the iteration %s is revoked and can not be used on Packer bu

Error message

the iteration %s is revoked and can not be used on Packer builds

What it means

The iteration resolved for the hcp-packer-image datasource has a RevokeAt timestamp that is non-zero and in the past, meaning it was revoked. HCP Packer revocations are hard stops: the datasource refuses to return image metadata from revoked iterations so builds cannot consume deleted/insecure image versions. This is intentional safety behavior, not a bug.

Source

Thrown at datasource/hcp-packer-image/data.go:187

		channel, err := cli.GetChannel(ctx, d.config.Bucket, d.config.Channel)
		if err != nil {
			return cty.NullVal(cty.EmptyObject), fmt.Errorf("error retrieving "+
				"channel from HCP Packer registry: %s", err.Error())
		}

		if channel.Iteration == nil {
			return cty.NullVal(cty.EmptyObject), fmt.Errorf("there is no iteration associated with the channel %s",
				d.config.Channel)
		}
		channelID = channel.ID
		iteration = channel.Iteration
	}

	revokeAt := time.Time(iteration.RevokeAt)
	if !revokeAt.IsZero() && revokeAt.Before(time.Now().UTC()) {
		// If RevokeAt is not a zero date and is before NOW, it means this iteration is revoked and should not be used
		// to build new images.
		return cty.NullVal(cty.EmptyObject), fmt.Errorf("the iteration %s is revoked and can not be used on Packer builds",
			iteration.ID)
	}

	var output DatasourceOutput

	cloudAndRegions := map[string][]string{}
	for _, build := range iteration.Builds {
		if build.CloudProvider != d.config.CloudProvider {
			continue
		}
		for _, image := range build.Images {
			cloudAndRegions[build.CloudProvider] = append(cloudAndRegions[build.CloudProvider], image.Region)
			if image.Region == d.config.Region && filterBuildByComponentType(build, d.config.ComponentType) {
				// This is the desired image.
				output = DatasourceOutput{
					CloudProvider: build.CloudProvider,
					ComponentType: build.ComponentType,
					CreatedAt:     image.CreatedAt.String(),

View on GitHub (pinned to eb36e3c3e4)

Solutions

Repoint the channel to a non-revoked iteration in the HCP Packer registry.
Update the template to use a newer channel or a valid iteration_id.
If the revocation was premature, revert the revocation in HCP Packer (restore the iteration) and re-run the build.
Check scheduled revocation policies in HCP Packer that may have auto-revoked the iteration.

Example fix

// before
source "hcp" {
  datasource "hcp-packer-image" {
    channel        = "stable" // points at revoked iteration 01HOLD...
    cloud_provider = "aws"
    region         = "us-east-1"
  }
}
// after
// Repoint channel 'stable' to a valid iteration in HCP, then rebuild.
source "hcp" {
  datasource "hcp-packer-image" {
    channel        = "stable"
    cloud_provider = "aws"
    region         = "us-east-1"
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight: check the channel's iteration revocation status via HCP CLI/API
// hcp packer channels show <channel> --bucket=my-app
// Reject if iteration.revoke_at is set and in the past.

Try / catch

// Wrap the build and handle the explicit revocation error:
out=$(packer build template.pkr.hcl 2>&1) || {
  echo "$out" | grep -q 'is revoked and can not be used' && echo "Repoint channel to a valid iteration" 
  exit 1
}

Prevention

Track revocation schedules; update channels before revoke_at elapses.
Use a rolling 'latest-good' channel maintained by automation that skips revoked iterations.
Avoid hardcoding iteration IDs that may be revoked; prefer channels with lifecycle automation.
Alert on HCP Packer revocation events in your monitoring.

When it happens

Trigger: cli.GetChannel or GetIteration returns an iteration whose RevokeAt (converted via time.Time(iteration.RevokeAt)) is before time.Now().UTC(); Execute then returns this error before iterating builds.

Common situations: A channel still points at an iteration someone revoked via HCP Packer's revocation feature or a scheduled rollback; soft-deleted iterations past their revocation date are still referenced by templates; CI pipelines pinned to old channels after a security revocation.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/3b2c46e932aa8d15. Report an issue: GitHub.