pulumi/pulumi · error

getting stack config value for key '%v': %w

Error message

getting stack config value for key '%v': %w

What it means

This wrapped error occurs while resolving a stack config value during GetStackConfiguration: stackConfig.Get(key, true) failed for the given key. The %w wraps the underlying cause (e.g. decryption failure or malformed stored value) and the message names the config key. It indicates the stack's stored configuration for that key could not be retrieved, not that the key is absent.

Source

Thrown at pkg/workspace/config.go:98

	}

	keys := make([]string, 0, len(project.Config))
	for k := range project.Config {
		keys = append(keys, k)
	}
	sort.Strings(keys)

	for _, projectConfigKey := range keys {
		projectConfigType := project.Config[projectConfigKey]

		key, err := parseConfigKey(project.Name.String(), projectConfigKey)
		if err != nil {
			return err
		}

		stackValue, _, err := stackConfig.Get(key, true)
		if err != nil {
			return fmt.Errorf("getting stack config value for key '%v': %w", key.String(), err)
		}

		if projectConfigType.IsExplicitlyTyped() {
			// We need to use stackValue.Value(dec) here to account for nested values.
			// We cannot get these from the decrypted config map as it does not handle nested values.
			// Uses the cached decrypted value from the batch decrypt above.
			decryptedValue, err := stackValue.Value(dec)
			if err != nil {
				return err
			}
			err = validateStackConfigValue(stackName, projectConfigKey, projectConfigType, stackValue, decryptedValue)
			if err != nil {
				return err
			}
		}
	}

	return nil

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Read the wrapped cause in the error chain and fix it (most often a decryption problem)
2. Ensure PULUMI_CONFIG_PASSPHRASE is set/correct when using the passphrase secrets provider
3. Re-set the broken value: pulumi config set <key> --secret <value> to rewrite it with valid encryption
4. If migrating stacks, use pulumi stack change-secrets-provider to re-encrypt values correctly

Example fix

# before: decryption fails because passphrase env var missing in CI
$ pulumi up  # -> getting stack config value for key 'db:password': ...
# after
$ export PULUMI_CONFIG_PASSPHRASE="$SECRET_PASSPHRASE"
$ pulumi up

// ensure secrets provider prerequisites exist before invoking
if (!process.env.PULUMI_CONFIG_PASSPHRASE && fs.existsSync('Pulumi.<stack>.yaml') && /secure/.test(fs.readFileSync(`Pulumi.${stack}.yaml`,'utf8'))) {
  throw new Error('PULUMI_CONFIG_PASSPHRASE must be set for passphrase secrets provider');
}

import { errors } from 'node:util';
try {
  await loadStackConfig();
} catch (err) {
  if (errors.unwrap(err)) {
    console.error('Config value retrieval failed; fix underlying cause:', errors.unwrap(err));
  }
  throw err;
}

When it happens

Trigger: Calling code paths that fully decrypt/read stack configuration (e.g. pulumi config get, pulumi up preparing config) when the stored value for a key cannot be fetched — commonly a secret whose encryption key/secrets provider is unavailable or whose ciphertext is corrupt.

Common situations: Secrets provider passphrase missing or wrong (PULUMI_CONFIG_PASSPHRASE not set) so decryption fails; stack moved between backends/organizations with different secret keys; manually edited Pulumi.stack.yaml corrupting a value.

Related errors

• no known secrets provider for type %q
• failed to decrypt value for key %q: %w
• could not decrypt configuration values: %w
• could not decrypt configuration value: %w
• getting stack configuration: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/65e5f12f70ec524f. Report an issue: GitHub.