---
title: Connect Your Cloud Account
url: /docs/get-started/connect-cloud/
---
Pulumi has no credential system of its own. It authenticates to your cloud the same way your cloud provider's own CLI and SDKs do — using the same environment variables, configuration files, and identity mechanisms. If your cloud provider's CLI already works on your machine, Pulumi already has everything it needs.

## How Pulumi authenticates

Each Pulumi provider uses the cloud vendor's official SDK and its standard credential chain, so any authentication method your cloud supports — CLI login, environment variables, instance profiles, workload identity — works with Pulumi unchanged. You can also set credentials explicitly for an individual [stack](/docs/iac/concepts/stacks/) using [provider configuration](/docs/iac/concepts/config/).

For the full range of options per provider, see the setup pages for [AWS](/registry/packages/aws/installation-configuration/), [Azure](/registry/packages/azure-native/installation-configuration/), [Google Cloud](/registry/packages/gcp/installation-configuration/), and [Kubernetes](/registry/packages/kubernetes/installation-configuration/).

## Check whether you're already connected

Run your cloud's identity check. If it prints your account, identity, or cluster details, Pulumi can already manage resources there and you can continue straight to writing your program.

| Cloud | Command | Success looks like |
| --- | --- | --- |
| AWS | `aws sts get-caller-identity` | Your user ID, account, and ARN are printed |
| Azure | `az account show` | Your subscription and tenant details are printed |
| Google Cloud | `gcloud config list` | Your active account and project are printed |
| Kubernetes | `kubectl cluster-info` | Your cluster's control plane address is printed |

## Set up access for your cloud

If the check above didn't succeed — or you'd like to review the details — each getting started guide has a configuration page for its cloud. Each of those pages is part of its cloud's full tutorial flow, and its Previous and Next buttons take you back to installing Pulumi or onward to creating and deploying your first project.

[Configure access to AWS →](/docs/iac/get-started/aws/configure/)
[Configure access to Azure →](/docs/iac/get-started/azure/configure/)
[Configure access to Google Cloud →](/docs/iac/get-started/gcp/configure/)
[Configure access to Kubernetes →](/docs/iac/get-started/kubernetes/configure/)

## Best practice: short-lived credentials with Pulumi ESC

Long-lived static keys are the most common source of credential leaks. [Pulumi ESC](/docs/esc/) can mint short-lived cloud credentials on demand via OpenID Connect (OIDC), so nothing sensitive lives on your workstation or in CI. See the ESC login providers for [AWS](/docs/esc/providers/login/aws-login/), [Azure](/docs/esc/providers/login/azure-login/), and [Google Cloud](/docs/esc/providers/login/gcp-login/).

## Next steps

1. Pick your cloud above to configure access, then continue that cloud's tutorial to create and deploy your first project.
1. New to Pulumi entirely? Start from the [getting started overview](/docs/get-started/).