What causes "invalid name '%s'" in hashicorp/nomad?

Rename the policy to contain only valid characters (alphanumerics, dashes, underscores) and resubmit.

invalid name '%s'

Error message

invalid name '%s'

What it means

ACLPolicy.Validate in nomad/structs/acl.go rejects a policy whose Name does not match the ValidPolicyName regex. Nomad restricts ACL policy names to a safe character set so names can be used in file paths and API URLs unambiguously. The error is accumulated into a multierror together with any other validation failures.

Source

Thrown at nomad/structs/acl.go:371

	a.Hash = hashVal
	return hashVal
}

func (a *ACLPolicy) Stub() *ACLPolicyListStub {
	return &ACLPolicyListStub{
		Name:        a.Name,
		Description: a.Description,
		JobACL:      a.JobACL,
		Hash:        a.Hash,
		CreateIndex: a.CreateIndex,
		ModifyIndex: a.ModifyIndex,
	}
}

func (a *ACLPolicy) Validate() error {
	var mErr multierror.Error
	if !ValidPolicyName.MatchString(a.Name) {
		err := fmt.Errorf("invalid name '%s'", a.Name)
		mErr.Errors = append(mErr.Errors, err)
	}
	if _, err := acl.Parse(a.Rules, acl.PolicyParseStrict); err != nil {
		err = fmt.Errorf("failed to parse rules: %v", err)
		mErr.Errors = append(mErr.Errors, err)
	}
	if len(a.Description) > maxPolicyDescriptionLength {
		err := fmt.Errorf("description longer than %d", maxPolicyDescriptionLength)
		mErr.Errors = append(mErr.Errors, err)
	}
	if a.JobACL != nil {
		if a.JobACL.JobID != "" && a.JobACL.Namespace == "" {
			err := fmt.Errorf("namespace must be set to set job ID")
			mErr.Errors = append(mErr.Errors, err)
		}
		if a.JobACL.Group != "" && a.JobACL.JobID == "" {
			err := fmt.Errorf("job ID must be set to set group")
			mErr.Errors = append(mErr.Errors, err)

View on GitHub (pinned to 482b49bf1a)

Solutions

Rename the policy to contain only valid characters (alphanumerics, dashes, underscores) and resubmit.
Check `nomad acl policy info <name>`/the API response for the exact invalid name reported.
If importing policies from files, sanitize filenames before deriving the policy name.
Upgrade/downgrade awareness: names valid in old clusters may fail strict validation on newer servers; rename or export with corrected names.

Example fix

// before
policy.Name = "team prod read"
// after
policy.Name = "team-prod-read"

Defensive patterns

Strategy: validation

Validate before calling

var validPolicyName = regexp.MustCompile(`^[a-zA-Z0-9-[\]]+$`)
func validatePolicyName(name string) error {
    if !validPolicyName.MatchString(name) {
        return fmt.Errorf("policy name %q contains invalid characters", name)
    }
    return nil
}

Try / catch

err := policy.Validate()
if err != nil {
    if strings.Contains(err.Error(), "invalid name") {
        return fmt.Errorf("rename policy: %w", err)
    }
    return err
}

Prevention

Derive policy names from sanitized identifiers (slugify filenames before applying).
Restrict names to alphanumerics, dashes, underscores in your tooling.
Add a pre-apply lint step for policy names in CI.
Avoid spaces, dots, slashes and path-traversal sequences in names.

When it happens

Trigger: Submitting an ACL policy via the ACL policy create/update API (or `nomad acl policy apply`) with a name containing characters outside the allowed set (the regex permits alphanumeric, dash, underscore; leading/trailing dashes and dotdot-style traversal names are rejected).

Common situations: Typing a policy name with spaces, dots, slashes or shell-unfriendly characters; scripting policy creation from filenames like 'my policy.hcl'; attempting path-traversal style names ('..'); older configs created before strict name validation.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/3f3a033b0ffb6abb. Report an issue: GitHub.