pulumi/pulumi · error

constructing deployment for upload: %w

Error message

constructing deployment for upload: %w

What it means

During `pulumi stack import`, after validation, the snapshot is serialized with `stack.SerializeUntypedDeployment`. If serialization fails — often because the snapshot contains secret values that cannot be encrypted (no/severed secrets provider), or malformed resources — the error is wrapped as "constructing deployment for upload: %w". The library throws it because it cannot build the deployment payload to hand to the backend.

Source

Thrown at pkg/cmd/pulumi/stack/io.go:569

		return multierror.Append(result,
			errors.New("importing this file could be dangerous; rerun with --force to proceed anyway"))
	}

	// Explicitly clear-out any pending operations.
	if snapshot.PendingOperations != nil {
		for _, op := range snapshot.PendingOperations {
			msg := fmt.Sprintf(
				"removing pending operation '%s' on '%s' from snapshot", op.Type, op.Resource.URN,
			)
			cmdutil.Diag().Warningf(diag.Message(op.Resource.URN, msg))
		}

		snapshot.PendingOperations = nil
	}

	dep, err := stack.SerializeUntypedDeployment(ctx, snapshot, nil /*opts*/)
	if err != nil {
		return fmt.Errorf("constructing deployment for upload: %w", err)
	}

	// Now perform the deployment.
	if err = backend.ImportStackDeployment(ctx, s, dep); err != nil {
		return fmt.Errorf("could not import deployment: %w", err)
	}
	return nil
}

// RequireCloudStack resolves the named stack (or the current stack when empty), requires that
// it lives on the Pulumi Cloud backend, and returns the cloud API client along with the
// StackIdentifier needed to address the stack via REST API endpoints.
func RequireCloudStack(
	ctx context.Context, sink diag.Sink, ws pkgWorkspace.Context, lm cmdBackend.LoginManager,
	stackName string,
) (*client.Client, client.StackIdentifier, error) {
	opts := display.Options{Color: cmdutil.GetGlobalColorization()}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Ensure the `secretsprovider` field in the deployment file matches the target stack's secrets provider, or re-encrypt the file with `pulumi stack change-secrets-provider` on the source.
2. Check the wrapped `%w` detail: if it mentions secrets/encryption, supply the correct key (e.g. set `PULUMI_CONFIG_PASSPHRASE` for passphrase stacks).
3. Validate the deployment JSON structure against a fresh `pulumi stack export` and fix malformed entries.
4. Try importing with the same CLI version that produced the export.

Example fix

// before: export uses passphrase, target stack uses Pulumi Cloud management
"secretsprovider": "passphrase"
// after: align the providers, e.g. re-encrypt source first
pulumi stack change-secrets-provider --stack dev passphrase://
pulumi stack export --stack dev > export.json
pulumi stack import --file export.json

# Check the deployment's secrets provider matches the target stack
jq -r '.secretsprovider // ""' export.json
pulumi stack select <target> && pulumi config  # inspect effective secrets provider

When it happens

Trigger: `pulumi stack import --file ...` where `SerializeUntypedDeployment(ctx, snapshot, nil)` returns an error: e.g. the imported state has secrets but the stack's secrets manager/key is missing or mismatched, or the snapshot has resources that fail marshaling.

Common situations: Importing state that references a passphrase/KMS secrets provider different from the target stack's; secrets provider changed after export (`secretsprovider` field mismatch); corrupted resource entries in the deployment JSON.

Related errors

• serializing resource state: %w
• serializing operation: %w
• serializing new snapshot: %w
• failed to serialize snapshot: %w
• failed to serialize repaired snapshot: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/eb62b413f73e7215. Report an issue: GitHub.