pulumi/pulumi · error

invalid configuration key: %w

Error message

invalid configuration key: %w

What it means

`pulumi config cp` copies a single configuration key between stacks. Before reading the value, it parses the user-supplied key string into a config.Key via ParseConfigKey; this error wraps any parse failure (missing `:` separator, invalid namespace, or inability to determine the default project namespace). The copy is aborted before any value is read or written.

Source

Thrown at pkg/cmd/pulumi/config/io.go:298

	}
	return overrides, nil
}

func copySingleConfigKey(
	ctx context.Context,
	ssml cmdStack.SecretsManagerLoader,
	configKey string,
	path bool,
	currentStack backend.Stack,
	currentProjectStack *workspace.ProjectStack,
	destinationStack backend.Stack,
	destinationProjectStack *workspace.ProjectStack,
	configFile string,
) error {
	var decrypter config.Decrypter
	key, err := ParseConfigKey(pkgWorkspace.Instance, configKey, path)
	if err != nil {
		return fmt.Errorf("invalid configuration key: %w", err)
	}

	v, ok, err := currentProjectStack.Config.Get(key, path)
	if err != nil {
		return err
	} else if !ok {
		return fmt.Errorf("configuration key '%s' not found for stack '%s'", PrettyKey(key), currentStack.Ref())
	}

	if v.Secure() {
		var err error
		var state cmdStack.SecretsManagerState
		if decrypter, state, err = ssml.GetDecrypter(ctx, currentStack, currentProjectStack); err != nil {
			return fmt.Errorf("could not create a decrypter: %w", err)
		}
		contract.Assertf(
			state == cmdStack.SecretsManagerUnchanged,
			"We're reading a secure value so the encryption information must be present already",

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Pass the key in valid `namespace:key` form, e.g. `aws:region`
2. If the key is a literal path key, add `--path` so the colon requirement is relaxed
3. Verify you are in a directory containing a valid Pulumi.yaml so the project-name default namespace can be resolved
4. Run `pulumi config` to list keys and copy the exact spelling

Example fix

// before
pulumi config cp region staging
// after
pulumi config cp aws:region staging

if !strings.Contains(key, ":") && !pathMode {
    return fmt.Errorf("key %q must be namespace:key (or pass --path)", key)
}

if err := runConfigCopy(key, dest); err != nil {
    if strings.Contains(err.Error(), "invalid configuration key") {
        // prompt user for correct namespace:key form
    }
}

When it happens

Trigger: Running `pulumi config cp` (or `config cp --path`) with a malformed key argument, e.g. a key without a namespace colon when not using --path, or an empty/garbage key string.

Common situations: Typos like `pulumi config cp aws:region dest` where the source key lacks `namespace:key` form; forgetting `--path` when the key contains dots/colons that are meant literally; running outside a project directory so the default namespace cannot be resolved.

Related errors

• invalid path: %w
• invalid path: %w
• invalid value: %w
• unmarshaling environment definition: %w
• cannot specify both mode and pattern/enforce

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/d444c1520699f8c1. Report an issue: GitHub.