# pulumi-cli Published articles for pulumi-cli. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Set Up Cloud OIDC From the Pulumi CLI DevFeed: [Set Up Cloud OIDC From the Pulumi CLI]() Original publisher: [Read original article]() Author: Sean Yeh Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [OpenID connect (OIDC)](), [Command-line interface](), [AWS IAM](), [Cloud](), [AWS Identity and Access Management (IAM)](), [Azure](), [Google Cloud Platform (GCP)]() Tags: [automated](), [aws](), [azure](), [cli](), [cloud](), [configuration](), [docs](), [esc](), [google-cloud](), [how-to](), [iam](), [identity](), [oidc](), [openid-connect](), [product](), [pulumi](), [pulumi-cli](), [security](), [terminal](), [workflow]() ### AI overview This tutorial explains how to use the Pulumi CLI command pulumi env setup to configure Pulumi ESC as an OIDC provider for AWS, Azure, and Google Cloud. It covers interactive onboarding, non-interactive flags for scripts and agents, cloud credentials, account selection, access policies, and automatic creation of identity providers, IAM roles, policy attachments, and ESC environments. ### Source excerpt Pulumi ESC can act as an OpenID Connect (OIDC) provider for AWS, Azure, and Google Cloud, issuing short-lived, signed tokens that these clouds exchange for temporary credentials. This eliminates hard-coded credentials and improves your security posture. Last year, we introduced an onboarding flow in the Pulumi Cloud console that makes it super easy to configure OIDC for your cloud provider in a few guided steps. We're bringing Pulumi Cloud into the CLI so agents can use its capabilities directly from the terminal, without requiring a human to complete steps in the console. The new pulumi env setup command brings OIDC onboarding to that workflow, with interactive prompts for guided setup and non-interactive flags for scripts and agents. pulumi env setup - how it works Run the command with your desired cloud provider (aws, azure, gcp). For example: pulumi env setup aws The command then asks what it needs to configure your cloud, including your credentials, the accounts to configure, and the level of access. The questions differ per cloud. For AWS, it asks: How to authenticate to AWS. It uses the credentials you already have, or it signs you in with AWS SSO. Which accounts to configure. Which policy to attach to the OIDC role. Choose AdministratorAccess for Pulumi Deployments, ReadOnlyAccess for Pulumi Insights, or any other policy ARN. Then, it will print out the plan: About to configure OIDC for organization my-org: account 111111111111: create role pulumi-esc-oidc-622e86ea-319ba4c675bb3c00-role attach arn:aws:iam::aws:policy/AdministratorAccess create ESC environment my-org/aws-login/sandbox-account-env Proceed? [yes/no] After you confirm, the command creates the identity provider, the IAM role, and the policy attachment in each account. It then creates one ESC Environment per account, with the aws-login provider already configured. Non-interactive setup You can also run the command without interactive prompts by passing in the necessary flags. Each cloud has its ow ## Preview ESC Changes with Environment Overrides DevFeed: [Preview ESC Changes with Environment Overrides]() Original publisher: [Read original article]() Author: Sean Yeh Published: 2026-07-23T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Command-line interface](), [configuration](), [Testing]() Tags: [cli](), [configuration](), [configuration-management](), [critical-infrastructure](), [esc](), [features](), [product](), [production](), [pulumi-cli](), [pulumi-esc](), [release](), [secrets](), [upgrade]() ### AI overview Pulumi introduces the --override-env flag for the Pulumi CLI, allowing teams to preview draft or alternate ESC environments during operations such as preview, up, refresh, and destroy. The feature helps reviewers validate configuration changes before approval and supports overrides through imported environment chains. ### Source excerpt Pulumi ESC makes it easy to store configuration and secrets for your Pulumi programs, and with Approvals for ESC you can review and approve changes before they go live. The new --override-env flag lets you preview any environment change, including an unapproved draft, to see exactly how it would affect your stack before it becomes the latest version. Example scenario Your team stores production app configuration in ESC and has enabled Approvals to keep bad values out of critical infrastructure. But one important question remains: how can reviewers properly validate a configuration change before approving it? Introducing: draft references and the -override-env flag We are introducing a new --override-env flag to the Pulumi CLI that works with every Pulumi operation that can consume ESC environments: preview, up, refresh, and destroy. This makes it easy to test configuration changes on the fly, giving your team the confidence to validate them as part of the review process. Example usages The basic usage is --override-env =, and you can override multiple environments at once! In this example, we are running a pulumi preview with environments app/myenv and app/myenv2 replaced by their draft versions (denoted by @draft:). pulumi preview \ --override-env "app/myenv=app/myenv@draft:123e4567-e89b-12d3-a456-426614174000" \ --override-env "app/myenv2=app/myenv2@draft:123e4567-e89b-12d3-a456-426614174000" The --override-env flag not only works with draft references, but for any environment too! Here is an example of deploying your stack with your AWS test environment: pulumi up --override-env "aws-login/prod=aws-login/testing" Note: --override-env can also override environments that are imported (directly or indirectly) from the ESC environment in your stack config. This allows you to override any environment in the import chain for full flexibility. Ways to use it Validate a draft ESC environment with your stack before approving One-off debugging w ## New: Versioned CLI and SDK Docs DevFeed: [New: Versioned CLI and SDK Docs]() Original publisher: [Read original article]() Author: Cam Soper Published: 2026-07-07T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Documentation](), [SDKs](), [Command-line interface]() Tags: [announcements](), [api](), [cli](), [community](), [docs](), [features](), [github](), [issue](), [java](), [net](), [node-js](), [product](), [pulumi](), [pulumi-cli](), [python](), [release](), [sdk](), [snapshots]() ### AI overview Pulumi has added version selectors to its CLI command reference and SDK API documentation. Users can choose documentation matching the Pulumi release they are running, with immutable snapshots available from v3.150.0 onward for the CLI and Node.js, Python, .NET, and Java SDKs. ### Source excerpt Pinned to an older Pulumi CLI or SDK version and finding that the docs describe a newer release? The Pulumi CLI command reference and the SDK API docs now include a version selector, so the documentation you're reading matches the version you're actually running. How it works When you open the CLI command reference, you'll see a version dropdown near the top of the page, below the title. The SDK API docs carry the same dropdown in the upper-right corner. Choose a release, and the page loads the documentation generated for that exact version. What's available Alongside the latest release, we keep immutable snapshots of previous versions going back to v3.150.0 (early 2025). The CLI command reference and the Node.js, Python, .NET, and Java SDK API docs are all covered, so the docs you need are only a dropdown away. (The Go SDK is versioned on pkg.go.dev, so its documentation lives there rather than in the Pulumi docs.) Get started Head to the CLI command reference or the SDK API docs and try the version dropdown. Selections are sticky, so when you navigate into a version, you'll be able to click around within that same version without having to choose it again. Have feedback? Let us know in the Pulumi Community Slack or by opening an issue on GitHub. Browse the CLI command reference ## Introducing ESC Secret Rotation Webhooks DevFeed: [Introducing ESC Secret Rotation Webhooks]() Original publisher: [Read original article]() Author: Sean Yeh Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-esc](), [secret rotation](), [notifications](), [pulumi-cloud](), [pulumi-cli](), [TypeScript](), [GitHub]() Tags: [cli](), [esc](), [github](), [notifications](), [product](), [pulumi](), [pulumi-cli](), [pulumi-cloud](), [rotation](), [secret-rotation](), [secrets](), [slack](), [typescript](), [webhooks]() ### AI overview Pulumi introduces ESC secret rotation webhooks, which trigger on successful or failed environment secret rotations. They can notify teams in Slack, refresh services using old credentials, and help detect failed rotations before outages. ### Source excerpt Pulumi ESC centralizes your secrets and configuration, and it can automatically rotate secrets on a schedule so credentials never go stale. But a rotation is only useful if the systems that depend on it know it happened. ESC secret rotation webhooks close that gap by notifying you the moment a secret rotates. Introducing secret rotation webhooks With ESC webhooks, you can react to rotations automatically. When ESC rotates an environment's secrets, a webhook can be configured to trigger on either success or failure. Use it to notify your team in Slack, refresh services that hold the old credential, or catch a failed rotation before it causes an outage. How to configure Pulumi Cloud Console Using the Pulumi Cloud Console, you can now configure webhooks for "Environment rotation succeeded" and "Environment rotation failed" in your ESC Environment's Settings page (under Settings -> Notifications). Pulumi Service Provider You can use the Pulumi Service Provider in your Pulumi program to configure webhooks. Here is an example in TypeScript: const environmentWebhook = new service.Webhook("env-webhook", { active: true, displayName: "env-webhook", organizationName: "my-org", projectName: environment.project, environmentName: environment.name, payloadUrl: "https://example.com", filters: [WebhookFilters.EnvironmentRotationSucceeded, WebhookFilters.EnvironmentRotationFailed], }) Pulumi CLI You can also use the Pulumi CLI to configure the webhook: pulumi env webhook new my-org/project/env env-webhook \ --url https://example.com \ --event environment_rotation_succeeded \ --event environment_rotation_failed Get started Secret rotation webhooks are available now for all Pulumi ESC environments. See the webhooks documentation to get started, and share your feedback on our GitHub repository. ## Introducing pulumi do: Direct Resource Operations for Any Cloud DevFeed: [Introducing pulumi do: Direct Resource Operations for Any Cloud]() Original publisher: [Read original article]() Author: Christian Nunciato Published: 2026-05-22T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Command-line interface](), [Cloud](), [Provisioning](), [Amazon S3](), [Amazon Web Services]() Tags: [ai-agents](), [aws](), [cli](), [command-line](), [features](), [iac](), [infrastructure](), [infrastructure-as-code](), [product](), [product-launches](), [pulumi](), [pulumi-cli](), [s3]() ### AI overview Pulumi introduces pulumi do, a terminal command for direct cloud resource operations. It can create, read, update, delete, and query resources across Pulumi-supported providers without requiring a project, code, or state. The article also describes how pulumi do, Agent accounts, and Pulumi ESC can support ad-hoc infrastructure work and AI agent workflows. ### Source excerpt Infrastructure as code is the right model for production systems. State tracking, drift detection, and repeatable deployments all matter when you're managing real workloads. But sometimes, you also need a quick, one-off interaction with the cloud: create a bucket or a database, look up a VPC, delete a stray resource. Today we're introducing pulumi do, a new command for direct resource operations. With pulumi do, you can create, read, update, delete, and query any cloud resource from the terminal with a single command, across thousands of Pulumi-supported providers -- no project, code, or state required. The problem: Sometimes IaC is more than you need When you're managing production workloads, IaC is the proven solution. Code lets you declare complex systems, state tracking catches drift before it becomes a problem, dependency graphs sequence changes safely, and policy keeps everything in bounds. That full lifecycle, especially with the backing of a platform like Pulumi Cloud, is exactly what you want to build systems that scale. But when you (or your coding agent) need an ad-hoc Postgres database, the simplest path with IaC still takes several steps: make a directory, create a project, configure your credentials, write the code, preview, deploy. It works, but it's not always necessary for what should be a simple operation. pulumi do collapses all of those steps into one, using the same Pulumi providers, resource model, and ecosystem that powers the core Pulumi platform. Resource creation is also only part of the problem. As Joe laid out in The Agentic Infrastructure Era, the real challenge for AI agents isn't with code or CLI commands, it's with everything else: getting a cloud account, resolving credentials, wiring configuration across multiple services. Agent accounts, also released this week, simplify this by letting an agent provision its own ephemeral Pulumi Cloud account, and Pulumi ESC takes care of consolidating credentials across providers. Together, with p