Pulumi Blog: Pablo Terradillos

The Standalone ESC CLI Retired: Use pulumi env

Pablo Terradillos — Wed, 22 Jul 2026 00:00:00 +0000

Pulumi ESC CLI v0.26.0 is the latest standalone release. We encourage users to use the Pulumi CLI instead.

The ESC repository has been archived and the code now lives under pulumi.

Why are we making this change

Pulumi ESC is the best way to store and manage configuration and secrets in your Pulumi programs and while you can certainly use ESC to store secrets and configurations for your applications or to manage your AI agents’ credentials, it’s still a core feature of Pulumi Cloud, and we want to make sure we deliver a consistent experience across our entire suite.

In addition to consistency, ESC and the Pulumi CLI share a lot of capabilities to interface to Pulumi Cloud and we want to make it easier and simpler for our customers: it’s now easier to understand which Pulumi organization you are working with, which user is logged in, etc.

Playing nicer with humans and AI agents

A single CLI means one binary to install, one login to manage, and one place to look things up. This simplicity is beneficial whether the operator is a person or an agent.

AI agents love code, and they love CLIs. By unifying the Pulumi CLI and ESC we offer a single place to look up operations around your Pulumi programs. Agents can now reason better about where to store configuration and secrets, without being confused by multiple CLI options that interface against the same service.

Faster improvements

With a shared CLI, any improvement to account management is automatically delivered to both: Pulumi and ESC users. At the same time, both benefit from ESC improvements and new features from day 1.

ESC is a core component of our platform; a separate interface no longer makes sense.

The same code all along

If you’re wondering what actually changes under the hood: nothing about how the commands work. The pulumi env commands were never a reimplementation — the Pulumi CLI has built them from the ESC CLI’s own code since ESC’s first release, which is why the same command surface has always been available under pulumi env. What we’re retiring is a second way to ship and install that code, not the code itself.

Do I need to update?

If you are using the ESC CLI, you should switch as soon as possible, as the standalone binary will not get the latest features. Don’t worry — the mapping is mechanical, and the migration guide covers it command by command:

esc env <command> becomes pulumi env <command>. For example, esc env ls becomes pulumi env ls.
The esc open and esc run shortcuts become pulumi env open and pulumi env run.
esc login, esc logout, and esc version become pulumi login, pulumi logout, and pulumi version.

If you are already using the Pulumi CLI, you have nothing to worry about; this has no effect since ESC commands were already available under the pulumi env sub-command.

Ready to switch? Install the Pulumi CLI if you don’t have it yet, then run pulumi env ls to see your environments. Every command is documented in the pulumi env reference.

Lock Down Values in Pulumi ESC with fn::final

Pablo Terradillos — Tue, 17 Mar 2026 11:00:00 -0700

Pulumi ESC (Environments, Secrets, and Configuration) allows you to compose environments by importing configuration and secrets from other environments, but this also means a child environment can silently override a value set by a parent. When that value is a security policy or a compliance setting, an accidental override can cause real problems. With the new fn::final built-in function, you can mark values as final, preventing child environments from overriding them. If a child environment tries to override a final value, ESC raises a warning and preserves the original value.

How it works

Let’s say you have a parent environment that sets the AWS region for all deployments. You can use fn::final to ensure no child environment can change it:

# project/parent-env
values:
 aws-region:
 fn::final: us-east-1

If a child environment tries to override the final value, ESC raises a cannot override final value warning.

# project/child-env
imports:
 - project/parent-env
values:
 aws-region: eu-west-1 # raises a warning

This evaluates to:

{
 "aws-region": "us-east-1"
}

In this scenario, the ESC environment is still valid, but the final value remains unchanged.

When to use fn::final

Use fn::final for:

Security-sensitive values that shouldn’t be changed
Compliance or policy settings enforced by a platform team
Shared base environments where certain values must remain consistent

Getting started

The fn::final function is available now in all Pulumi ESC environments. For more information, check out the fn::final documentation!

Schema Validation Comes to Pulumi ESC with fn::validate

Pablo Terradillos — Thu, 12 Feb 2026 11:00:00 -0300

Pulumi ESC environments can now validate configuration values against JSON Schema with the new fn::validate built-in function. Invalid configurations are caught immediately when you save, preventing misconfigurations from reaching your deployments.

Configuration errors are often discovered too late during deployment or, worse, in production. With fn::validate, you define validation rules directly in your environment, and ESC enforces them at save time. If a value doesn’t match its schema, the environment cannot be saved until the issue is resolved.

How it works

The fn::validate function takes a JSON Schema and a value. If the value conforms to the schema, it passes through unchanged. If not, ESC raises a validation error.

values:
 port:
 fn::validate:
 schema: { type: number, minimum: 1, maximum: 65535 }
 value: 8080

This validates that port is a number between 1 and 65535. The evaluated result is simply 8080.

Validating objects with required fields

For complex configurations, you can enforce structure and required fields:

values:
 database:
 fn::validate:
 schema:
 type: object
 properties:
 host: { type: string }
 port: { type: number }
 name: { type: string }
 required: [host, port, name]
 value:
 host: "db.example.com"
 port: 5432
 name: "myapp"

If any required field is missing or has the wrong type, the environment cannot be saved.

Reusing schemas across environments

Define schemas once and reference them across multiple environments. Using the environments built-in property keeps the schema out of your environment’s output:

Schema environment (my-project/schemas)

values:
 database-schema:
 type: object
 properties:
 host: { type: string }
 port: { type: number }
 required: [host, port]

Environment using the schema

values:
 database:
 fn::validate:
 schema: ${environments.my-project.schemas.database-schema}
 value:
 host: "prod-db.example.com"
 port: 5432

This pattern ensures consistent validation rules across teams and projects.

What happens when validation fails

When a value doesn’t conform to its schema, ESC returns a clear error message:

values:
 port:
 fn::validate:
 schema: { type: string }
 value: 8080

This raises: expected string, got number. The environment cannot be saved until you fix the value or update the schema.

When to use schema validation

Enable fn::validate for:

Values with specific type requirements (numbers, strings, arrays)
Objects that must have certain fields present
Numbers that must fall within a valid range
Configurations shared across multiple environments
Any value where catching errors early prevents downstream issues

Getting started

The fn::validate function is available now in all Pulumi ESC environments. Add schema validation to your existing environments or use it when creating new ones.

For more information, see the fn::validate documentation.

Introducing the new and improved ESC Editor

Sean Yeh — Thu, 15 Jan 2026 08:00:00 -0500

Pulumi ESC is Pulumi Cloud’s centralized solution for managing secrets and configuration across every vault and cloud provider you use. It helps teams secure their configuration while adopting modern best practices like short-lived credentials with OIDC and automated secret rotation.

Whether you’re configuring Pulumi programs, powering applications and services, or managing credentials for tools like the AWS CLI, ESC provides a single, consistent way to do it safely and at scale.

Behind the scenes, ESC integrates with multiple cloud providers and secret managers, supports composable environments, and offers rich built-in functions, from simple value transformations to encoding files as Base64.

With this level of power, usability matters more than ever. That’s why today we’re introducing the new and improved Pulumi ESC Web Editor, designed to make managing secrets and configuration easier, faster, and more intuitive.

Today, you can create and manage your Pulumi ESC configuration in multiple ways, such as using the CLI set and edit commands, or through our VS Code extension. For many users, however, their first experience with ESC happens in the Pulumi Cloud Console.

Based on feedback from users of both our YAML Document view and Table view in the Console, we’ve been working hard to create a new and improved unified editor experience that makes ESC even easier to work with. One of the most notable improvements is a brand new Inspect tab that lets you easily edit secrets and gain deeper insights into your configuration. With this new UI, you can now freely switch between writing YAML and using rich UI elements to manipulate your environment—and the editor keeps everything in sync, with clear, in-context information about what you’re doing and what’s possible at every step.

Let’s explore some of these use cases!

Adding and editing secrets

Adding secrets is now as simple as selecting Secret from the Add new menu.

The Inspect tab lets you view and edit your secret securely, automatically encrypting it as ciphertext in your environment definition. No more worrying about accidentally exposing sensitive values!

Using providers and built-in functions

ESC offers a large library of providers and built-in functions to use in your environment. The new editor makes discovering and using them effortless.

When you add a provider or function, the editor inserts it with example values to get you started quickly. The Inspect tab provides instant access to documentation, so you can more easily configure the integrations.

Exporting configurations

Consuming your configuration where you need it is now easier than ever. The Export menu in the Inspect sidebar lets you quickly expose values as Pulumi config for your stacks, or as environment variables in your shell.

Conclusion

The new Pulumi ESC Editor brings together the best of both worlds: the power of the YAML editor with the ease of UI controls. Try it out today in the Pulumi Cloud Console and let us know what you think!

New Pulumi ESC Onboarding and OIDC Provider Experience

Pablo Terradillos — Fri, 17 Oct 2025 16:00:00 -0300

Pulumi ESC (Environments, Secrets, and Configuration) provides centralized secrets management and configuration orchestration across your infrastructure and applications. Today, we’re excited to introduce a redesigned onboarding experience and a simpler, automated way to set up Pulumi ESC as an OpenID Connect (OIDC) provider.

A new and refreshed onboarding experience

Pulumi ESC helps you manage configuration for Pulumi programs, handle secret rotation, and centralize secrets stored across multiple providers.

We’ve now started simplifying these workflows from the moment you create a new Environment. The redesigned onboarding experience helps you get the most out of ESC.

Using Pulumi ESC as an OIDC Provider

Among its many uses, Pulumi ESC can act as an OpenID Connect (OIDC) provider, issuing short-lived, signed tokens that external systems can exchange for temporary cloud credentials. This eliminates hard-coded credentials and improves your security posture.

Other Pulumi offerings, such as Pulumi Insights, use this mechanism to securely scan resources across your organization.

A simpler way to set up OIDC for your cloud providers

Setting up an OIDC provider manually can involve multiple steps and be error-prone. To simplify this, Pulumi ESC now offers automated setup for AWS, Azure, and Google Cloud directly from the onboarding flow.

For each login provider, we offer different setup options to suit your needs. You can log in with your cloud credentials and let Pulumi Cloud handle the rest, or you can create your resources from your own machine using the Pulumi CLI.

Previously, you had to go to the AWS Console to create an identity provider, create and configure an IAM Role, and set up the trust policy before finally creating your ESC Environment.

Now, you can just use SSO, giving Pulumi Cloud permissions to create the necessary resources automatically.

After we have finished setting up the trust relationship with AWS, we’ll set up a new ESC environment for you under the specified project.

Once setup is complete, your new environment is ready to issue short-lived credentials.

pulumi env run aws-login/tehsis-env -- aws s3 ls

You can now access your cloud resources securely, without worrying about managing long-lived credentials.

What’s next?

This is just the beginning of our work to simplify Pulumi ESC setup and onboarding. We’re continuing to refine how teams configure, secure, and manage environments to make getting started with ESC as smooth as possible.

Try Pulumi ESC today and see how it can streamline your secrets and configuration management!

Pulumi ESC: Open Approvals

Pablo Terradillos — Mon, 13 Oct 2025 16:00:00 -0300

Many teams live with the fear that a production environment might be accidentally opened, exposing credentials or sensitive systems before anyone even notices.

We’re excited to announce a new feature for Pulumi ESC: Open approvals. A governance capability that lets organizations require review and sign-off before an environment is opened (i.e. activated or exposed)

Expanding on our mission to enforce compliance and security without slowing teams down

You may recall that earlier this year we introduced Approvals for updates, which allows teams to require review and sign-off before applying modifications to environment configurations. We are now extending Pulumi ESC auditing and governance capabilities to enable Just in time (JIT) access control.

Many organizations require more robust guardrails around when an environment becomes active or accessible. Open Approvals introduces a gate before environment activation, enforcing that every environment open is intentional, reviewed, and governed.

Open Approvals introduces a gate before environment activation, enforcing that every environment open is intentional, reviewed, and governed.

How it works

When configuring Approvals gates for your environments under Settings → Approval Rulesets, you can now gate Open actions in addition to Updates. From this very same UI, you can define the approvals requirements:

Number of required reviewers
Specific teams or individuals allowed to approve
Whether self-approval is permitted

Once a ruleset is defined, all open operations in the corresponding environment will require to be approved before proceeding.

To create an open request, users need to specify the approval duration, how long they need access after opening the environment, and a description explaining why access is needed.

Approvals can be later review and approved from the Approvals tab.

A request access can also be created from the CLI via the newly introduced pulumi env open-request command.

$ pulumi env open-request org/project/env --access-duration-seconds=2h --grant-expiration-seconds=1h

Closing notes

Open approvals expands on Pulumi ESC support for compliance and governance capability while we stay true to our goal: empower teams to move fast while staying secure and compliant: no matter where or how changes happen.

We’re excited about what’s ahead and look forward to building it together with your feedback.

You can learn more about Approvals in Pulumi ESC Docs.

Introducing Approvals in Pulumi ESC

Pablo Terradillos — Mon, 04 Aug 2025 09:00:00 -0300

Did you know that 80% of unplanned outages aren’t caused by hardware failures or cyberattacks, but by the very changes we make to improve our systems?

Pulumi ESC already enables safer change management with our innovative versioning capability which allows users to track and roll back environment revisions.

Building on this foundation, we’re excited to announce the release of Approvals in Pulumi ESC—a new feature that enables organizations to bring governance and oversight directly into their environment configuration workflows.

With Approvals, teams can require explicit review and sign-off before applying changes to ESC-managed environments, bringing the same rigor to configuration as they already have with infrastructure-as-code and application development.

Enforce Change Management Without Slowing Teams Down

Pulumi ESC helps teams manage environment configurations—such as secrets and application settings—across services and environments, from development through production.

In fast-moving teams, managing these settings safely and consistently is critical. But as the number of contributors grows, so does the risk of accidental or unreviewed changes making it into critical environments.

That’s where Approvals come in.

With Approvals, any proposed change to an ESC environment—whether through the Pulumi Console or CLI—must go through a structured review process before it’s applied. Similar to submitting a Pull Request, contributors can propose changes that are reviewed and approved by designated team members.

This gives you a native, consistent workflow for gating configuration updates without needing external tools or manual oversight.

Why use Approvals?

Teams can use Pulumi ESC Approvals to apply the same rigor of code review workflows to environment configurations and secrets management. Approvals help organizations enforce governance policies, meet compliance requirements, and reduce the risk of misconfigurations by requiring explicit review and sign‑off before applying changes. Each request creates a clear, auditable record of who approved what, when, and why, which is especially valuable for regulated industries or teams with strict change‑management processes.

By introducing a controlled review process, Approvals let developers propose updates while ensuring only authorized reviewers can approve and apply them. This balances collaboration with security and accountability, and works seamlessly in both the Pulumi Cloud console and the Pulumi CLI.

How It Works

To get started, navigate to your environment’s Settings → Approval Rulesets, where you can define approval requirements such as:

Number of required reviewers
Specific teams or individuals allowed to approve
Whether self-approval is permitted
Whether changes require reapproval if modified

Once a ruleset is enabled, any environment update must go through a change request workflow. Instead of directly saving changes, contributors create a draft, which then must be reviewed and approved before being applied.

Changes pending approval are clearly visible to your team, and reviewers can inspect the diff, leave feedback, or revise the request before approving.

Approvals are also fully supported in the Pulumi CLI, using the --draft flag:

$ pulumi env set --draft org/project/env FEATURE_X_ENABLED true

In addition to the CLI, Approvals can be used directly from the ESC SDK—making it easy to integrate change‑management workflows into your own applications or automation scripts.

They are also available through the Pulumi Visual Studio Code Extension, allowing developers to review, approve, and apply configuration changes without leaving their editor.

Finally, the Pulumi Service Provider supports managing approval rules as code. For example:

import * as service from "@pulumi/pulumiservice";
import * as pulumi from "@pulumi/pulumi";

// ...

var approvalRule = new service.ApprovalRule("rule-test", {
 name: "My rule!",
 enabled: true,
 targetActionTypes: ["update"],
 environmentIdentifier: {
 organization: environment.organization,
 project: environment.project,
 name: environment.name,
 },
 approvalRuleConfig: {
 numApprovalsRequired: 3,
 allowSelfApproval: true,
 requireReapprovalOnChange: true,
 eligibleApprovers: [
 {
 rbacPermission: "environment:write",
 },
 {
 user: "pulumi-bot",
 },
 {
 user: "IaroslavTitov",
 },
 ]
 }
})

You can find more examples for different languages at the Pulumi Service Provider Github repository.

Built for Collaboration and Compliance

Whether you’re enforcing separation of duties, complying with industry standards or regulations, or simply want better visibility into changes, Approvals helps bring process to how configuration flows through your systems.

It also integrates seamlessly into existing workflows—no need to reinvent how teams work. Just add governance where it matters most.

What’s Next

Approvals in ESC is just the beginning. We’re exploring how approval workflows can be extended to other areas of the Pulumi ecosystem to provide a consistent, governed experience across the entire software delivery lifecycle.

Our goal is to empower teams to move fast while staying secure and compliant—no matter where or how changes happen. We’re excited about what’s ahead and look forward to building it together with your feedback.

Happy building!

Bring Your Own Keys With Pulumi ESC

Pablo Terradillos — Wed, 18 Jun 2025 13:25:26 -0300

Today we’re excited to launch support for Customer-Managed Keys (CMKs) in Pulumi ESC. This feature gives your organization full control over how your secrets and state are encrypted — empowering you to meet the most demanding compliance requirements like HIPAA, GDPR, and FedRAMP, all while maintaining the ease-of-use that Pulumi is known for.

Why Customer-Managed Keys?

Pulumi encrypts secrets and other sensitive information stored in ESC using data keys, which are encrypted with Pulumi-Managed Keys using strong security standards. However, customers might need to use their own keys to gain full control over their lifecycle and revocation, maintain a centralized audit trail, and enforce custom rotation policies. This is especially important to meet compliance requirements or specific regulations (e.g., HIPAA, GDPR, FedRAMP, etc.). Customer-Managed Keys give customers that control while keeping these aspects transparent for the consumers of those secrets.

How It Works

Customer-Managed Keys integrate seamlessly with your Pulumi Cloud Organization. Once enabled, all existing data keys used to encrypt your ESC secrets, previously encrypted with the Pulumi-managed key, will be automatically re-encrypted with the new CMK.

Setting it up takes just a few minutes:

Create a KMS key in your AWS account.
Grant access to the KMS key using OIDC in your AWS account.
Configure your Pulumi Cloud organization to use your new KMS key.

Available Today

Customer-Managed Keys with support for AWS KMS are available today for all organizations on the Pulumi Enterprise or Business Critical plans. You can set it up by following the instructions in the Pulumi Cloud documentation.

We expect to add support for more cloud providers in the future. Please vote on the following GitHub issues for your favorite to support prioritization:

We’re excited to see how Customer-Managed Keys help you and your organization meet your compliance goals with Pulumi Cloud. Your feedback is essential as we continue to evolve this feature:

Connect with us in the Pulumi Community Slack
Open an issue on GitHub
Read the full documentation on Customer-Managed Keys

Try this today, Get Started with Pulumi for free

Pulumi Blog: Pablo Terradillos

The Standalone ESC CLI Retired: Use pulumi env

Why are we making this change

Playing nicer with humans and AI agents

Faster improvements

The same code all along

Do I need to update?

Lock Down Values in Pulumi ESC with fn::final

How it works

When to use fn::final

Getting started

Schema Validation Comes to Pulumi ESC with fn::validate

How it works

Validating objects with required fields

Reusing schemas across environments

What happens when validation fails

When to use schema validation

Getting started

Introducing the new and improved ESC Editor

Adding and editing secrets

Using providers and built-in functions

Exporting configurations

Conclusion

New Pulumi ESC Onboarding and OIDC Provider Experience

A new and refreshed onboarding experience

Using Pulumi ESC as an OIDC Provider

A simpler way to set up OIDC for your cloud providers

What’s next?

Pulumi ESC: Open Approvals

Expanding on our mission to enforce compliance and security without slowing teams down

How it works

Closing notes

Introducing Approvals in Pulumi ESC

Enforce Change Management Without Slowing Teams Down

Why use Approvals?

How It Works

Built for Collaboration and Compliance

What’s Next

Bring Your Own Keys With Pulumi ESC

Why Customer-Managed Keys?

How It Works

Available Today

Share Your Feedback