pulumi/pulumi · error

enforcementLevel cannot be required in configSchema. enforce

Error message

enforcementLevel cannot be required in configSchema. enforcementLevel is a reserved property

What it means

For the same reserved-property reason, a policy config schema may not list 'enforcementLevel' among its Required fields. NewPolicyPack checks schema.Required and fails construction if it contains the reserved key.

Source

Thrown at sdk/go/pulumi/policyx/policy_pack.go:101

) (PolicyPack, error) {
	if name == "" || !policyPackNameRE.MatchString(name) {
		return nil, fmt.Errorf("invalid policy pack name: %q", name)
	}

	for _, policy := range policies {
		if policy.Name() == "all" {
			return nil, fmt.Errorf("invalid policy name %[1]q. %[1]q is a reserved name", policy.Name())
		}

		schema := policy.ConfigSchema()

		if schema != nil {
			if _, ok := schema.Properties["enforcementLevel"]; ok {
				return nil, errors.New("enforcementLevel cannot be explicitly specified in configSchema properties." +
					" enforcementLevel is a reserved property")
			}
			if slices.Contains(schema.Required, "enforcementLevel") {
				return nil, errors.New("enforcementLevel cannot be required in configSchema." +
					" enforcementLevel is a reserved property")
			}
		}
	}

	return &policyPack{
		name:     name,
		version:  version,
		policies: policies,
	}, nil
}

func (p *policyPack) Name() string { return p.name }

func (p *policyPack) Version() semver.Version { return p.version }

func (p *policyPack) Policies() []Policy {
	return p.policies

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Remove "enforcementLevel" from the schema's Required slice
2. Keep only user-defined config fields in Required
3. Add a test asserting Required excludes reserved keys

Example fix

// before
schema := &policyx.PolicyConfigSchema{
    Properties: props,
    Required:   []string{"enforcementLevel", "region"},
}
// after
schema := &policyx.PolicyConfigSchema{
    Properties: props,
    Required:   []string{"region"},
}

for _, r := range schema.Required {
    if r == "enforcementLevel" {
        panic("enforcementLevel is reserved and cannot be required")
    }
}

null

if _, err := policyx.NewPolicyPack(name, ver, level, policies); err != nil {
    if strings.Contains(err.Error(), "cannot be required") {
        // remove enforcementLevel from Required
    }
}

When it happens

Trigger: A Policy's ConfigSchema returns a Required slice containing "enforcementLevel".

Common situations: Building the Required list programmatically and including all properties; mistaking enforcementLevel for a user-configurable required field.

Related errors

• enforcementLevel cannot be explicitly specified in configSch
• failed to load Pulumi policy project located at %q: %w
• it looks like the policy pack's dependencies are not install
• policy pack not found at %q
• policy pack %q failed to start: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/2eb038dae002fa5e. Report an issue: GitHub.