pulumi/pulumi · error

validating stack config: %w

Error message

validating stack config: %w

What it means

During `pulumi preview`, after decrypting the stack's configuration, the engine runs stack config validation (via pkgWorkspace.ValidateStackConfig). If the decrypted config violates the project schema (wrong types, missing required keys, invalid values), the failure is wrapped with this message and the preview aborts before any diff is computed.

Source

Thrown at pkg/cmd/pulumi/operations/preview.go:538

			stackName := s.Ref().Name().String()
			if skipConfigValidation {
				// Still apply project config defaults onto the stack config, but skip validation.
				if configErr := pkgWorkspace.ApplyProjectConfig(
					ctx, stackName, proj, cfg.Environment, cfg.Config, encrypter, decrypter); configErr != nil {
					return fmt.Errorf("applying stack config: %w", configErr)
				}
			} else {
				configErr := pkgWorkspace.ValidateStackConfigAndApplyProjectConfig(
					ctx,
					stackName,
					proj,
					cfg.Environment,
					cfg.Config,
					encrypter,
					decrypter)
				if configErr != nil {
					return fmt.Errorf("validating stack config: %w", configErr)
				}
			}

			targetURNs := slice.Prealloc[string](len(targets))
			targetURNs = append(targetURNs, targets...)

			excludeURNs := slice.Prealloc[string](len(excludes))
			excludeURNs = append(excludeURNs, excludes...)

			replaceURNs := slice.Prealloc[string](len(replaces))
			replaceURNs = append(replaceURNs, replaces...)

			for _, tr := range targetReplaces {
				targetURNs = append(targetURNs, tr)
				replaceURNs = append(replaceURNs, tr)
			}

			refreshOption, err := getRefreshOption(proj, refresh)

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Read the wrapped inner error to identify the offending config key and fix its value or type in Pulumi.<stack>.yaml
2. Run `pulumi config set <key> <value>` (with --secret or --plaintext as appropriate) instead of hand-editing the file
3. Compare the config keys against the `config:` section of Pulumi.yaml and remove/rename stale keys
4. If a dependent stack value is the problem, ensure the referenced stack's output exists and the value is in `pulumi config --show-secrets` form

Example fix

// before (Pulumi.dev.yaml)
config:
  aws:region: us-east-1
  myapp:replicas: three
// after
config:
  aws:region: us-east-1
  myapp:replicas: 3

# shell check before running preview
pulumi config --show-secrets | grep -E '<suspect-key>' # confirm key exists and value looks right
# or run the cheap validation path first:
pulumi preview --json # surfaces config validation errors before relying on the run

// Go: invoking the engine API programmatically
if err := runPreview(...); err != nil {
    var wrapped *fmt.WrapError // inspect chain for "validating stack config"
    if strings.Contains(err.Error(), "validating stack config:") {
        // surface the inner configErr cause to the user
    }
    return err
}

When it happens

Trigger: Running `pulumi preview` when cfg.Config contains entries that fail validation for the project, e.g. a config value typed as int in Pulumi.yaml passed as a non-integer string, a secret value that cannot be structured, or config violating the schema returned by the project's config schema.

Common situations: Hand-editing Pulumi.<stack>.yaml and inserting a string where an integer/list is declared; renaming a config key so a required key is missing; pasting config from another project with a different schema.

Related errors

• invalid configuration key: %w
• invalid type %q; must be one of string, int, bool, or float
• could not set config: %w
• the --json option cannot be used with the --plaintext, --sec
• validating stack config: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/a2ec4dfb708281c0. Report an issue: GitHub.