pulumi/pulumi · error

new passphrase must be provided

Error message

new passphrase must be provided

What it means

ChangeStackSecretsProvider requires a NewPassphrase when switching a stack to the 'passphrase' secrets provider. If opts is nil or opts.NewPassphrase is nil, this plain error is returned before any CLI invocation. It is a client-side argument validation error.

Source

Thrown at sdk/go/auto/local_workspace.go:646

	}
	for _, s := range stacks {
		if s.Current {
			return &s, nil
		}
	}
	return nil, nil
}

// ChangeStackSecretsProvider edits the secrets provider for the given stack.
func (l *LocalWorkspace) ChangeStackSecretsProvider(
	ctx context.Context, stackName, newSecretsProvider string, opts *ChangeSecretsProviderOptions,
) error {
	args := []string{"stack", "change-secrets-provider", "--stack", stackName, newSecretsProvider}

	var reader io.Reader
	if newSecretsProvider == "passphrase" {
		if opts == nil || opts.NewPassphrase == nil {
			return errors.New("new passphrase must be provided")
		}
		reader = strings.NewReader(*opts.NewPassphrase)
	}
	stdout, stderr, errCode, err := l.runPulumiInputCmdSync(ctx, reader, nil, nil, args...)
	if err != nil {
		return newAutoError(fmt.Errorf("failed to change secrets provider: %w", err), stdout, stderr, errCode)
	}
	return nil
}

// CreateStack creates and sets a new stack with the stack name, failing if one already exists.
func (l *LocalWorkspace) CreateStack(ctx context.Context, stackName string) error {
	args := []string{"stack", "init", stackName}
	if l.secretsProvider != "" {
		args = append(args, "--secrets-provider", l.secretsProvider)
	}
	if l.remote {
		args = append(args, "--no-select")

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Pass &auto.ChangeSecretsProviderOptions{NewPassphrase: &passphrase} when newSecretsProvider is "passphrase"
2. Choose a different provider type if no passphrase is intended (e.g. "cloud")
3. Store the passphrase securely (env var/secret manager) and reference it rather than hardcoding

Example fix

// before
err := ws.ChangeStackSecretsProvider(ctx, stackName, "passphrase", nil)
// after
passphrase := os.Getenv("STACK_PASSPHRASE")
err := ws.ChangeStackSecretsProvider(ctx, stackName, "passphrase",
    &auto.ChangeSecretsProviderOptions{NewPassphrase: &passphrase})

if newProvider == "passphrase" && (opts == nil || opts.NewPassphrase == nil || *opts.NewPassphrase == "") {
    return errors.New("NewPassphrase is required when switching to the passphrase provider")
}

func passphraseOptsProvided(opts *auto.ChangeSecretsProviderOptions) bool {
    return opts != nil && opts.NewPassphrase != nil && *opts.NewPassphrase != ""
}

if err := ws.ChangeStackSecretsProvider(ctx, stack, "passphrase", opts); err != nil {
    if err.Error() == "new passphrase must be provided" {
        return fmt.Errorf("bug in caller: supply ChangeSecretsProviderOptions.NewPassphrase")
    }
    return err
}

When it happens

Trigger: Calling LocalWorkspace.ChangeStackSecretsProvider(ctx, stackName, "passphrase", nil) or with &ChangeSecretsProviderOptions{} (NewPassphrase left nil).

Common situations: Migrating a stack from a cloud/cloudpassphrase provider to a local passphrase provider and forgetting the options struct; copying example code that used a non-passphrase target provider.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• unable to set config: %w
• unable to set nil environment values
• failed to change secrets provider: %w
• could not get secret outputs: %w
• error unmarshalling secret outputs: %s: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/b2db64b7d2442256. Report an issue: GitHub.