{"record":{"id":"e4a6db3ac99e4d62","repo":"pulumi/pulumi","slug":"serializing-resource-state-w","errorCode":null,"errorMessage":"serializing resource state: %w","messagePattern":"serializing resource state: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/backend/journal.go","lineNumber":53,"sourceCode":"\t\"github.com/pulumi/pulumi/sdk/v3/go/common/apitype\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/env\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/resource\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/resource/config\"\n\tutilenv \"github.com/pulumi/pulumi/sdk/v3/go/common/util/env\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/logging\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/version\"\n)\n\nfunc SerializeJournalEntry(\n\tctx context.Context, je engine.JournalEntry, enc config.Encrypter,\n) (apitype.JournalEntry, error) {\n\tvar state *apitype.ResourceV3\n\tvar requiresByteString bool\n\n\tif je.State != nil {\n\t\ts, encodedByteString, err := stack.SerializeResource(ctx, je.State, enc, false)\n\t\tif err != nil {\n\t\t\treturn apitype.JournalEntry{}, fmt.Errorf(\"serializing resource state: %w\", err)\n\t\t}\n\t\tstate = &s\n\t\trequiresByteString = requiresByteString || encodedByteString\n\t}\n\n\tvar operation *apitype.OperationV2\n\tif je.Operation != nil {\n\t\top, encodedByteString, err := stack.SerializeOperation(ctx, *je.Operation, enc, false)\n\t\tif err != nil {\n\t\t\treturn apitype.JournalEntry{}, fmt.Errorf(\"serializing operation: %w\", err)\n\t\t}\n\t\toperation = &op\n\t\trequiresByteString = requiresByteString || encodedByteString\n\t}\n\tvar secretsManager *apitype.SecretsProvidersV1\n\tif je.SecretsManager != nil {\n\t\tsecretsManager = &apitype.SecretsProvidersV1{\n\t\t\tType:  je.SecretsManager.Type(),","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/backend/journal.go#L35-L71","documentation":"SerializeJournalEntry converts a journal entry's resource state into its wire (apitype) form via stack.SerializeResource. This error wraps any failure from that serialization — typically secret encryption failures, unsupported property values (e.g. binary data requiring byte-string encoding), or marshal errors. It means one resource in the journal entry could not be converted for persistence.","triggerScenarios":"Calling SerializeJournalEntry with je.State != nil when stack.SerializeResource fails: encrypting a secret with a misconfigured secrets manager, encountering a value the serializer cannot encode, or a context cancellation during serialization.","commonSituations":"Secrets provider misconfigured (bad key/passphrase) so secret encryption fails during checkpoint writing; state containing values incompatible with the target schema version; corrupted in-memory resource state after a failed plugin call.","solutions":["Check the wrapped error (use %v / errors.Unwrap) — the root cause is usually secret encryption; verify the secrets provider config (`pulumi config set-secret` works) with `pulumi stack change-secrets-provider`","Re-run the operation; if the secrets provider is passphrase-based, confirm PULUMI_CONFIG_PASSPHRASE is set correctly in the environment","Inspect which resource failed and re-deploy or delete the offending resource if its state is corrupt","If caused by a schema/serialization bug, file an issue with the wrapped error text"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure the secrets provider works before running operations\nout, err := exec.Command(\"pulumi\", \"config\", \"get\", \"someSecretKey\").CombinedOutput()\nif err != nil { log.Fatalf(\"secrets provider misconfigured: %s\", out) }","typeGuard":"func isSerializeJournalEntryErr(err error) bool {\n    return strings.Contains(err.Error(), \"serializing resource state:\")\n}","tryCatchPattern":"entry, err := SerializeJournalEntry(ctx, je)\nif err != nil {\n    return fmt.Errorf(\"journal write aborted; check secrets provider config: %w\", err)\n}","preventionTips":["Verify secrets provider configuration (PULUMI_CONFIG_PASSPHRASE, KMS key) before updates","Keep provider SDK outputs serializable; avoid exotic value types in resource outputs","Keep the CLI version aligned with the version that wrote the state","Unwrap and log the root cause for diagnostics"],"tags":["serialization","snapshot","secrets","journal"],"backgroundTag":"snapshot-serialization-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}