pulumi/pulumi · error

serializing resource state: %w

Error message

serializing resource state: %w

What it means

SerializeJournalEntry converts a journal entry's resource state into its wire (apitype) form via stack.SerializeResource. This error wraps any failure from that serialization — typically secret encryption failures, unsupported property values (e.g. binary data requiring byte-string encoding), or marshal errors. It means one resource in the journal entry could not be converted for persistence.

Source

Thrown at pkg/backend/journal.go:53

	"github.com/pulumi/pulumi/sdk/v3/go/common/apitype"
	"github.com/pulumi/pulumi/sdk/v3/go/common/env"
	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/config"
	utilenv "github.com/pulumi/pulumi/sdk/v3/go/common/util/env"
	"github.com/pulumi/pulumi/sdk/v3/go/common/util/logging"
	"github.com/pulumi/pulumi/sdk/v3/go/common/version"
)

func SerializeJournalEntry(
	ctx context.Context, je engine.JournalEntry, enc config.Encrypter,
) (apitype.JournalEntry, error) {
	var state *apitype.ResourceV3
	var requiresByteString bool

	if je.State != nil {
		s, encodedByteString, err := stack.SerializeResource(ctx, je.State, enc, false)
		if err != nil {
			return apitype.JournalEntry{}, fmt.Errorf("serializing resource state: %w", err)
		}
		state = &s
		requiresByteString = requiresByteString || encodedByteString
	}

	var operation *apitype.OperationV2
	if je.Operation != nil {
		op, encodedByteString, err := stack.SerializeOperation(ctx, *je.Operation, enc, false)
		if err != nil {
			return apitype.JournalEntry{}, fmt.Errorf("serializing operation: %w", err)
		}
		operation = &op
		requiresByteString = requiresByteString || encodedByteString
	}
	var secretsManager *apitype.SecretsProvidersV1
	if je.SecretsManager != nil {
		secretsManager = &apitype.SecretsProvidersV1{
			Type:  je.SecretsManager.Type(),

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Check the wrapped error (use %v / errors.Unwrap) — the root cause is usually secret encryption; verify the secrets provider config (`pulumi config set-secret` works) with `pulumi stack change-secrets-provider`
2. Re-run the operation; if the secrets provider is passphrase-based, confirm PULUMI_CONFIG_PASSPHRASE is set correctly in the environment
3. Inspect which resource failed and re-deploy or delete the offending resource if its state is corrupt
4. If caused by a schema/serialization bug, file an issue with the wrapped error text

// ensure the secrets provider works before running operations
out, err := exec.Command("pulumi", "config", "get", "someSecretKey").CombinedOutput()
if err != nil { log.Fatalf("secrets provider misconfigured: %s", out) }

func isSerializeJournalEntryErr(err error) bool {
    return strings.Contains(err.Error(), "serializing resource state:")
}

entry, err := SerializeJournalEntry(ctx, je)
if err != nil {
    return fmt.Errorf("journal write aborted; check secrets provider config: %w", err)
}

When it happens

Trigger: Calling SerializeJournalEntry with je.State != nil when stack.SerializeResource fails: encrypting a secret with a misconfigured secrets manager, encountering a value the serializer cannot encode, or a context cancellation during serialization.

Common situations: Secrets provider misconfigured (bad key/passphrase) so secret encryption fails during checkpoint writing; state containing values incompatible with the target schema version; corrupted in-memory resource state after a failed plugin call.

Related errors

• serializing new snapshot: %w
• serializing operation: %w
• failed to serialize journal entry: %w
• failed to serialize snapshot: %w
• failed to serialize repaired snapshot: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/e4a6db3ac99e4d62. Report an issue: GitHub.