Pulumi CLI environment variables

PULUMI_STACK

Specifies the selected pulumi stack, overriding the stack selected with pulumi stack select STACK. The priority is as follows:

1. The --stack command line flag
2. PULUMI_STACK
3. Stack selected with pulumi stack select <STACK>

PULUMI_AUTOMATION_API_SKIP_VERSION_CHECK

Skips the minimum CLI version check used by Automation API to ensure compatibility. We do not recommend using this variable as it may result in unexpected behavior or confusing error messages from Automation API.

PULUMI_AUTOMATION_API_SKIP_VERSION_CHECK=true

PULUMI_ACCESS_TOKEN

Set this environment variable to authenticate into the Pulumi Cloud backend and bypass the access token prompt when running pulumi login .

PULUMI_ACCESS_TOKEN="your-access-token"

PULUMI_API

Overrides the URL of the Pulumi Cloud API that the CLI communicates with when using the Pulumi Cloud backend. Most users should set PULUMI_BACKEND_URL instead, which selects the backend itself; this variable is for advanced scenarios, such as pointing the CLI at a non-default Pulumi Cloud API endpoint.

PULUMI_API="https://api.pulumi.com"

PULUMI_BACKEND_URL

Set this environment variable to use a specified backend instead of the default backend. See State and Backends for details on valid backend URLs.

PULUMI_BACKEND_URL="s3://your-pulumi-state-bucket"

PULUMI_CONFIG

Sets configuration for unit testing. Must be in JSON format.

This environment variable is ignored during normal Pulumi operations -- e.g., up, preview, etc. -- but must be valid JSON if present.

PULUMI_CONFIG='{"project:myTag":"val1","project:mySecret":"val2"}'

PULUMI_CONFIG_PASSPHRASE

Set this as an environment variable to protect and unlock your configuration values and secrets. Your passphrase is used to generate a unique key for your stack, and configuration and encrypted state values are then encrypted using AES-256-GCM. Read the change log and Configuration and Secrets to learn more about Pulumi's configuration and secrets management system.

PULUMI_CONFIG_PASSPHRASE="your-passphrase"

PULUMI_CONFIG_PASSPHRASE_FILE

An alternative method to providing PULUMI_CONFIG_PASSPHRASE. Set this to the path of a file that contains the passphrase value.

PULUMI_CONFIG_PASSPHRASE_FILE="/tmp/passphrase.txt"

PULUMI_CONSOLE_DOMAIN

Overrides the domain used when generating links to the Pulumi Cloud.

PULUMI_CONSOLE_DOMAIN="yourhost.domain.com"

PULUMI_CONTINUE_ON_ERROR

Continues to perform the update/destroy operation despite the occurrence of errors.

PULUMI_CONTINUE_ON_ERROR=true

PULUMI_CREDENTIAL_STORE

Selects an opt-in store for CLI credentials, such as your Pulumi Cloud access token, that encrypts them at rest with a key protected by your operating system's credential manager (Keychain on macOS, Credential Manager on Windows, or a Secret Service provider such as GNOME Keyring on Linux) instead of writing them to disk in plaintext under PULUMI_HOME. Set to os to require the OS-native store, or auto to use it when available and fall back to plaintext. Set to plaintext to opt out.

PULUMI_CREDENTIAL_STORE=os

PULUMI_DEBUG_COMMANDS

List commands helpful for debugging Pulumi itself.

PULUMI_DEBUG_COMMANDS=true

PULUMI_DEBUG_GRPC

Enables debug tracing of Pulumi gRPC internals. The variable should be set to the log file to which gRPC debug traces will be sent.

PULUMI_DEBUG_GRPC="/path/to/grpc-debug.log"

PULUMI_DEBUG_PROMISE_LEAKS

As of v0.12.2, the promise leak experience has been improved and shows a simple error message. Set this environment variable to get more verbose error messages when debugging promise leaks.

PULUMI_DEBUG_PROMISE_LEAKS=true

PULUMI_DEFAULT_ORGANIZATION

Sets the default organization to use when creating a new stack or resolving an unqualified stack name, similar to setting a default organization with pulumi org set-default.

PULUMI_DEFAULT_ORGANIZATION=your-org

PULUMI_DEV

Enable features for hacking on Pulumi itself.

PULUMI_DEV=true

PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION

Disables the automatic installation of missing plugins.

PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=true

PULUMI_DISABLE_SECRET_CACHE

Disables the caching encryption operations for unchanged stack secrets.

PULUMI_DISABLE_SECRET_CACHE=true

PULUMI_DISABLE_PROVIDER_PREVIEW

Disables provider preview and enables previous more conservative preview behavior.

PULUMI_DISABLE_PROVIDER_PREVIEW=true

PULUMI_DISABLE_VALIDATION

Disables format validation of system inputs. Currently, this disables validation of stack names.

PULUMI_DISABLE_VALIDATION=true

PULUMI_DISABLE_REGISTRY_RESOLVE

By default, pulumi install and related package-resolution commands use the Pulumi Registry to resolve package names. Set this to true to disable registry-based resolution and fall back to the CLI's other resolution mechanisms.

PULUMI_DISABLE_REGISTRY_RESOLVE=true

PULUMI_DIY_BACKEND_DISABLE_CHECKPOINT_BACKUPS

If set, checkpoint backups will not be written to the backup folder.

PULUMI_DIY_BACKEND_DISABLE_CHECKPOINT_BACKUPS=true

PULUMI_DIY_BACKEND_GZIP

Enables gzip compression when writing state files.

PULUMI_DIY_BACKEND_GZIP=true

PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR

Using a self-managed (DIY) state backend, such as a local directory or an Amazon S3, Google Cloud Storage, or Azure Blob Storage bucket, in the legacy non-project-scoped stack layout is deprecated and due to be removed in a future release. The CLI now raises an error rather than a warning when it detects this layout. Set this to true to bypass the error and continue using the legacy layout. We recommend running pulumi state upgrade to move to project-scoped stacks instead, and consider moving to the Pulumi Cloud backend while you are at it, since it manages this state layout, locking, and encryption for you.

PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR=true

PULUMI_DIY_BACKEND_LEGACY_LAYOUT

Uses the legacy layout for new buckets, which currently default to project-scoped stacks.

PULUMI_DIY_BACKEND_LEGACY_LAYOUT=true

PULUMI_DIY_BACKEND_NO_LEGACY_WARNING

Disables the warning about legacy stack files mixed with project-scoped stack files.

PULUMI_DIY_BACKEND_NO_LEGACY_WARNING=true

PULUMI_DIY_BACKEND_PARALLEL

Number of parallel operations when fetching stacks and resources from the DIY backend.

PULUMI_DIY_BACKEND_PARALLEL=NUMBER_OF_PARALLEL_OPERATIONS

PULUMI_DIY_BACKEND_RETAIN_CHECKPOINTS

If set, every checkpoint will be duplicated to a timestamped file.

PULUMI_DIY_BACKEND_RETAIN_CHECKPOINTS=true

PULUMI_ENABLE_LEGACY_APPLY

As of 1.0.0-beta1, input properties are no longer propagated to missing output properties during a pulumi preview. If this causes issues in your Pulumi program, set this to true to enable the old behavior.

PULUMI_ENABLE_LEGACY_APPLY=true

PULUMI_ENABLE_LEGACY_DIFF

As of v0.17.23, the detection of differences between the actual and desired state of a resource is left entirely up to that resource's provider. This change can expose bugs in resource providers that lead to diffs being present even if the desired configuration matches the actual state of the resource. Set this to 1 or true to enable the old diff behavior.

PULUMI_ENABLE_LEGACY_DIFF=true

PULUMI_ENABLE_LEGACY_PLUGIN_SEARCH

As of v0.16.18, a fix has been released to prevent the Pulumi CLI from loading the newest plugin for a resource provider instead of the requested version. This has the potential to disrupt users that previously had working configurations. Set this environment variable to opt into the legacy plugin load behavior.

PULUMI_ENABLE_LEGACY_PLUGIN_SEARCH=true

PULUMI_ENABLE_LEGACY_REFRESH_DIFF

Use legacy refresh diff behavior, in which only output changes are reported and changes against the desired state are not calculated.

PULUMI_ENABLE_LEGACY_REFRESH_DIFF=true

PULUMI_ENABLE_STREAMING_JSON_PREVIEW

By default, pulumi preview --json emits a single PreviewDigest JSON object to stdout after the preview completes. Set this to true to instead stream JSON events to stdout as the preview runs, matching the behavior of pulumi up|destroy|refresh --json.

PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true

PULUMI_ERROR_ON_DEPENDENCY_CYCLES

Enables error reporting when dependency cycles are detected.

PULUMI_ERROR_ON_DEPENDENCY_CYCLES=true

PULUMI_ERROR_OUTPUT_STRING

Throws an error instead of returning a string when attempting to convert an Output to a string.

PULUMI_ERROR_OUTPUT_STRING=true

PULUMI_EXPERIMENTAL

Enables experimental options and commands. See What does "experimental" mean? for what to expect.

PULUMI_EXPERIMENTAL=true

PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER

When set to "true", the secrets manager stored in the stack's state is used as a fallback when the stack configuration is missing or incomplete.

PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER=true

PULUMI_GITSSH_PASSPHRASE

The passphrase to use with Git operations that use SSH.

PULUMI_GITSSH_PASSPHRASE="your passphrase"

PULUMI_HOME

Overrides the folder where the Pulumi CLI stores its artifacts: plugins, workspaces, templates, and credentials file. By default, artifacts are stored next to Pulumi binaries in ~/.pulumi.

PULUMI_HOME="/path/to/artifacts"

PULUMI_IGNORE_AMBIENT_PLUGINS

Disables discovering additional plugins by examining $PATH.

PULUMI_IGNORE_AMBIENT_PLUGINS=true

PULUMI_LOG_ROTATION_MAX_AGE_DAYS

Overrides how long automatic logs in $PULUMI_HOME/logs are kept before being rotated out. Defaults to 7 days.

PULUMI_LOG_ROTATION_MAX_AGE_DAYS=14

PULUMI_LOG_ROTATION_MAX_TOTAL_MB

Overrides the maximum total size, in megabytes, of the automatic logs directory ($PULUMI_HOME/logs) before the oldest logs are rotated out. Defaults to 500.

PULUMI_LOG_ROTATION_MAX_TOTAL_MB=1000

PULUMI_NEO

Enables Neo help and links in the CLI output, regardless of the Neo settings for the given Pulumi organization. The legacy name PULUMI_COPILOT is still accepted as an alias.

PULUMI_NEO=true

PULUMI_PARALLEL

Allow P resource operations to run in parallel at once (1 for no parallelism)

PULUMI_PARALLEL=NUMBER_OF_PARALLEL_OPERATIONS

PULUMI_PARALLEL_DIFF

Enables running diff calculations in parallel.

PULUMI_PARALLEL_DIFF=true

PULUMI_PLUGIN_DOWNLOAD_URL_OVERRIDES

Specifies overrides for plugin-download URLs. The expected format is regexp=URL, and multiple pairs can be specified separated by commas.

PULUMI_PLUGIN_DOWNLOAD_URL_OVERRIDES="^https://foo=https://bar,^github://=https://buzz"

PULUMI_PREFER_YARN

Set this environment variable to opt-in to using yarn instead of npm for installing Node.js dependencies.

PULUMI_PREFER_YARN=true

PULUMI_PYTHON_CMD

As of v0.16.6, the Pulumi CLI uses python3 instead of python when running a Python program. Set this environment variable to run a different Python binary.

PULUMI_PYTHON_CMD="python-version-binary"

PULUMI_RUN_PROGRAM

Runs the Pulumi program for refresh and destroy operations. This is the same as passing '--run-program=true' to the CLI.

PULUMI_RUN_PROGRAM=true

PULUMI_SKIP_CHECKPOINTS

As of v3.40.1, you may skip saving state checkpoints and only save the final deployment. See #10668. This is an experimental feature that also requires PULUMI_EXPERIMENTAL=true to be set for versions >= v3.40.1, < v3.104.0.

PULUMI_SKIP_CHECKPOINTS=true

PULUMI_SKIP_CONFIRMATIONS

As of v2.0.0, an explicit confirmation was required when running in non-interactive mode. Set this environment variable to make that explicit confirmation.

PULUMI_SKIP_CONFIRMATIONS=true

PULUMI_SKIP_UPDATE_CHECK

As of v0.17.9, you may skip the Pulumi version update check by setting this environment variable.

PULUMI_SKIP_UPDATE_CHECK=true

PULUMI_SUPPRESS_NEO_LINK

Suppresses showing the 'explainFailure' link to Neo in the CLI output, regardless of the Neo settings for the given Pulumi organization. The legacy name PULUMI_SUPPRESS_COPILOT_LINK is still accepted as an alias.

PULUMI_SUPPRESS_NEO_LINK=true

NO_COLOR

The presence of this environment variable (regardless of its value) strips color ANSI codes from text output to the terminal. See https://no-color.org/ for more details. When used with Automation API, this environment variable will strip color directives from the event logs.

NO_COLOR

Setting CLI arguments with environment variables

As of v3.208.0, all Pulumi CLI arguments can be set via environment variables.

All CLI argument environment variables follow a predictable naming convention: PULUMI_OPTION_ followed by the capitalized snake case version of the argument name. For example:

Note that you can specify boolean arguments either with true and false or 1 and 0. For more information, as well as some practical examples, see the release article.