pulumi/pulumi · error

getting stack configuration: %w

Error message

getting stack configuration: %w

What it means

During refresh setup, the CLI loads the stack's full configuration via config.GetStackConfiguration (project + stack config + secrets manager). If loading fails — bad config file, unreadable secrets provider, malformed Pulumi.yaml — the error is wrapped as "getting stack configuration" and the refresh aborts.

Source

Thrown at pkg/cmd/pulumi/operations/refresh.go:242

				cmdutil.Diag(),
				ws,
				cmdBackend.DefaultLoginManager,
				stackName,
				cmdStack.OfferNew,
				opts.Display,
				configFile,
			)
			if err != nil {
				return err
			}

			if err := parseAndSaveConfigArray(ctx, cmdutil.Diag(), ws, s, configArray, path, configFile); err != nil {
				return err
			}

			cfg, sm, err := config.GetStackConfiguration(ctx, cmdutil.Diag(), ssml, s, proj, configFile, envOverrides)
			if err != nil {
				return fmt.Errorf("getting stack configuration: %w", err)
			}

			m, err := metadata.GetUpdateMetadata(message, root, execKind, execAgent, false, cfg, cmd.Flags())
			if err != nil {
				return fmt.Errorf("gathering environment metadata: %w", err)
			}
			cmdutil.SetStringSpanAttributes(ctx, m.Environment)

			decrypter := sm.Decrypter()
			encrypter := sm.Encrypter()

			stackName := s.Ref().Name().String()
			// Skip config validation when the program is not being run (the default for refresh),
			// or when explicitly requested via --skip-config-validation. This allows stacks with
			// missing or invalid config to be refreshed in scenarios such as ephemeral PR environments
			// where config may diverge between branches.
			if runProgram && !skipConfigValidation {
				// Running the program: validate the stack config (and apply project defaults).

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Read the wrapped inner error: fix the specific file or secrets provider it names
2. Verify PULUMI_CONFIG_PASSPHRASE (or cloud credentials) is set correctly in the environment
3. Run `pulumi config` to confirm the stack config loads before refreshing
4. Validate Pulumi.yaml parses as YAML and matches the project schema

Example fix

// before (CI)
pulumi refresh
// after (CI)
export PULUMI_CONFIG_PASSPHRASE="$SECRET"
pulumi refresh

# pre-flight: confirm config loads before refresh
pulumi config || exit 1

if strings.Contains(err.Error(), "getting stack configuration:") {
    // check secrets provider credentials and Pulumi.yaml before retrying
}

When it happens

Trigger: Running `pulumi refresh` when the stack's config file is missing/corrupt, the secrets provider cannot be initialized (bad passphrase, inaccessible key vault), or Pulumi.yaml is invalid YAML/schema.

Common situations: Wrong PULUMI_CONFIG_PASSPHRASE in CI; secrets provider (e.g. Azure KV, AWS KMS) credentials expired; a malformed Pulumi.<stack>.yaml after a manual edit; running from a directory without Pulumi.yaml and no --config-file.

Related errors

• config value for '%s' looks like a secret; rerun with --secr
• saving config: %w
• validating stack config: %w
• applying stack config: %w
• getting snapshot: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/7d41947bced245ab. Report an issue: GitHub.