resource %s is not a provider (type=%s); --provider must nam

Error message

resource %s is not a provider (type=%s); --provider must name a provider resource

What it means

The URN supplied to --provider resolves to a resource whose type is not `pulumi:providers:<pkg>`, i.e. a regular resource rather than a provider. The CLI sanity-checks this to fail fast with a clear message instead of a confusing schema error later.

Source

Thrown at pkg/cmd/pulumi/do/do_shared.go:983

	)
	if err != nil {
		return nil, fmt.Errorf("load stack: %w", err)
	}
	snap, err := s.Snapshot(ctx, backendSecrets.DefaultProvider)
	if err != nil {
		return nil, fmt.Errorf("load stack snapshot: %w", err)
	}
	if snap == nil {
		return nil, fmt.Errorf("stack has no snapshot yet; cannot resolve --provider %s", providerURN)
	}
	for _, res := range snap.Resources {
		if res.URN != providerURN {
			continue
		}
		// Sanity-check: the URN must refer to a provider resource. Providers have a type token of
		// the form "pulumi:providers:<pkg>"; anything else is almost certainly a user error.
		if !strings.HasPrefix(string(res.Type), "pulumi:providers:") {
			return nil, fmt.Errorf(
				"resource %s is not a provider (type=%s); --provider must name a provider resource",
				providerURN, res.Type,
			)
		}
		// The provider package must also match: AWS provider inputs handed to an Azure
		// Configure call would either fail with a confusing schema mismatch or — worse — silently
		// authenticate against the wrong cloud. Reject early with a clear message.
		expectedType := tokens.Type("pulumi:providers:" + pc.spec.Name())
		if res.Type != expectedType {
			return nil, fmt.Errorf(
				"resource %s is a provider for a different package (type=%s); --provider must name a %s resource",
				providerURN, res.Type, expectedType,
			)
		}
		// Clone so we don't hand callers an aliasing pointer into the snapshot's state.
		return maps.Clone(res.Inputs), nil
	}
	return nil, fmt.Errorf("no resource named %s in the current stack", providerURN)

View on GitHub (pinned to 793f7b2e16)

Solutions

Find the provider URN: it looks like urn:pulumi:<stack>::<project>::pulumi:providers:<pkg>::<name> — use that
Run `pulumi stack export | grep 'pulumi:providers'` to list provider URNs
Correct the --provider argument to name the provider resource, not a managed resource

Example fix

// before
--provider urn:pulumi:prod::infra::aws:s3/bucket:Bucket
// after
--provider urn:pulumi:prod::infra::pulumi:providers:aws::default

Defensive patterns

Strategy: validation

Validate before calling

pulumi stack export | jq -e --arg urn "$URN" 'any(.deployment.resources[]; .urn == $urn and (.type | startswith("pulumi:providers:")))' >/dev/null || { echo "URN is not a provider"; exit 1; }

Try / catch

if err := run(); err != nil {
	if strings.Contains(err.Error(), "is not a provider") {
		fmt.Fprintln(os.Stderr, "use a pulumi:providers:* URN")
	}
}

Prevention

Select URNs by grepping for pulumi:providers: prefix
Never hand-pick URNs from full resource lists
Validate URN type programmatically in scripts

When it happens

Trigger: Passing a URN of a bucket, VM, or other user resource to --provider during upsert/configure; e.g. --provider urn:pulumi:prod::infra::aws:s3/bucket:Bucket.

Common situations: Copy-pasting a URN from `pulumi stack` output and picking the wrong resource line; confusing a provider's child resource with the provider itself; scripting URN extraction incorrectly.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/455693b2273f7e6e. Report an issue: GitHub.