What causes "Environment variable not in format 'key=value': %s" in hashicorp/packer?

Rewrite each entry as a single 'KEY=value' string inside the vars array.

Environment variable not in format 'key=value': %s

Error message

Environment variable not in format 'key=value': %s

What it means

Each entry in the provisioner's `environment_vars` (Vars) must be a single string of the form 'key=value'. Prepare splits each entry on '=' with strings.SplitN; if there is no '=' or the key is empty, it throws "Environment variable not in format 'key=value': %s". This keeps PowerShell env var injection well-formed.

Source

Thrown at provisioner/powershell/provisioner.go:279

		} else {
			p.config.ElevatedExecuteCommand = p.defaultScriptCommand()
			log.Printf("Using script default elevated execute command %s", p.config.ElevatedExecuteCommand)
		}
	}

	for _, path := range p.config.Scripts {
		if _, err := os.Stat(path); err != nil {
			errs = packersdk.MultiErrorAppend(errs,
				fmt.Errorf("Bad script '%s': %s", path, err))
		}
	}

	// Do a check for bad environment variables, such as '=foo', 'foobar'
	for _, kv := range p.config.Vars {
		vs := strings.SplitN(kv, "=", 2)
		if len(vs) != 2 || vs[0] == "" {
			errs = packersdk.MultiErrorAppend(errs,
				fmt.Errorf("Environment variable not in format 'key=value': %s", kv))
		}
	}

	if p.config.ExecutionPolicy > 7 {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf(`Invalid execution `+
			`policy provided. Please supply one of: "bypass", "allsigned",`+
			` "default", "remotesigned", "restricted", "undefined", `+
			`"unrestricted", "none".`))
	}

	if !(p.config.DebugMode >= 0 && p.config.DebugMode <= 2) {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf("%d is an invalid Trace level for `debug_mode`; valid values are 0, 1, and 2", p.config.DebugMode))
	}

	if errs != nil {
		return errs
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Rewrite each entry as a single 'KEY=value' string inside the vars array.
Quote the entry so an embedded '=' isn't split away: vars = ["MYVAR=with=equals"] works, vars = ["MYVAR"] does not.
If the value is empty, still include the '=': "MYVAR=".

Example fix

// before (HCL)
environment_vars = ["MYVAR"]
// after
environment_vars = ["MYVAR=somevalue"]

Defensive patterns

Strategy: validation

Validate before calling

// Go, before Prepare
for _, kv := range cfg.Vars {
    parts := strings.SplitN(kv, "=", 2)
    if len(parts) != 2 || parts[0] == "" {
        return fmt.Errorf("env var %q must be KEY=value", kv)
    }
}

Try / catch

// Go
if err := prov.Prepare(cfg); err != nil {
    if strings.Contains(err.Error(), "Environment variable not in format") {
        // normalize cfg.Vars entries to KEY=value and retry Prepare
    }
    return err
}

Prevention

Always express environment_vars as an array of "KEY=value" strings, never bare keys.
Include '=' even when the value is empty ("KEY=").
Quote values containing '='; SplitN only splits on the first '='.
Add a CI check that scans template files for malformed var entries.

When it happens

Trigger: Prepare called with config.Vars entries like "foo" (no '='), "=bar" (empty key), or an entry where the value was accidentally omitted.

Common situations: Writing env vars as a JSON object instead of an array of key=value strings; forgetting the value; leading '=' typos; quoting mistakes in HCL2 that drop the '='.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/4b7d106450754803. Report an issue: GitHub.