pulumi login | CLI commands

Log in to a Pulumi state backend

Synopsis

Log in to a Pulumi state backend.

With no arguments, this command logs in to Pulumi Cloud:

$ pulumi login

If PULUMI_ACCESS_TOKEN is set, that token is used. Otherwise, the command prompts for an access token and offers to open a browser where you can create one.

To log in to a self-hosted Pulumi Cloud, pass its API URL:

$ pulumi login https://api.pulumi.acmecorp.com

For either, --default-org sets the organization to use when a command doesn’t name one, and --interactive lists the accounts you’re already logged in to so you can choose among them.

To manage state yourself, pass the URL of a supported storage backend instead. Pulumi stores state under a .pulumi directory at that location, and backing it up and coordinating access across a team is then up to you:

$ pulumi login file://~                                    # local filesystem
$ pulumi login s3://my-pulumi-state-bucket                 # AWS S3
$ pulumi login gs://my-pulumi-state-bucket                 # Google Cloud Storage
$ pulumi login azblob://my-pulumi-state-bucket             # Azure Blob Storage
$ pulumi login postgres://user:password@host:5432/database # PostgreSQL

--local is a shortcut for file://~, which stores state under ~/.pulumi.

pulumi login [url] [flags]

Options

  -c, --cloud-url string         The URL of the Pulumi Cloud API to log in with (e.g., 'https://api.pulumi.com')
      --default-org string       A default org to associate with the login. Please note, currently, only the managed and self-hosted backends support organizations
  -h, --help                     help for login
      --insecure                 Allow insecure server connections when using SSL
      --interactive              Show interactive login options based on known accounts
  -l, --local                    Use Pulumi in local-only mode
      --oidc-expiration string   The expiration for the cloud backend access token in duration format (e.g. '15m', '24h')
      --oidc-org string          The organization to use for OIDC token exchange audience
      --oidc-team string         The team when exchanging for a team token
      --oidc-token string        An OIDC token to exchange for a cloud backend access token. Can be either a raw token or a file path prefixed with 'file://'.
      --oidc-user string         The user when exchanging for a personal token

Options inherited from parent commands

      --color string                 Colorize output. Choices are: always, never, raw, auto (default "auto")
  -C, --cwd string                   Run pulumi as if it had been started in another directory
      --disable-integrity-checking   Disable integrity checking of checkpoint files
  -e, --emoji                        Enable emojis in the output
  -Q, --fully-qualify-stack-names    Show fully-qualified stack names
      --logflow                      Flow log settings to child processes (like plugins)
      --logtostderr                  Log to stderr instead of to files
      --memprofilerate int           Enable more precise (and expensive) memory allocation profiles by setting runtime.MemProfileRate
      --non-interactive              Disable interactive mode for all commands
      --otel-traces string           Export OpenTelemetry traces to the specified endpoint. Use file:// for local JSON files, grpc:// or https:// for remote collectors
      --profiling string             Emit CPU and memory profiles and an execution trace to '[filename].[pid].{cpu,mem,trace}', respectively
      --tracing file:                Emit tracing to the specified endpoint. Use the file: scheme to write tracing data to a local file
  -v, --verbose int                  Enable verbose logging (e.g., v=3); anything >3 is very verbose

SEE ALSO

• pulumi - Pulumi command line