pulumi/pulumi · error

getting stack policy packs: %w

Error message

getting stack policy packs: %w

What it means

This error wraps the failure of Backend().GetStackPolicyPacks(ctx, s.Ref()) while `pulumi policy install` fetches the policy packs configured for the stack from the backend. The underlying error (auth, network, API, or stack-not-found) is preserved via %w. It means the CLI could not even enumerate the stack's required packs, so nothing was installed.

Source

Thrown at pkg/cmd/pulumi/policy/policy_install.go:119

			return cmdStack.RequireStack(ctx, cmd.diag, pkgWorkspace.Instance,
				cmdBackend.DefaultLoginManager, stackName, cmdStack.LoadOnly, displayOpts, "")
		}
	}

	// Get the stack (uses current stack if stackName is empty).
	s, err := cmd.requireStack(ctx, stackName)
	if err != nil {
		if stackName == "" && errors.Is(err, workspace.ErrProjectNotFound) {
			return errors.New("could not find a Pulumi project in the current working directory; " +
				"please specify a stack using the --stack flag.")
		}
		return err
	}

	// Fetch the required policy packs for the stack.
	policyPacks, err := s.Backend().GetStackPolicyPacks(ctx, s.Ref())
	if err != nil {
		return fmt.Errorf("getting stack policy packs: %w", err)
	}

	if len(policyPacks) == 0 {
		fmt.Fprintf(cmd.stderr, "No policy packs to install for stack %s\n", s.Ref().String())
		return nil
	}

	cwd, err := cmd.getwd()
	if err != nil {
		return fmt.Errorf("getting current working directory: %w", err)
	}

	reg := cmdCmd.NewDefaultRegistry(
		ctx, cmdBackend.DefaultLoginManager, pkgWorkspace.Instance, nil, cmd.diag, env.Global())
	pluginHost, err := pkghost.New(context.WithoutCancel(ctx), cmd.diag, cmd.diag, nil,
		pkgWorkspace.EnsureLanguageInstalled, schema.NewLoaderServerFromContext, convert.NewMapperServerFromContext,
		packageworkspace.NewResolverServer(reg))
	if err != nil {

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Run `pulumi whoami` / `pulumi stack` to verify auth and that the stack ref resolves before retrying
2. Re-login with `pulumi login` to refresh an expired token
3. Check network/VPN connectivity to api.pulumi.com (curl the API URL)
4. Verify the --stack argument points to an existing stack in the current backend

Example fix

// before
pulumi policy install --stack myorg/prod/wrong-name
// after
pulumi stack select myorg/prod  # confirm the stack exists first
pulumi policy install

if !strings.Contains(out, backend) && exec.Command("pulumi","whoami").Run() != nil { return fmt.Errorf("not logged in; run pulumi login") }

err := runCmd("pulumi", "policy", "install")
if err != nil {
    if strings.Contains(err.Error(), "getting stack policy packs") {
        // check auth/connectivity, then retry with backoff
    }
}

When it happens

Trigger: Running `pulumi policy install` when the stack ref is wrong or missing server-side, the Pulumi Cloud API is unreachable, the auth token is expired/invalid, or the backend returns a non-200 for the stack-policy-packs endpoint.

Common situations: Expired Pulumi access token after `pulumi login` session aged out; VPN/firewall blocking api.pulumi.com; typo'd --stack value pointing at a nonexistent stack; self-hosted backend without the policy API implemented.

Related errors

• creating environment draft: %w
• submitting change request: %w
• updating environment draft: %w
• updating environment definition: %w
• cloning environment: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/fd15ae382cdebd5c. Report an issue: GitHub.