{"record":{"id":"eb62b413f73e7215","repo":"pulumi/pulumi","slug":"constructing-deployment-for-upload-w","errorCode":null,"errorMessage":"constructing deployment for upload: %w","messagePattern":"constructing deployment for upload: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/stack/io.go","lineNumber":569,"sourceCode":"\t\treturn multierror.Append(result,\n\t\t\terrors.New(\"importing this file could be dangerous; rerun with --force to proceed anyway\"))\n\t}\n\n\t// Explicitly clear-out any pending operations.\n\tif snapshot.PendingOperations != nil {\n\t\tfor _, op := range snapshot.PendingOperations {\n\t\t\tmsg := fmt.Sprintf(\n\t\t\t\t\"removing pending operation '%s' on '%s' from snapshot\", op.Type, op.Resource.URN,\n\t\t\t)\n\t\t\tcmdutil.Diag().Warningf(diag.Message(op.Resource.URN, msg))\n\t\t}\n\n\t\tsnapshot.PendingOperations = nil\n\t}\n\n\tdep, err := stack.SerializeUntypedDeployment(ctx, snapshot, nil /*opts*/)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"constructing deployment for upload: %w\", err)\n\t}\n\n\t// Now perform the deployment.\n\tif err = backend.ImportStackDeployment(ctx, s, dep); err != nil {\n\t\treturn fmt.Errorf(\"could not import deployment: %w\", err)\n\t}\n\treturn nil\n}\n\n// RequireCloudStack resolves the named stack (or the current stack when empty), requires that\n// it lives on the Pulumi Cloud backend, and returns the cloud API client along with the\n// StackIdentifier needed to address the stack via REST API endpoints.\nfunc RequireCloudStack(\n\tctx context.Context, sink diag.Sink, ws pkgWorkspace.Context, lm cmdBackend.LoginManager,\n\tstackName string,\n) (*client.Client, client.StackIdentifier, error) {\n\topts := display.Options{Color: cmdutil.GetGlobalColorization()}\n","sourceCodeStart":551,"sourceCodeEnd":587,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/stack/io.go#L551-L587","documentation":"During `pulumi stack import`, after validation, the snapshot is serialized with `stack.SerializeUntypedDeployment`. If serialization fails — often because the snapshot contains secret values that cannot be encrypted (no/severed secrets provider), or malformed resources — the error is wrapped as \"constructing deployment for upload: %w\". The library throws it because it cannot build the deployment payload to hand to the backend.","triggerScenarios":"`pulumi stack import --file ...` where `SerializeUntypedDeployment(ctx, snapshot, nil)` returns an error: e.g. the imported state has secrets but the stack's secrets manager/key is missing or mismatched, or the snapshot has resources that fail marshaling.","commonSituations":"Importing state that references a passphrase/KMS secrets provider different from the target stack's; secrets provider changed after export (`secretsprovider` field mismatch); corrupted resource entries in the deployment JSON.","solutions":["Ensure the `secretsprovider` field in the deployment file matches the target stack's secrets provider, or re-encrypt the file with `pulumi stack change-secrets-provider` on the source.","Check the wrapped `%w` detail: if it mentions secrets/encryption, supply the correct key (e.g. set `PULUMI_CONFIG_PASSPHRASE` for passphrase stacks).","Validate the deployment JSON structure against a fresh `pulumi stack export` and fix malformed entries.","Try importing with the same CLI version that produced the export."],"exampleFix":"// before: export uses passphrase, target stack uses Pulumi Cloud management\n\"secretsprovider\": \"passphrase\"\n// after: align the providers, e.g. re-encrypt source first\npulumi stack change-secrets-provider --stack dev passphrase://\npulumi stack export --stack dev > export.json\npulumi stack import --file export.json","handlingStrategy":"validation","validationCode":"# Check the deployment's secrets provider matches the target stack\njq -r '.secretsprovider // \"\"' export.json\npulumi stack select <target> && pulumi config  # inspect effective secrets provider","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Align secrets providers between source and target stacks before importing (use `pulumi stack change-secrets-provider`).","Keep `PULUMI_CONFIG_PASSPHRASE` set in the environment when working with passphrase-based stacks.","Round-trip export/import on a test stack to validate the file before the real import."],"tags":["import","serialization","secrets"],"backgroundTag":"deployment-serialization-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}