pulumi/pulumi · error

alias parent urn must not be secret

Error message

alias parent urn must not be secret

What it means

Alias parent URNs are treated as non-secret identifiers; if awaitURN reports the parent URN Output as secret, the SDK rejects the alias with this error because secret values cannot be embedded in alias specs sent to the engine.

Source

Thrown at sdk/go/pulumi/context.go:2503

		}
		spec.Parent = &pulumirpc.Alias_Spec_NoParent{
			NoParent: noParent.(bool),
		}
		// We're done here.
		return nil
	}

	resolvedParentURN, known, secret, err := parentURN.awaitURN(ctx.Context())
	if err != nil {
		return fmt.Errorf("alias parent could not be resolved: %w", err)
	}

	if !known {
		return errors.New("alias parent urn must be known")
	}

	if secret {
		return errors.New("alias parent urn must not be secret")
	}

	spec.Parent = &pulumirpc.Alias_Spec_ParentUrn{
		ParentUrn: string(resolvedParentURN),
	}

	return nil
}

// mapAliases maps a list of aliases coming from resource options
// to their RPC representation which the engine understands.
func (ctx *Context) mapAliases(aliases []Alias,
	resourceType string,
	name string,
	parent Resource,
) ([]*pulumirpc.Alias, error) {
	aliasSpecs := slice.Prealloc[*pulumirpc.Alias](len(aliases))
	await := func(input StringInput) (string, error) {

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Keep the parent URN out of secret transformations - alias against the resource object (Alias{Parent: res}) instead of a secret-tainted URN output
2. Unwrap the URN from the secret computation so it is a plain URNOutput
3. Refactor so secrets are handled in dedicated outputs, not in the value feeding ParentURN

Example fix

// before
urnOut := pulumi.Secret(parent.URN()).(pulumi.URNOutput)
alias := pulumi.Alias{ParentURN: urnOut} // secret -> rejected

// after
alias := pulumi.Alias{Parent: parent} // plain resource reference, not secret

When it happens

Trigger: Alias{ParentURN: <output>} where the URN output became secret - typically because the parent's URN passed through a secret-holding Output (e.g. derived inside ApplyT from a secret, or wrapped via pulumi.Secret/ToSecret).

Common situations: Chain of ApplyT calls over secret outputs accidentally capturing the URN; wrapping whole resource-output structs in secrets and then extracting URN; using secret config to select a parent resource.

Related errors

• Expected 'parent' string '%s' to contain '::'
• error collapsing alias to URN: %w
• alias parent could not be resolved: %w
• failed to collapse alias combinations: %w
• failed to normalize URN references: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/406bafcf675ab240. Report an issue: GitHub.