Invalid execution policy provided. Please supply one of: "by

Error message

Invalid execution policy provided. Please supply one of: "bypass", "allsigned", "default", "remotesigned", "restricted", "undefined", "unrestricted", "none".

What it means

The PowerShell provisioner maps `execution_policy` strings to an integer enum (0-8, covering bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none). Prepare throws this error when config.ExecutionPolicy holds a value greater than 7, i.e. an unrecognized policy name or out-of-range value.

Source

Thrown at provisioner/powershell/provisioner.go:284

	for _, path := range p.config.Scripts {
		if _, err := os.Stat(path); err != nil {
			errs = packersdk.MultiErrorAppend(errs,
				fmt.Errorf("Bad script '%s': %s", path, err))
		}
	}

	// Do a check for bad environment variables, such as '=foo', 'foobar'
	for _, kv := range p.config.Vars {
		vs := strings.SplitN(kv, "=", 2)
		if len(vs) != 2 || vs[0] == "" {
			errs = packersdk.MultiErrorAppend(errs,
				fmt.Errorf("Environment variable not in format 'key=value': %s", kv))
		}
	}

	if p.config.ExecutionPolicy > 7 {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf(`Invalid execution `+
			`policy provided. Please supply one of: "bypass", "allsigned",`+
			` "default", "remotesigned", "restricted", "undefined", `+
			`"unrestricted", "none".`))
	}

	if !(p.config.DebugMode >= 0 && p.config.DebugMode <= 2) {
		errs = packersdk.MultiErrorAppend(errs, fmt.Errorf("%d is an invalid Trace level for `debug_mode`; valid values are 0, 1, and 2", p.config.DebugMode))
	}

	if errs != nil {
		return errs
	}

	return nil
}

// Takes the inline scripts, adds a wrapper around the inline scripts, concatenates them into a temporary file and
// returns a string containing the location of said file.

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set execution_policy to one of: bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none.
Remove the execution_policy key entirely to use the provisioner default.
Check spelling and lowercase the value; the decode is exact.

Example fix

// before
execution_policy = "Remote Signed"
// after
execution_policy = "remotesigned"

Defensive patterns

Strategy: validation

Validate before calling

// Go, before Prepare
valid := map[string]bool{"bypass": true, "allsigned": true, "default": true, "remotesigned": true, "restricted": true, "undefined": true, "unrestricted": true, "none": true}
if cfg.ExecutionPolicy != "" && !valid[strings.ToLower(cfg.ExecutionPolicy)] {
    return fmt.Errorf("execution_policy %q not supported", cfg.ExecutionPolicy)
}

Try / catch

// Go
if err := prov.Prepare(cfg); err != nil {
    if strings.Contains(err.Error(), "Invalid execution policy") {
        // reset cfg.ExecutionPolicy to "" or a listed value
    }
    return err
}

Prevention

Copy policy names exactly from the docs: bypass, allsigned, default, remotesigned, restricted, undefined, unrestricted, none.
Use lowercase values with no spaces or hyphens.
Omit execution_policy entirely when unsure — the default is safe.
Keep a shared HCL variable with a validation block constraining execution_policy values.

When it happens

Trigger: Prepare called with config.ExecutionPolicy > 7 — typically after a misspelled or unsupported execution_policy string was converted by the enum decode, or a numeric value out of range.

Common situations: Typo in execution_policy (e.g. "remote-signed" instead of "remotesigned"); using a policy name not in the supported list; copy-pasting Windows policy names like "remotesigned, bypass"; older templates using removed values.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e37fcd34efb70967. Report an issue: GitHub.