🚨 Pulumi Error: 'Preview failed: resource does not exist' — Cause, Fix, and Troubleshooting Guide

Overview

error: Preview failed: resource 'i-0abc123' does not exist means Pulumi asked the resource’s provider to read the live cloud object identified by the ID you passed to pulumi import, and the provider’s Read call came back empty. Pulumi imports work by looking up an existing resource by its provider-native ID, recording its current state, and then generating matching code — so if the lookup fails, there is nothing to import.

The error is raised during the preview phase, before any state is written. Almost always it means the ID is wrong for that resource type, the resource lives in a different region/account/project than the provider is configured for, or the object was already deleted.

Previewing import (dev)

     Type                 Name        Plan
 +   pulumi:pulumi:Stack  app-dev     create
 =   └─ aws:ec2/instance:Instance  web  import

error: Preview failed: resource 'i-0abc123' does not exist

Symptoms

• pulumi import <type> <name> <id> fails during preview with resource '<id>' does not exist.
• The same ID works in the cloud console or provider CLI (e.g. aws ec2 describe-instances) but only when you point at a different region or profile.
• Import from a bulk import file (pulumi import -f import.json) fails on one specific entry.
• pulumi up after adding a resource option import: also fails with the same message.

Common Root Causes

1. Wrong region, account, or project on the provider

Pulumi’s Read runs through the provider configured in your stack. If the resource is in us-west-2 but the stack’s aws:region is us-east-1, the provider genuinely cannot see it. This is the single most common cause.

pulumi config get aws:region

2. ID format doesn’t match the resource type

Each resource type expects a specific ID shape. An EC2 instance uses i-0abc123..., an S3 bucket uses its bucket name, an IAM role uses its name, and some resources need a composite ID like vpc-123/subnet-456. Passing an ARN where a name is expected — or vice versa — produces a not-found result.

# aws:ec2/instance:Instance  -> i-0abc1234567890def
# aws:s3/bucket:Bucket        -> my-bucket-name (not the ARN)
# aws:iam/role:Role           -> role-name (not the ARN)

3. The resource was already deleted or never existed

If the object was destroyed out-of-band (console, another tool, TTL), the provider read returns nothing. There is simply nothing to import.

4. Wrong Pulumi resource type token

pulumi import aws:ec2/instance:Instance web i-0abc123 will fail if the token is subtly wrong (for example importing a launch template ID as an instance). The provider looks up the ID as that type and finds nothing.

5. Credentials / permissions scoped to a different scope

If the credentials in use can authenticate but are for another account or lack read permission on that resource, the read can come back empty or denied — surfacing as “does not exist”.

How to Diagnose

Confirm the resource really exists and note its exact region and account with the native provider CLI first:

# Prove the object exists and see which region/account it is in
aws ec2 describe-instances --instance-ids i-0abc123 --region us-west-2

Check what region and credentials Pulumi is actually using for the stack:

pulumi stack select dev
pulumi config
pulumi whoami -v

Run the import with verbose provider logging to see the exact Read request:

pulumi import aws:ec2/instance:Instance web i-0abc123 \
  --logtostderr -v=9 2> import-debug.log

Search the log for the Read RPC and the ID the provider received — this confirms whether the correct ID and region reached the provider.

Fixes

Point the provider at the right region/account. If the resource lives elsewhere, set the stack config to match before importing:

pulumi config set aws:region us-west-2
pulumi import aws:ec2/instance:Instance web i-0abc123

Use the correct ID form for the type. Look up the resource’s import documentation (the # Import section of each resource in the Pulumi Registry) and pass the exact ID format. For S3 that is the bucket name, not the ARN:

pulumi import aws:s3/bucket:Bucket data my-bucket-name

Use an explicit provider for cross-region/account imports. If most of your stack is in one region but the resource is in another, declare a second provider and pass it during import so you don’t have to change the whole stack’s region:

import * as aws from "@pulumi/aws";

const usWest = new aws.Provider("us-west", { region: "us-west-2" });

const web = new aws.ec2.Instance("web", {
    // ...args matching the live instance...
}, { provider: usWest, import: "i-0abc123" });

Then run pulumi up — the import: resource option performs the same read but through the named provider.

Verify the resource still exists. If the native CLI also cannot find it, the object is gone; remove the import entry (or the resource) and, if you meant to create it, drop the import option so Pulumi creates it fresh.

What to Watch Out For

• The error appears at preview time, so no state is written — you can safely retry after fixing the ID or region.
• Bulk imports via -f import.json fail on the first bad entry; fix that entry’s id or type and re-run.
• ARNs and names are not interchangeable — many AWS resources import by name even though they are addressed elsewhere by ARN.
• After a successful import, run pulumi preview immediately; a clean (no-diff) preview confirms your generated code matches the live resource.
• Composite-ID resources (subnets-in-VPC, security-group rules) need the exact separator the provider expects, usually / or ,.

Related Guides

• Pulumi Error: ‘inputs to import do not match’ — Troubleshooting Guide
• Pulumi Error: ‘resource already exists’ — Troubleshooting Guide
• Pulumi Error: ‘could not load plugin’ — Troubleshooting Guide