pulumi/pulumi · error

<joined error messages>

Error message

<joined error messages>

What it means

After protecting resources, any per-resource errors collected during the edit are joined with newlines into a single error and surfaced to the user. It aggregates failures like URNs not found in the snapshot.

Source

Thrown at pkg/cmd/pulumi/state/state_protect.go:197

func protectMultipleResources(
	ctx context.Context, stdout io.Writer,
	sink diag.Sink, ws pkgWorkspace.Context, stackName string, urns []string, showPrompt bool,
) error {
	return runTotalStateEditWithPrompt(
		ctx, sink, ws, backend.DefaultLoginManager, stackName, showPrompt, func(_ display.Options, snap *deploy.Snapshot,
		) error {
			resourceCount, errs := protectResourcesInSnapshot(snap, urns)

			if resourceCount > 0 && len(errs) == 0 {
				fmt.Fprintf(stdout, "%d resources protected\n", resourceCount)
			}

			if len(errs) > 0 {
				errMsgs := slice.Prealloc[string](len(errs))
				for _, err := range errs {
					errMsgs = append(errMsgs, err.Error())
				}
				return errors.New(strings.Join(errMsgs, "\n"))
			}

			return nil
		}, protectMessage)
}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Check each URN against `pulumi stack export` or `pulumi stack --show-urns` and fix typos/mismatches
2. Ensure the URNs belong to the currently targeted stack
3. Remember pending-delete resources are skipped — exclude them or refresh state first
4. Retry after a `pulumi refresh` so URNs reflect current state

Example fix

// before
$ pulumi state protect --resource "urn:pulumi:st::proj::aws:s3/bucket:Bucket::old"
error: ...not found...
// after
$ pulumi stack export | grep urn  # find correct URN
$ pulumi state protect --resource "urn:pulumi:st::proj::aws:s3/bucket:Bucket::b"

# verify each URN exists before protecting
pulumi stack export | grep -F "$URN" || echo "missing: $URN"

if err != nil {
    for _, line := range strings.Split(err.Error(), "\n") {
        log.Printf("protect failed: %s", line)
    }
}

When it happens

Trigger: `pulumi state protect --resource urn1 urn2 ...` where one or more URNs don't match any resource in the snapshot (or other per-resource edit failures occur).

Common situations: Typos in URNs; URNs from a different stack; resources deleted or pending deletion and thus excluded; renamed resources with stale URNs.

Related errors

• --provider: %w
• resource %s is not a provider (type=%s); --provider must nam
• resource %s is a provider for a different package (type=%s);
• no resource named %s in the current stack
• expected a URN but got a Provider Reference, use '%s' instea

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/bd2b599d74fa43c4. Report an issue: GitHub.