hashicorp/packer · error

project validation for id %q responded in error: %v

Error message

project validation for id %q responded in error: %v

What it means

loadProjectID, when HCP_PROJECT_ID is set in the environment, takes it at face value and calls ValidateRegistryForProject to confirm the project exists and is accessible with the current credentials. If validation returns an error, it is wrapped as `project validation for id %q responded in error: %v` including the offending project ID.

Source

Thrown at internal/hcp/api/client.go:135

	listOrgParams := organizationSvc.NewOrganizationServiceListParams()
	listOrgResp, err := c.Organization.OrganizationServiceList(listOrgParams, nil)
	if err != nil {
		return fmt.Errorf("unable to fetch organization list: %v", err)
	}
	orgLen := len(listOrgResp.Payload.Organizations)
	if orgLen != 1 {
		return fmt.Errorf("unexpected number of organizations: expected 1, actual: %v", orgLen)
	}
	c.OrganizationID = listOrgResp.Payload.Organizations[0].ID
	return nil
}

func (c *Client) loadProjectID() error {
	if env.HasProjectID() {
		c.ProjectID = os.Getenv(env.HCPProjectID)
		err := c.ValidateRegistryForProject()
		if err != nil {
			return fmt.Errorf("project validation for id %q responded in error: %v", c.ProjectID, err)
		}
		return nil
	}
	// Get the project using the organization ID.
	listProjParams := projectSvc.NewProjectServiceListParams()
	listProjParams.ScopeID = &c.OrganizationID
	scopeType := string(rmmodels.HashicorpCloudResourcemanagerResourceIDResourceTypeORGANIZATION)
	listProjParams.ScopeType = &scopeType
	listProjResp, err := c.Project.ProjectServiceList(listProjParams, nil)

	if err != nil {
		//For permission errors, our service principal may not have the ability
		// to see all projects for an Org; this is the case for project-level service principals.
		serviceErr, ok := err.(*projectSvc.ProjectServiceListDefault)
		if !ok {
			return fmt.Errorf("unable to fetch project list: %v", err)
		}
		if serviceErr.Code() == http.StatusForbidden {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify HCP_PROJECT_ID matches an existing project UUID in the HCP portal and correct it
2. Ensure the service principal's organization matches the project's organization
3. Grant the principal access to the project's Packer registry (buckets: read/write as needed)
4. Unset HCP_PROJECT_ID to let loadProjectID discover the project via the organization listing instead

Example fix

// before: stale project id
export HCP_PROJECT_ID=old-deleted-uuid
// after
export HCP_PROJECT_ID=<current-project-uuid-from-hcp-portal>

// Confirm the project id is set and non-empty before client construction
pid := os.Getenv("HCP_PROJECT_ID")
if pid == "" {
    return errors.New("HCP_PROJECT_ID must be set (use the UUID from the HCP portal)")
}

if err != nil && strings.Contains(err.Error(), "project validation") {
    return fmt.Errorf("check HCP_PROJECT_ID exists and the principal has access: %w", err)
}

When it happens

Trigger: NewClient → loadProjectID with env.HasProjectID() true, and ValidateRegistryForProject fails: nonexistent project ID, project belongs to a different organization than the principal, deleted project, or principal lacking the HCP Packer registry role on that project.

Common situations: Stale HCP_PROJECT_ID after a project was deleted or recreated; copying a project ID from another organization; service principal scoped to a different org than the project; typo in the project UUID.

Related errors

• The `bucket_name` must be specified
• `channel` is currently a required field.
• the `bucket_name` must be specified
• the `channel_name` must be specified
• error retrieving HCP Packer Version from HCP Packer Registry

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e2b54ab7f50cc3eb. Report an issue: GitHub.