{"record":{"id":"e37fcd34efb70967","repo":"hashicorp/packer","slug":"invalid-execution-policy-provided-please-supply-o","errorCode":null,"errorMessage":"Invalid execution policy provided. Please supply one of: \"bypass\", \"allsigned\", \"default\", \"remotesigned\", \"restricted\", \"undefined\", \"unrestricted\", \"none\".","messagePattern":"Invalid execution policy provided\\. Please supply one of: \"bypass\", \"allsigned\", \"default\", \"remotesigned\", \"restricted\", \"undefined\", \"unrestricted\", \"none\"\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/powershell/provisioner.go","lineNumber":284,"sourceCode":"\n\tfor _, path := range p.config.Scripts {\n\t\tif _, err := os.Stat(path); err != nil {\n\t\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\t\tfmt.Errorf(\"Bad script '%s': %s\", path, err))\n\t\t}\n\t}\n\n\t// Do a check for bad environment variables, such as '=foo', 'foobar'\n\tfor _, kv := range p.config.Vars {\n\t\tvs := strings.SplitN(kv, \"=\", 2)\n\t\tif len(vs) != 2 || vs[0] == \"\" {\n\t\t\terrs = packersdk.MultiErrorAppend(errs,\n\t\t\t\tfmt.Errorf(\"Environment variable not in format 'key=value': %s\", kv))\n\t\t}\n\t}\n\n\tif p.config.ExecutionPolicy > 7 {\n\t\terrs = packersdk.MultiErrorAppend(errs, fmt.Errorf(`Invalid execution `+\n\t\t\t`policy provided. Please supply one of: \"bypass\", \"allsigned\",`+\n\t\t\t` \"default\", \"remotesigned\", \"restricted\", \"undefined\", `+\n\t\t\t`\"unrestricted\", \"none\".`))\n\t}\n\n\tif !(p.config.DebugMode >= 0 && p.config.DebugMode <= 2) {\n\t\terrs = packersdk.MultiErrorAppend(errs, fmt.Errorf(\"%d is an invalid Trace level for `debug_mode`; valid values are 0, 1, and 2\", p.config.DebugMode))\n\t}\n\n\tif errs != nil {\n\t\treturn errs\n\t}\n\n\treturn nil\n}\n\n// Takes the inline scripts, adds a wrapper around the inline scripts, concatenates them into a temporary file and\n// returns a string containing the location of said file.","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/powershell/provisioner.go#L266-L302","documentation":"The PowerShell provisioner maps `execution_policy` strings to an integer enum (0-8, covering bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none). Prepare throws this error when config.ExecutionPolicy holds a value greater than 7, i.e. an unrecognized policy name or out-of-range value.","triggerScenarios":"Prepare called with config.ExecutionPolicy > 7 — typically after a misspelled or unsupported execution_policy string was converted by the enum decode, or a numeric value out of range.","commonSituations":"Typo in execution_policy (e.g. \"remote-signed\" instead of \"remotesigned\"); using a policy name not in the supported list; copy-pasting Windows policy names like \"remotesigned, bypass\"; older templates using removed values.","solutions":["Set execution_policy to one of: bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none.","Remove the execution_policy key entirely to use the provisioner default.","Check spelling and lowercase the value; the decode is exact."],"exampleFix":"// before\nexecution_policy = \"Remote Signed\"\n// after\nexecution_policy = \"remotesigned\"","handlingStrategy":"validation","validationCode":"// Go, before Prepare\nvalid := map[string]bool{\"bypass\": true, \"allsigned\": true, \"default\": true, \"remotesigned\": true, \"restricted\": true, \"undefined\": true, \"unrestricted\": true, \"none\": true}\nif cfg.ExecutionPolicy != \"\" && !valid[strings.ToLower(cfg.ExecutionPolicy)] {\n    return fmt.Errorf(\"execution_policy %q not supported\", cfg.ExecutionPolicy)\n}","typeGuard":null,"tryCatchPattern":"// Go\nif err := prov.Prepare(cfg); err != nil {\n    if strings.Contains(err.Error(), \"Invalid execution policy\") {\n        // reset cfg.ExecutionPolicy to \"\" or a listed value\n    }\n    return err\n}","preventionTips":["Copy policy names exactly from the docs: bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none.","Use lowercase values with no spaces or hyphens.","Omit execution_policy entirely when unsure — the default is safe.","Keep a shared HCL variable with a validation block constraining execution_policy values."],"tags":["powershell","provisioner","execution-policy","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}