action %s has ephemeral config values, which are not support

Error message

action %s has ephemeral config values, which are not supported in action invocations

What it means

After unmarking the action's config value, the renderer separates sensitive, then ephemeral marks. If any ephemeral paths remain, it refuses to serialize: ephemeral (write-only, never-persisted) values cannot be represented in the JSON action invocation output, so emitting them would lose their protection guarantee.

Source

Thrown at internal/command/jsonplan/action_invocations.go:162

	case *plans.InvokeActionTrigger:
		ai.InvokeActionTrigger = &InvokeActionTrigger{}
		if at.CallingResourceAddr != nil {
			ai.InvokeActionTrigger.CallingResourceAddress = at.CallingResourceAddr.String()
		}
	default:
		return ai, fmt.Errorf("unsupported action trigger type: %T", at)
	}

	var config []byte
	var sensitive []byte
	var unknown []byte

	if actionDec.ConfigValue != cty.NilVal {
		unmarkedValue, pvms := actionDec.ConfigValue.UnmarkDeepWithPaths()
		sensitivePaths, otherMarks := marks.PathsWithMark(pvms, marks.Sensitive)
		ephemeralPaths, otherMarks := marks.PathsWithMark(otherMarks, marks.Ephemeral)
		if len(ephemeralPaths) > 0 {
			return ai, fmt.Errorf("action %s has ephemeral config values, which are not supported in action invocations", action.Addr)
		}
		if len(otherMarks) > 0 {
			return ai, fmt.Errorf("action %s has config values with unsupported marks: %v", action.Addr, otherMarks)
		}

		unknownValue := unknownAsBool(unmarkedValue)
		unknown, err = ctyjson.Marshal(unknownValue, unknownValue.Type())
		if err != nil {
			return ai, err
		}

		configValue := omitUnknowns(unmarkedValue)
		config, err = ctyjson.Marshal(configValue, configValue.Type())
		if err != nil {
			return ai, err
		}

		sensitivePaths = append(sensitivePaths, schema.ConfigSchema.SensitivePaths(unmarkedValue, nil)...)

View on GitHub (pinned to c9def3e214)

Solutions

Remove the ephemeral reference from the action's config_values block so the value is wholly known and non-ephemeral.
Pass the sensitive-but-not-ephemeral form of the value if only secrecy is required.
Upgrade Terraform to a version whose jsonplan supports ephemeral action config if one exists for your case.

Example fix

# before
action "restart" {
  config = {
    token = ephemeral_resource.secret.token  # ephemeral -> error
  }
}

# after: use a non-ephemeral value
variable "token" { type = string sensitive = true }
action "restart" {
  config = { token = var.token }

Defensive patterns

Strategy: validation

Validate before calling

// Detect ephemeral marks in an action config before marshaling so you can
// give a targeted message instead of failing inside MarshalActionInvocation.
for _, a := range plan.Changes.ActionInvocations {
    sch := schemas.ActionTypeConfig(a.ProviderAddr.Provider, a.Addr.Action.Action.Type)
    dec, err := a.Decode(&sch)
    if err != nil || dec.ConfigValue == cty.NilVal {
        continue
    }
    _, pvms := dec.ConfigValue.UnmarkDeepWithPaths()
    eph, _ := marks.PathsWithMark(pvms, marks.Ephemeral)
    if len(eph) > 0 {
        return fmt.Errorf("action %s uses ephemeral config, unsupported in JSON plan", a.Addr)
    }
}

Try / catch

ai, err := jsonplan.MarshalActionInvocation(action, schemas)
if err != nil && strings.Contains(err.Error(), "ephemeral config values") {
    // guide the user to remove the ephemeral reference from the action block
}
return err

Prevention

Do not reference ephemeral resources/variables inside provider action config blocks.
Use sensitive (not ephemeral) variables when you only need secrecy that can be serialized.
Document which action attributes are write-only so authors avoid passing them into actions.

When it happens

Trigger: actionDec.ConfigValue is non-nil and contains at least one value carrying the marks.Ephemeral mark (len(ephemeralPaths) > 0 after marks.PathsWithMark). Occurs when an action config block references an ephemeral variable/resource or a write-only provider attribute.

Common situations: Referencing an ephemeral variable (e.g. ephemeral = true input variable) or an ephemeral resource inside a provider action block; using write-only attributes in a lifecycle action before the JSON renderer supported them.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/8999da81782ae895. Report an issue: GitHub.