provider reference.\\n\",\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\tctx := cmd.Context()\n\n\t\t\tif err := env.esc.getCachedClient(ctx); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tref, args, err := env.getExistingEnvRef(ctx, args)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif ref.version != \"\" {\n\t\t\t\treturn errors.New(\"the provider command does not accept versions\")\n\t\t\t}\n\t\t\tif len(args) != 2 {\n\t\t\t\treturn errors.New(\"expected <access-key-id> and <secret-access-key>\")\n\t\t\t}\n\t\t\taccessKeyID, secretAccessKey := args[0], args[1]\n\n\t\t\tpath, err := resource.ParsePropertyPath(pathStr)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid --path: %w\", err)\n\t\t\t}\n\n\t\t\tnode := buildAWSLoginStaticNode(accessKeyID, secretAccessKey, sessionToken)\n\n\t\t\tvar envVars []envVar\n\t\t\tif exportEnvVars {\n\t\t\t\tenvVars = awsLoginEnvVars(propertyPathRef(path))\n\t\t\t}\n","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/esc/cli/env_provider_aws_login.go#L60-L96","documentation":"The `pulumi env provider aws-login static` command writes an `fn::open::aws-login` block into a Pulumi ESC environment. It only operates on the latest version of an environment, so after parsing the environment reference it rejects any reference that carries an explicit version modifier (e.g. `myenv@1`). The check happens in env_provider_aws_login.go:78 right after getExistingEnvRef strips the ref from the positional args.","triggerScenarios":"Running `pulumi env provider aws-login static my-org/proj/myenv@1 <access-key-id> <secret-access-key>` — i.e. including a version tag/modifier (like @1, @latest, @sha256:...) in the environment name argument of any aws-login provider subcommand.","commonSituations":"Developers copy an environment reference with a version pin from another ESC command (`env open myenv@1`) or from CI scripts that evaluate versioned environments, then reuse it verbatim in the provider command. Provider commands edit the environment definition, which only makes sense on the mutable latest version.","solutions":["Remove the version modifier from the environment reference: `pulumi env provider aws-login static my-org/proj/myenv <access-key-id> <secret-access-key>`.","If you need versioned credentials, first open the versioned environment with `pulumi env open myenv@1` and consume its outputs instead of editing it.","Use `pulumi env tag repository`-style workflows: create a new named environment if you truly need a frozen copy, and run the provider command against that."],"exampleFix":"// before\npulumi env provider aws-login static my-org/proj/myenv@1 AKIA... secret\n// after\npulumi env provider aws-login static my-org/proj/myenv AKIA... secret","handlingStrategy":"validation","validationCode":"// shell: validate the ref has no version modifier before invoking\nif [[ \"$ENV_REF\" == *\"@\"* ]]; then\n  echo \"refusing: provider commands do not accept versioned env refs: $ENV_REF\" >&2\n  exit 1\nfi\npulumi env provider aws-login static \"$ENV_REF\" \"$AWS_KEY\" \"$AWS_SECRET\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never append @version to env refs in scripts that call `env provider` subcommands.","Reserve versioned refs for read-only commands like `env open`/`env run`.","Centralize env ref construction in a script helper that strips or rejects versions."],"tags":["cli","esc","aws","argument-validation"],"backgroundTag":"env-version-not-supported","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}