pulumi/pulumi · error

validating stack config: %w

Error message

validating stack config: %w

What it means

Wraps an error from stack config validation in the watch command. The decrypted/loaded config failed validation (e.g. required keys missing, invalid values, secret decryption issues).

Source

Thrown at pkg/cmd/pulumi/operations/watch.go:149

			if err != nil {
				return fmt.Errorf("gathering environment metadata: %w", err)
			}
			cmdutil.SetStringSpanAttributes(ctx, m.Environment)

			decrypter := sm.Decrypter()
			encrypter := sm.Encrypter()

			stackName := s.Ref().Name().String()
			configErr := pkgWorkspace.ValidateStackConfigAndApplyProjectConfig(
				ctx,
				stackName,
				proj,
				cfg.Environment,
				cfg.Config,
				encrypter,
				decrypter)
			if configErr != nil {
				return fmt.Errorf("validating stack config: %w", configErr)
			}

			opts.Engine = engine.UpdateOptions{
				ParallelDiff:              env.ParallelDiff.Value(),
				LocalPolicyPacks:          engine.MakeLocalPolicyPacks(policyPackPaths, policyPackConfigPaths),
				Parallel:                  parallel,
				Debug:                     debug,
				Refresh:                   refresh,
				UseLegacyDiff:             env.EnableLegacyDiff.Value(),
				UseLegacyRefreshDiff:      env.EnableLegacyRefreshDiff.Value(),
				DisableProviderPreview:    env.DisableProviderPreview.Value(),
				DisableResourceReferences: env.DisableResourceReferences.Value(),
				DisableOutputValues:       env.DisableOutputValues.Value(),
				Experimental:              env.Experimental.Value(),
				SkipPluginPreInstall:      skipPluginPreInstall,
			}

			err = backend.WatchStack(ctx, s, backend.UpdateOperation{

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Run `pulumi config` to inspect the stack config values
2. Fix or remove invalid config keys with `pulumi config set` / `pulumi config rm`
3. Check the wrapped cause (%w) for which key/value failed validation

pulumi config --show-secrets > /dev/null || { echo "stack config invalid or secrets undecryptable"; exit 1; }

if err != nil && strings.Contains(err.Error(), "validating stack config") {
	return fmt.Errorf("fix `pulumi config` values before watching: %w", err)
}

When it happens

Trigger: Running `pulumi watch` with a stack config containing invalid or missing required values, wrong namespace keys, or undecryptable secrets (bad secrets provider/passphrase).

Common situations: Malformed config entries after manual edits; switching secrets providers without re-encrypting; typos in config keys.

Related errors

• invalid configuration key: %w
• invalid type %q; must be one of string, int, bool, or float
• could not set config: %w
• the --json option cannot be used with the --plaintext, --sec
• validating stack config: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/88731dbd3f6003bf. Report an issue: GitHub.