failed to validate explicit provider config for %s: %w

Error message

failed to validate explicit provider config for %s: %w

What it means

During a `pulumi import`, when the imported resource is an explicit provider, the engine calls the provider plugin's Check RPC to validate its configuration inputs. If the plugin returns an error (not validation failures, but a hard RPC/protocol error), the engine wraps it with this message and aborts the import. It means the provider's configuration could not even be evaluated for validity.

Source

Thrown at pkg/resource/deploy/import.go:545

			providers.SetProviderVersion(inputs, version)
		}
		if imp.PluginDownloadURL != "" {
			providers.SetProviderURL(inputs, imp.PluginDownloadURL)
		}
		if len(imp.PluginChecksums) > 0 {
			providers.SetProviderChecksums(inputs, imp.PluginChecksums)
		}
		if parameterization != nil {
			providers.SetProviderName(inputs, pkg)
			providers.SetProviderParameterization(inputs, parameterization)
		}

		resp, err := i.deployment.providers.Check(ctx, plugin.CheckRequest{
			URN:  providerURN,
			News: inputs,
		})
		if err != nil {
			return nil, fmt.Errorf("failed to validate explicit provider config for %s: %w", providerURN, err)
		}
		state := pkgresource.NewState{
			Type:                    typ,
			URN:                     providerURN,
			Custom:                  true,
			Delete:                  false,
			ID:                      "",
			Inputs:                  inputs,
			Outputs:                 nil,
			Parent:                  imp.Parent,
			Protect:                 false,
			Taint:                   false,
			External:                false,
			Dependencies:            nil,
			InitErrors:              nil,
			Provider:                "",
			PropertyDependencies:    nil,
			PendingReplacement:      false,

View on GitHub (pinned to 793f7b2e16)

Solutions

Read the wrapped underlying error (%w) for the plugin's actual message and fix the provider inputs passed via --provider.
Upgrade or reinstall the provider plugin so its Check RPC works with your engine version.
Verify the provider reference string (urn:id) passed with --provider is correctly formed.
Retry the import after correcting config; check plugin logs for the underlying cause.

Example fix

// before: provider inputs invalid
pulumi import --provider 'urn:pulumi:stack::proj::pulumi:providers:aws::default::04da6b54...' aws:iam/role:Role myRole r-123
// after: correct provider config inputs
pulumi import --provider 'urn:pulumi:stack::proj::pulumi:providers:aws::default::<valid-id>,region=us-east-1' aws:iam/role:Role myRole r-123

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-validate provider inputs via a stack preview before importing
const provider = new aws.Provider("default", { region: "us-east-1" });
// verify: pulumi preview succeeds and plugin version matches CLI

Try / catch

try {
  await pulumiImport(resourceArgs, { provider: providerRef });
} catch (e) {
  if (String(e).includes("failed to validate explicit provider config")) {
    // inspect wrapped cause, fix provider inputs / plugin, retry
  }
  throw e;
}

Prevention

Keep provider plugins up to date and compatible with your CLI version
Validate provider config with a preview before running import
Pass all required provider inputs explicitly with --provider

When it happens

Trigger: Running `pulumi import` with `--provider` referencing an explicit provider whose inputs fail the provider's Check call — e.g. the plugin crashes, returns a gRPC error, or its inputs are structurally invalid so Check errors instead of returning failures.

Common situations: Malformed provider config on the import command line, a provider plugin binary that is broken or incompatible with the engine, or provider inputs that fail deserialization in the plugin.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/df7db4bcaf829d43. Report an issue: GitHub.