pulumi/pulumi · error

opening ESC environments for policy pack %q: %w

Error message

opening ESC environments for policy pack %q: %w

What it means

Raised in PolicyPack.ResolveEnvironments when opening the synthetic ESC environment (built from the policy pack's required environments) via OpenYAMLEnvironment fails. This mirrors stack ESC resolution: the policy pack declares Pulumi Cloud environments, and the ESC engine could not open/import them. Diagnostics are handled separately; only the hard open failure is wrapped here.

Source

Thrown at pkg/backend/httpstate/policypack.go:140

	return installRequiredPolicy(ctx, policyPackPath, content, stdout, stderr)
}

func (rp *cloudRequiredPolicy) Config() map[string]*json.RawMessage { return rp.RequiredPolicy.Config }

// ResolveEnvironments opens any referenced ESC environments and returns resolved
// config (from policyConfig) and environment variables. Returns nil if no environments are referenced.
func (rp *cloudRequiredPolicy) ResolveEnvironments(ctx context.Context) (*engine.ResolvedPolicyEnvironment, error) {
	if len(rp.Environments) == 0 {
		return nil, nil
	}

	// Build a synthetic environment that imports all referenced environments.
	// This reuses the same path as stack ESC resolution.
	yaml := workspace.NewEnvironment(rp.Environments).Definition()

	env, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)
	if err != nil {
		return nil, fmt.Errorf("opening ESC environments for policy pack %q: %w", rp.RequiredPolicy.Name, err)
	}
	if len(diags) != 0 {
		var diagMsgs strings.Builder
		for _, d := range diags {
			fmt.Fprintf(&diagMsgs, "  %s\n", d.Summary)
		}
		return nil, fmt.Errorf(
			"opening ESC environments for policy pack %q:\n%s", rp.RequiredPolicy.Name, diagMsgs.String())
	}

	result := &engine.ResolvedPolicyEnvironment{}

	// Extract policyConfig from the resolved environment.
	if policyConfigVal, ok := env.Properties["policyConfig"]; ok {
		policyConfig, err := escValueToConfigMap(policyConfigVal)
		if err != nil {
			return nil, fmt.Errorf("extracting policyConfig from ESC environment for %q: %w", rp.RequiredPolicy.Name, err)
		}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Check the policy pack's environments list and confirm each named environment exists in the org (Pulumi Cloud ESC console).
2. Grant the current token/user read access to every referenced environment (check ESC environment permissions).
3. Open the environments in `pulumi esc` to surface YAML/definition errors (invalid syntax, circular imports).
4. Remove stale environment references from the policy pack configuration after renames or deletions.

Example fix

// before (pulumi policy config)
environments:
  - prod/secrets-env   // deleted, causes open failure
// after
environments:
  - prod/policy-config  // verified to exist and be readable
// code path
env, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)
if err != nil {
	return nil, fmt.Errorf("check ESC environments exist and are accessible for %q: %w", rp.RequiredPolicy.Name, err)
}

for _, envName := range rp.Environments {
	if _, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName,
		workspace.NewEnvironment([]string{envName}).Definition(), time.Minute, nil); err != nil {
		return fmt.Errorf("ESC environment %q missing or unreadable: %w", envName, err)
	}
}

func hasDiagnostics(diags []encoding.Diagnostic) bool {
	return len(diags) > 0
}

env, diags, err := rp.envs.OpenYAMLEnvironment(ctx, rp.orgName, yaml, 2*time.Hour, nil)
if err != nil {
	return nil, fmt.Errorf("ESC environments for policy pack %q must exist and be readable: %w", rp.RequiredPolicy.Name, err)
}
if hasDiagnostics(diags) {
	// surface diags before proceeding
}

When it happens

Trigger: A policy pack references ESC environments that don't exist, were deleted/renamed, aren't readable by the current token, contain invalid YAML/ESC definitions, or the ESC service call fails (network, 401/403, org mismatch).

Common situations: Environment deleted after being added to a policy pack's required policies config; token lacks read access to another team's environment; circular environment imports; typo in environment names in policy pack configuration; org renamed.

Related errors

• opening ESC environments for policy pack %q: %s
• preparing ESC environment for policy pack %q: %w
• opening ESC environments: %w
• Publish policy pack failed: %w
• Request to signal completion of the publish operation failed

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/3d8378ab4a60884b. Report an issue: GitHub.