Pulumi Cloud Role
When configuring deployment settings, you can choose the organization role that a stack’s deployments run as. On the stack’s Settings → Deploy page, open Advanced settings and pick a role from the Pulumi Cloud role dropdown.
If you leave the dropdown on Default access, the deployment only has access to the specific stack being deployed. However, this limited access can cause failures when the deployment needs to:
- Access stack references from other stacks
- Access environments
- Manage organization resources such as teams, members, or OIDC issuers
By selecting an appropriate role, you provide the deployment with the necessary permissions to access these additional resources.
Organization roles are managed through the Roles section. For more information on creating and managing roles, see the Roles documentation.
For a full explanation of how a deployment’s permissions are determined, the default permissions for each trigger, and how to grant additional access, see Permissions.
Custom roles
For fine-grained access control, create custom roles with permissions tailored to what the deployment needs. Custom roles appear in the Pulumi Cloud role dropdown marked with a Custom badge.