%d is an invalid Trace level for `debug_mode`; valid values

Error message

%d is an invalid Trace level for `debug_mode`; valid values are 0, 1, and 2

What it means

Validation guard in the PowerShell provisioner's Prepare. debug_mode maps to the Windows Trace-Command verbosity level, which only accepts 0 (off), 1, or 2; this error fires when debug_mode is set to any other integer. Change debug_mode in the provisioner block to 0, 1, or 2.

Source

Thrown at provisioner/powershell/provisioner.go:291

	// Do a check for bad environment variables, such as '=foo', 'foobar'
	for _, kv := range p.config.Vars {
		vs := strings.SplitN(kv, "=", 2)
		if len(vs) != 2 || vs[0] == "" {
			errs = packersdk.MultiErrorAppend(errs,
				fmt.Errorf("Environment variable not in format 'key=value': %s", kv))
		}
	}

	if p.config.ExecutionPolicy > 7 {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf(`Invalid execution `+
			`policy provided. Please supply one of: "bypass", "allsigned",`+
			` "default", "remotesigned", "restricted", "undefined", `+
			`"unrestricted", "none".`))
	}

	if !(p.config.DebugMode >= 0 && p.config.DebugMode <= 2) {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf("%d is an invalid Trace level for `debug_mode`; valid values are 0, 1, and 2", p.config.DebugMode))
	}

	if errs != nil {
		return errs
	}

	return nil
}

// Takes the inline scripts, adds a wrapper around the inline scripts, concatenates them into a temporary file and
// returns a string containing the location of said file.
func extractInlineScript(p *Provisioner) (string, error) {
	temp, err := tmp.File("powershell-provisioner")
	if err != nil {
		return "", err
	}

	defer temp.Close()

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set debug_mode's trace level to 0, 1, or 2
Remove debug_mode if you don't need PowerShell transcript/tracing output

Example fix

// before
debug_mode = 3
// after
debug_mode = 2

Defensive patterns

Strategy: validation

Validate before calling

// Go, before Prepare
if cfg.DebugMode < 0 || cfg.DebugMode > 2 {
    return fmt.Errorf("debug_mode must be 0, 1 or 2, got %d", cfg.DebugMode)
}

Try / catch

// Go
if err := prov.Prepare(cfg); err != nil {
    if strings.Contains(err.Error(), "invalid Trace level") {
        cfg.DebugMode = 0
    }
    return err
}

Prevention

Only use 0, 1, or 2 for debug_mode — 2 is maximum verbosity.
Remove debug_mode from production templates; keep it only in local dev overrides.
Use an HCL variable validation block to constrain the range in shared templates.

When it happens

Trigger: Prepare called with config.DebugMode < 0 or > 2, e.g. debug_mode = 3 or a negative number in the template.

Common situations: Copy-pasting a debug level from another provisioner that allows more levels; thinking higher numbers mean more verbose output and escalating past 2; typing a typo like 22.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/a1755848e91c65f0. Report an issue: GitHub.