pulumi/pulumi · error

the provider command does not accept versions

Error message

the provider command does not accept versions

What it means

The `pulumi env provider aws-login static` command writes an `fn::open::aws-login` block into a Pulumi ESC environment. It only operates on the latest version of an environment, so after parsing the environment reference it rejects any reference that carries an explicit version modifier (e.g. `myenv@1`). The check happens in env_provider_aws_login.go:78 right after getExistingEnvRef strips the ref from the positional args.

Source

Thrown at pkg/cmd/esc/cli/env_provider_aws_login.go:78

			"Writes an `fn::open::aws-login` block with static credentials at the configured\n" +
			"path under `values`. The secret access key and session token, if any, are\n" +
			"wrapped in `fn::secret`. If a block already exists at the path it is replaced.\n" +
			"\n" +
			"See https://www.pulumi.com/docs/esc/integrations/dynamic-login-credentials/aws-login/\n" +
			"for the full provider reference.\n",
		RunE: func(cmd *cobra.Command, args []string) error {
			ctx := cmd.Context()

			if err := env.esc.getCachedClient(ctx); err != nil {
				return err
			}

			ref, args, err := env.getExistingEnvRef(ctx, args)
			if err != nil {
				return err
			}
			if ref.version != "" {
				return errors.New("the provider command does not accept versions")
			}
			if len(args) != 2 {
				return errors.New("expected <access-key-id> and <secret-access-key>")
			}
			accessKeyID, secretAccessKey := args[0], args[1]

			path, err := resource.ParsePropertyPath(pathStr)
			if err != nil {
				return fmt.Errorf("invalid --path: %w", err)
			}

			node := buildAWSLoginStaticNode(accessKeyID, secretAccessKey, sessionToken)

			var envVars []envVar
			if exportEnvVars {
				envVars = awsLoginEnvVars(propertyPathRef(path))
			}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Remove the version modifier from the environment reference: `pulumi env provider aws-login static my-org/proj/myenv <access-key-id> <secret-access-key>`.
2. If you need versioned credentials, first open the versioned environment with `pulumi env open myenv@1` and consume its outputs instead of editing it.
3. Use `pulumi env tag repository`-style workflows: create a new named environment if you truly need a frozen copy, and run the provider command against that.

Example fix

// before
pulumi env provider aws-login static my-org/proj/myenv@1 AKIA... secret
// after
pulumi env provider aws-login static my-org/proj/myenv AKIA... secret

// shell: validate the ref has no version modifier before invoking
if [[ "$ENV_REF" == *"@"* ]]; then
  echo "refusing: provider commands do not accept versioned env refs: $ENV_REF" >&2
  exit 1
fi
pulumi env provider aws-login static "$ENV_REF" "$AWS_KEY" "$AWS_SECRET"

When it happens

Trigger: Running `pulumi env provider aws-login static my-org/proj/myenv@1 <access-key-id> <secret-access-key>` — i.e. including a version tag/modifier (like @1, @latest, @sha256:...) in the environment name argument of any aws-login provider subcommand.

Common situations: Developers copy an environment reference with a version pin from another ESC command (`env open myenv@1`) or from CI scripts that evaluate versioned environments, then reuse it verbatim in the provider command. Provider commands edit the environment definition, which only makes sense on the mutable latest version.

Related errors

• expected <access-key-id> and <secret-access-key>
• invalid --path: %w
• expected <role-arn> and <session-name>
• output format '%s' may not be used with a property path
• the init command does not accept versions

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/d4fe723bb1ba93c6. Report an issue: GitHub.