Pulumi Blog: Germán Lena

Announcing Pulumi Identity and Access Management (IAM)

Germán Lena — Mon, 09 Jun 2025 00:00:00 +0000

Cloud development is accelerating at an unprecedented pace, fueled by AI and the relentless drive for innovation. But this incredible speed demands unwavering trust in your security posture. How do you empower teams to deploy rapidly and frequently without opening doors to risk or violating compliance mandates? Today, we’re thrilled to answer that critical challenge by introducing Pulumi Identity and Access Management (IAM) – a foundational new capability designed to embed robust, granular security directly into your cloud development lifecycle, enabling you to innovate both quickly and safely with Pulumi. Pulumi IAM provides the unified framework for fine-grained authorization needed to confidently manage modern cloud infrastructure and applications across the entire Pulumi Cloud platform.

Our Vision for Pulumi IAM

Pulumi IAM is a foundational investment, delivering enterprise-grade access management through a phased approach. Today’s release marks the beginning, with much more planned:

Phase 1: Granular Access Tokens & Custom Roles (Available Today)
- Define custom, reusable Permissions with fine-grained scopes (e.g., stack:delete only).
- Create Custom Roles by combining Permissions with specific Pulumi Entities (Stacks, Environments, etc.).
- Generate Organization Access Tokens scoped precisely to these Custom Roles, perfect for secure automation.
Phase 2: User & Team Role Assignment (Coming Soon)
- Leverage OIDC configuration to dynamically assume Custom Roles for secure, tokenless authentication from CI/CD systems like GitHub Actions, GitLab, and more.
- Assign these powerful Custom Roles directly to individual users and teams within your Pulumi organization.
- Implement a complete overhaul of user and team access management, moving beyond the basic Admin/Member distinctions, and enabling reusability of custom building blocks permissions and roles that work for your organization
Phase 3: Advanced Authorization & Scalability (Future Release)
- Introduce Attribute-Based Access Control (ABAC), allowing policies based on tags or other attributes of Pulumi Entities (e.g., “grant ‘dev-role’ access to all stacks tagged ’env:dev’”).
- Enable the creation of Custom RBAC Policies with conditional logic for highly specific access scenarios and reuse them
- Provide mechanisms to manage permissions across hundreds or thousands of Pulumi Entities efficiently.

A Foundation for Zero Trust & Unified Security

Pulumi IAM isn’t just another feature; it’s a foundational pillar underpinning security across the entire Pulumi Cloud ecosystem, enabling organizations to implement Zero Trust principles for their infrastructure management. Modern security models assume breaches will happen and demand rigorous verification for every access request. Static, organization-wide roles no longer suffice where separation of duties, least privilege, and compliance are paramount.

Pulumi IAM addresses these challenges by providing:

Least Privilege Enforcement: Define precisely who can do what on which specific resources, minimizing the potential impact if credentials or accounts are compromised. This is core to Zero Trust – grant only the minimum necessary access, verified at the point of action.
Granular Control Across Pulumi:
- Infrastructure as Code (IaC): Apply fine-grained controls over Pulumi Stacks
- Secrets Management: Define specific access levels for Pulumi ESC Environments.
- Insights: Manage permissions for Pulumi Insights account settings.
Secure Automation: Provide secure, least-privilege tokens and OIDC integration for CI/CD pipelines and automation, drastically reducing the risk associated with over-privileged service accounts.
Unified, Scalable Governance: Establish a consistent authorization model that simplifies administration and scales from small teams to complex enterprise environments, ensuring security doesn’t hinder velocity.

Launching Today: Granular Access Tokens via Custom Roles

This vision begins today with the initial phase of Pulumi IAM, enabling you to define Custom Roles built from fine-grained Permissions and apply them specifically to Organization Access Tokens. This initial step provides immediate, significant security benefits, particularly for automation:

True Least Privilege for CI/CD: Scope pipeline tokens to only the actions (e.g., pulumi up) and Entities (e.g., stack: myapp-prod) they absolutely need.
Reduced Blast Radius: If a scoped token is compromised, the potential damage is limited strictly to the permissions defined in its associated role.
Enhanced Compliance: Demonstrate precise control over programmatic access to auditors.

How to Get Started with Granular Access Tokens

Configuring and using Custom Roles for scoped tokens is done via the Pulumi Cloud console:

1. Define a Custom Permission (Optional)

Create reusable sets of fine-grained scopes.

As an admin, navigate to Organization Settings -> Roles -> Permissions
Follow instructions for creating a custom permission.

2. Create a Custom Role

Combine permissions with specific resources.

As an admin, navigate to Organization Settings -> Roles
Follow instructions for creating a custom role.

3. Generate a Scoped Organization Access Token

Generate an organization access token with narrowed scope.

As an admin, navigate to Organization Settings -> Access Tokens -> Organization Access Tokens.*
Click “Create token”. Provide a description. Select your Custom Role from the “Role” dropdown. Generate the token.

New Scenarios Unlocked Today

This release immediately enables more secure and compliant workflows:

Secure Multi-Environment CI/CD: A single pipeline can use different tokens based on the target environment (dev, staging, prod), each assuming a role with appropriately restricted permissions (e.g., read-only for prod dependencies, write for the target stack).
Restricted Operational Scripts: An automation script designed only to read audit logs can use a token tied to a role granting only audit_log:read permission, preventing accidental or malicious modifications.
Safer ChatOps & Tooling: Integrations like ChatOps bots can operate with tokens scoped down to only necessary actions (e.g., triggering a pulumi preview on specific stacks).

Available Today: Custom Permissions, Custom Roles, and the ability to scope Organization Access Tokens using these roles, is available now for customers on the Pulumi Enterprise and Pulumi Business Critical tiers. Explore these features in your Pulumi Cloud organization settings!

Conclusion: Building a More Secure Future

Pulumi Identity and Access Management (IAM) represents a fundamental advancement in securing cloud development lifecycles managed by Pulumi, providing the controls needed to confidently embrace speed and scale. Today’s launch of Granular Access Tokens via Custom Roles provides immediate security improvements for automation and programmatic access, laying the vital groundwork for our comprehensive IAM vision rooted in Zero Trust principles.

This empowers platform and security teams with the fine-grained control needed to implement least privilege, enhance compliance, and scale Pulumi usage securely without sacrificing velocity.

We encourage our Enterprise and Business Critical customers to explore Custom Roles and Granular Access Tokens today. Dive into the documentation and start building roles tailored to your security requirements. We welcome your feedback and feature requests in our GitHub repository. Join us as we build a more secure foundation for cloud engineering!

Learn More

Learn more about Pulumi Cloud’s new IAM & RBAC features:

Unveiling the New Stacks Page

Germán Lena — Thu, 24 Oct 2024 00:00:00 -0700

We’re thrilled to unveil the redesigned Pulumi Infrastructure as Code (IaC) Stacks page within Pulumi Cloud console, addressing one of the most upvoted issues in our Pulumi Cloud Requests repository! This revamped experience delivers a significant boost in performance and usability, empowering even the most complex organizations to manage their infrastructure with ease.

Why a New Stacks Page?

As our customers scaled, the previous Stacks page faced some limitations that impacted its effectiveness. Here were some of the primary challenges:

Performance Issues: The page became sluggish with large numbers of stacks, making it difficult to scroll smoothly when you had thousands of stacks.
Limited Grouping and Sorting Options: Users had limited customization options for organizing their stacks, with minimal control over grouping and sorting.
Tag-Based Grouping Limitations: Grouping by tags wasn’t as reliable as we wanted—it sometimes failed to load completely.

What’s New?

The new Stacks page provides more information at a glance, offering a streamlined and powerful experience:

Effortless Scalability: Manage thousands of stacks with ease. The new page is optimized for performance, ensuring smooth scrolling and interaction regardless of scale.
Flexible Grouping: Group your stacks by repository, project, and tags simultaneously—up to three levels of grouping. Or opt for no grouping at all! The choice is yours. Expand and collapse groups as needed for a more organized and focused browsing experience.
Enhanced Sorting: Sort your stacks by last update or group name (ascending/descending) to quickly find what you need.
Shareable Views: The page now includes query parameters in the URL, allowing you to save and share your exact view with team members effortlessly.
Personalized Experience: The page remembers your last selected groups and sorting preferences, so you can pick up right where you left off.
Dynamic Loading: Enjoy instantaneous loading as you scroll, eliminating wait times and boosting efficiency.
Time-Saving Shortcuts: Use quick option to make group and sort selections or to reset them.

Classic View: Still Available

For users who prefer the familiar grouping by repository and project, and sorting by last updated, we’ve got you covered! Simply click the “Classic View” shortcut in the top right-corner to switch to the classic grouping and sorting option instantaneously.

Your Feedback Matters

We’re excited for you to experience the power and flexibility of the new Pulumi Stacks page! Share your feedback and suggestions through our Pulumi Cloud requests GitHub repository—we’re always listening and striving to improve.

Simplify OIDC Trust with the New Pulumi GitHub Action

Germán Lena — Mon, 20 May 2024 21:45:13 +0000

We’re excited to announce a new GitHub Action that simplifies the integration of Pulumi’s powerful OpenID Connect (OIDC) Trust feature into your GitHub Actions workflows. This action streamlines secure authentication with Pulumi Cloud, allowing you to leverage GitHub as an identity provider and eliminate the need for long-lived Pulumi access tokens.

A Quick Refresher on Pulumi’s OIDC Trust

The OIDC Trust feature allows you to configure trusted OIDC identity providers, such as GitHub, GitLab, or Google Cloud, within your Pulumi organization. This feature ensures secure and straightforward integration of Pulumi Cloud within any OIDC-compliant system. Once set up, you can securely exchange short-lived OIDC tokens from these providers for temporary Pulumi access tokens. These tokens can then be used to authenticate to Pulumi and perform actions such as deploying your infrastructure using Pulumi IaC, retrieving secrets stored in Pulumi ESC, etc. This approach enhances security by eliminating the need to store long-lived sensitive credentials and aligns with best cloud practices.

Streamlining OIDC Trust with GitHub Actions

Our new GitHub Action makes using OIDC Trust even easier. It automates the secure retrieval of Pulumi access tokens directly within your GitHub workflows, streamlining the authentication process and eliminating manual steps. This automation reduces errors, enhances security by reducing potential token leakage, and improves the maintainability of your workflows, making them cleaner, more readable, and easier to update.

Example Usage

This example demonstrates how to use the Action to authenticate with OIDC and run the pulumi preview command.

name: Pulumi preview
on:
 workflow_dispatch:

permissions:
 id-token: write
 contents: read

jobs:
 run_cron_job:
 runs-on: ubuntu-latest

 steps:
 - uses: actions/checkout@v4

 - uses: pulumi/auth-actions@v1
 with:
 organization: org-name
 requested-token-type: urn:pulumi:token-type:access_token:organization

 - uses: pulumi/actions@v5
 with:
 command: preview
 stack-name: org-name/stack-name

For more information about the pulumi/auth-actions@v1 Action, check the Pulumi Auth Action documentation.

Conclusion

The new GitHub Action for Pulumi OIDC Trust makes it easier than ever to incorporate secure, short-lived credential management into your GitHub Actions workflows. Embrace the power of OIDC, eliminate the “secret zero” problem, and streamline your Pulumi deployments with ease.

Give the action a try in your next GitHub Actions workflow and let us know what you think! Check out our documentation for more details.

OpenID Connect Trust Relationships for Pulumi Cloud

Germán Lena — Fri, 19 Apr 2024 21:45:13 +0000

We are excited to introduce a powerful addition to Pulumi’s authentication capabilities: OpenID Connect (OIDC) Trust Relationships. This feature makes it easy to integrate Pulumi securely into any ecosystem that supports OIDC. By incorporating OIDC, Pulumi is not only extending its compatibility with a broader range of environments but also reinforcing its commitment to delivering top-tier, secure, and scalable solutions to developers and enterprises alike. Whether you are working within CI/CD pipelines or engaging directly with cloud services, this new feature ensures that your infrastructure management is more secure, efficient, and aligned with industry best practices.

Addressing the “Secret Zero” Challenge

A lot of platforms deal with the “secret zero” challenge, which have a weak link where they require a static, long-lived access token. Managing long-lived access tokens has always been a challenge for developers. Often those secrets are set and forgotten, leaving the team to scramble when it comes time to rotate them. This struggle often leads to those secrets not being rotated very often. This long-term access token becomes a weak point in the overall security posture as well as a hassle for developers. With OIDC Trust Relationships, we’re tackling the “secret zero” challenge head-on by introducing exchanging a secure platform token for a short-term Pulumi token. This enhances security and simplifies token management.

Simplified Authentication

OIDC Trust simplifies the authentication process by allowing you to securely request dynamic credentials for Pulumi using your preferred OIDC provider. OIDC is supported across many popular CI/CD systems, such as GitHub, GitLab, Circle CI, and more. In addition, OIDC can be used from within most cloud providers, such as AWS, Azure, GCP, and more.

Enhanced Security with Policy Controls

When you set up an OIDC Trust in Pulumi Cloud, you can set policies to deny or approve token exchanges based on issuer subject or additional claims. We support wildcard matching to create simple policies that support complex authorization scenarios. Based on your specific policy requirements, these policies can be used to issue a token scoped to an organization, team, or personal access.

Seamless Integration with Pulumi ESC

OIDC Trust seamlessly integrate with Pulumi ESC, providing a comprehensive solution for managing infrastructure and access to secrets and configuration. You can now use your native GitHub app token to exchange it for a short-lived Pulumi Token, and ESC will seamlessly exchange it for a cloud token through an ESC environment.

Demo

In this demo, we are going to use Github Actions to retrieve Pulumi credentials and use them to list all the Pulumi ESC Environments in our organization.

Go to the OIDC Issuers Page.
Register Issuer and give a name and (optional) max expiration. Enter the GitHub actions URL https://token.actions.githubusercontent.com.
Add a policy to allow OIDC and configure the sub and audience for your organization and repositories. In the demo, we are using:

Aud: urn:pulumi:org:organization
Sub: repo:organization/repo:*

Create a GitHub action. Here is a sample code. Make sure to substitute your organization in the pulumi/auth-actions organization parameter.

name: Pulumi ESC List Environments
on:
 workflow_dispatch:

permissions:
 id-token: write
 contents: read

jobs:
 run_cron_job:
 runs-on: ubuntu-20.04
 timeout-minutes: 30

 steps:
 - name: Checkout repo
 uses: actions/checkout@v3

 - name: Install pulumi
 uses: pulumi/actions@v4

 - name: Install deps
 run: yarn

 - uses: pulumi/auth-actions@v1
 with:
 organization: organization
 requested-token-type: urn:pulumi:token-type:access_token:organization

 - name: Login to Pulumi
 run: pulumi login
 env:
 PULUMI_ACCESS_TOKEN: ${{ env.PULUMI_ACCESS_TOKEN }}

 - name: List all Pulumi ESC Environments
 run: pulumi env ls

Go to GitHub Actions page, and run the workflow you just created.

Next steps

Introducing Customer-Managed Agents for Pulumi Deployments

Arun Loganathan — Mon, 08 Jan 2024 08:06:12 -0700

At Pulumi, we constantly strive to build solutions that not only simplify infrastructure management but also align with the diverse and specific needs of our customers. To that end, we’re thrilled to announce the general availability of Customer-Managed Agents for Pulumi Deployments.

Primer on Pulumi Deployments

Pulumi Deployments is a fully managed platform for managing infrastructure at scale, providing easy-to-use building blocks that can be used as a simple CI/CD platform or to build a sophisticated self-serve platform to support thousands of engineers. Traditional CI/CD platforms focus on Git-push workflows which fall short when managing infrastructure where the same code base is used to create new infrastructure with no explicit Git-push event. Pulumi Deployments goes beyond the Git-push based workflows to offer deployment triggers based on the Pulumi Deployments REST API, click to deploy in the Pulumi Cloud console, Review Stacks, remote Automation API, and many more features to come.

Since its launch, Pulumi Deployments has transformed how organizations manage their infrastructure, offloading the execution of Pulumi infrastructure as code (IaC) actions — such as previews, updates, destroys, and refreshes — to Pulumi Cloud. Our customers have used it to deploy and manage mission-critical services, driving efficiencies and reducing the operational burden of deploying and managing infrastructure.

Deploy on Your Terms: Launching Customer-Managed Agents

With the launch of Customer-Managed Agents, you can now self-host the deployment agents within your infrastructure, bringing the same power and flexibility of Pulumi-hosted deployments to isolated environments. Customers with hard security and compliance requirements can now fully leverage Pulumi Deployments.

Newton, a leading crypto trading platform and a Pulumi Cloud customer, was in the private beta of Customer-Managed Agents. “Pulumi’s rapid innovation and customer-centric approach never fail to impress. The introduction of Customer-Managed Agents is a testament to their ongoing commitment,” said Shaun Martin, Director of Engineering at Newton. “We’re thrilled with the turnkey solutions Pulumi Deployments offer, enhancing our infrastructure management while upholding our stringent security requirements.”

Key Benefits of Customer-Managed Deployment Agents

Host anywhere: You can host the deployment agents anywhere to manage infrastructure, even within your fully private VPCs
Any hardware, any environment¹: Run the agents on any hardware of your choice and configure the environment that meets your needs
Mix & match: You can use standard Pulumi-hosted deployments for your development stacks and use self-hosted Customer-Managed Agents for your private network infrastructure. You can mix and match to suit your unique needs
Multiple pools: You can set up multiple deployment agent pools, assign stacks to specific pools, and scale agents dynamically to increase your deployment concurrency. Customers can have up to 150 concurrent deployments
Meet compliance: You can configure the agents with the credentials needed to manage your infrastructure. This way your cloud provider credentials never leave your private network

¹ Currently Linux and MacOS are supported

Customer-Managed Agents support all the deployment triggers currently offered by Pulumi Deployments such as click to deploy, the Pulumi Deployments REST API, Git push to deploy, Review Stacks, and remote Automation API.

Customer-Managed Agents is available on the Business Critical edition of Pulumi Cloud. Contact sales if you are interested and want to enable Customer-Managed Agents. If you are a self-hosted Pulumi Cloud customer, please get in touch to be notified when it is available.

How to get started

Before you begin, ensure you have installed the Pulumi Github App and update the source control settings. Docker is a requirement for the agent.

Install and configure the agent

Go to Deployment runners under Organization Settings in the left-hand navigation menu. Once on the Deployment runners page, choose Add a new pool. Next, provide a name and description for your agent. You will then get a new access token for the pool. Be sure to copy and save this token in a secure location.

Download and install the agents using the command provided. Once installed, provide the access token previously copied to configure the agent.

If you run into issues, ensure docker is running before you configure and start the agents. Ensure you restart or refresh the shell session (example: source ~/.zshrc).

Now your first agent should be up and running! You can verify the status of the agent by refreshing the page. Additionally, you can use the same token to set up multiple agents to increase concurrency of your deployments and they will be assigned to the same pool.

Agents poll Pulumi Cloud every 30 seconds to check for pending deployments. In the pool page, you can see the last online status of the agents. Agents will disappear from the list after 1-2 hours of being offline. If you are running the agent inside a firewall ensure to allow outbound requests to api.pulumi.com.

Configure Stack

Go to deployment settings, found under the settings tab on a stack under ‘Deploy’. Scroll down and select the pool you created under the Deployment Runner pool drop-down.

Ensure that agents have the cloud provider credentials to be able to deploy in your environments. You have two methods:

Use OpenID Connect (OIDC) to generate credentials
Directly provide credentials to agents through environment variables configured in the host, or passing the environment variables when invoking the binary. Example:
```
VARIABLE=value customer-managed-deployment-agent run
```
You also need to update the pulumi-deployment-agent.yaml configuration file by setting env_forward_allowlist. The configuration file can be found in the directory where the agent is extracted. env_forward_allowlist expects an array of strings. Example:
```
token: pul-d2d2….
version: v0.0.5
env_forward_allowlist:
 - key_one
 - key_two
 - key_three
```

Verify setup

You have completed the setup. Try out the agent by doing pulumi refresh through the Actions drop-down in your stack page.

You should see the logs in the agent running on the machine you configured and also in the Pulumi Cloud console.

On the deployments page, you can see all the deployments including pending deployments, and which deployment agents were used in a deployment.

Your Journey, Our Support

Customer-Managed Agents empower you to align your deployment strategies with the specific requirements of your infrastructure. Whether it’s ensuring compliance, enhancing security, or customizing deployment processes, Customer-Managed Agents provide the flexibility you need.

Embark on this journey to simplify your infrastructure deployments with our new feature. We are here every step of the way to assist you. Share any feedback in the Pulumi Cloud Requests repository with us.