pulumi/pulumi · error

configuring policy pack %q: %w

Error message

configuring policy pack %q: %w

What it means

After validation, the engine pushes the final config to the analyzer plugin via gRPC `Configure`. If that RPC fails (plugin crash, transport error, plugin rejects the config), the error is wrapped with the pack name. This means the config passed local validation but the plugin could not accept or apply it.

Source

Thrown at pkg/engine/update.go:323

			var configFromFile map[string]plugin.AnalyzerPolicyConfig
			if pack.Config != "" {
				configFromFile, err = resourceanalyzer.LoadPolicyPackConfigFromFile(pack.Config)
				if err != nil {
					return nil, err
				}
			}
			config, validationErrors, err := resourceanalyzer.ReconcilePolicyPackConfig(
				info.Policies, info.InitialConfig, configFromFile)
			if err != nil {
				return nil, fmt.Errorf("reconciling policy config for %q: %w", info.Name, err)
			}
			if len(validationErrors) > 0 {
				sort.Strings(validationErrors)
				return nil, fmt.Errorf("validating policy config for %q: %s",
					info.Name, strings.Join(validationErrors, "; "))
			}
			if err = analyzer.Configure(plugctx.Request(), config); err != nil {
				return nil, fmt.Errorf("configuring policy pack %q: %w", info.Name, err)
			}
		}
		analyzers = append(analyzers, analyzer)
	}
	return analyzers, nil
}

// HostFactory constructs the plugin host for a deployment.
type HostFactory func(
	ctx context.Context, d, statusD diag.Sink, debug plugin.DebugContext,
) (plugin.Host, error)

// UpdateOptions contains all the settings for customizing how an update (deploy, preview, or destroy) is performed.
//
// This structure is embedded in another which uses some of the unexported fields, which trips up the `structcheck`
// linter.
//
//nolint:structcheck

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Check the wrapped error and plugin stderr/logs for the root cause (crash vs config rejection)
2. Rebuild the policy pack with a @pulumi/policy version compatible with your CLI
3. Re-run and watch plugin diagnostics; fix any config values the plugin rejects
4. Ensure adequate resources/permissions so the plugin process isn't killed

Example fix

// before: stale plugin binary crashes on Configure
pulumi plugin rm --all && pulumi up --policy-pack ./pack --policy-pack-config cfg.json
// after: rebuilt pack accepts config
npm rebuild && pulumi up --policy-pack ./pack --policy-pack-config cfg.json

info, err := analyzer.GetAnalyzerInfo(ctx)
if err != nil { return err } // plugin must be alive and protocol-compatible before Configure
if info.SupportsConfig { /* proceed with validated config */ }

err := runWithPolicyPack(cfgPath)
if err != nil && strings.Contains(err.Error(), "configuring policy pack") {
    log.Printf("plugin failed to accept config: %v", err)
    log.Println("check plugin logs, rebuild the pack, or remove stale plugins (pulumi plugin rm --all)")
    os.Exit(1)
}

When it happens

Trigger: Calling analyzer.Configure(plugctx.Request(), config) after successful validation when the analyzer plugin process is dead, the gRPC call fails, or the plugin-side configuration logic errors (e.g. invalid enforcement level, plugin version that can't deserialize the config).

Common situations: Policy pack plugin crashed or was killed (OOM) mid-deployment; plugin binary incompatible with the CLI's gRPC protocol version; plugin rejects enforcementLevel or config it cannot parse despite passing schema validation.

Related errors

• load %q: %w
• load provider: %w
• could not run plugin at %q: %w
• getting schema: %w
• could not execute plugin %s (%s): %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/45f4b59a337a2654. Report an issue: GitHub.