---
title: pulumi env setup aws | CLI commands
url: /docs/iac/cli/commands/pulumi_env_setup_aws/
---



[EXPERIMENTAL] Set up AWS OIDC integration for Pulumi ESC

## Synopsis

[EXPERIMENTAL] Set up AWS OIDC integration for Pulumi ESC

Creates, in each selected AWS account:
  - an OIDC identity provider trusting Pulumi Cloud
  - an IAM role whose trust policy is scoped to your organization
  - an attachment of the chosen managed policy to that role

You are asked how to authenticate: with the AWS credentials you already have, which
configures the single account they belong to, or by signing in to AWS SSO in your
browser, which lets you configure several accounts at once.

Examples:
  pulumi env setup aws --policy AdministratorAccess

  # Use existing credentials without prompting.
  pulumi env setup aws --policy ReadOnlyAccess --yes

  # Force the browser sign-in, inferring the SSO instance from your AWS config.
  pulumi env setup aws --sso --policy AdministratorAccess

  # Force the browser sign-in and configure one account non-interactively.
  pulumi env setup aws --sso-start-url https://my.awsapps.com/start \
--sso-region us-east-1 --policy ReadOnlyAccess \
--account 123456789012 --sso-role AdministratorAccess --yes

```
pulumi env setup aws [flags]
```

## Options

```
      --account account        an AWS account to set up (repeatable; prompted for when omitted)
      --duration string        the session duration for the assumed role (default "1h")
  -h, --help                   help for aws
      --org string             the Pulumi organization to configure OIDC for
      --policy string          the policy attached to the OIDC role: AdministratorAccess (required for Deployments), ReadOnlyAccess (required for Insights), or any other policy ARN; prompted for when omitted
      --project string         the ESC project that per-account environments are created in (default "aws-login")
      --session-name string    the AWS session name recorded for the assumed role (default "pulumi-environments-session")
      --sso                    force AWS SSO browser sign-in instead of using existing credentials, so several accounts can be configured at once (the SSO start URL and region are inferred from your AWS config)
      --sso-region string      the region the AWS SSO instance is hosted in (inferred from your AWS config when omitted)
      --sso-role string        the SSO role to assume when setting up each account (prompted for when ambiguous)
      --sso-start-url string   the AWS SSO start URL; forces the browser sign-in (inferred from your AWS config when omitted)
      --yes                    skip all confirmation prompts
```

## Options inherited from parent commands

```
      --color string                 Colorize output. Choices are: always, never, raw, auto (default "auto")
  -C, --cwd string                   Run pulumi as if it had been started in another directory
      --disable-integrity-checking   Disable integrity checking of checkpoint files
  -e, --emoji                        Enable emojis in the output
      --env string                   The name of the environment to operate on.
  -Q, --fully-qualify-stack-names    Show fully-qualified stack names
      --logflow                      Flow log settings to child processes (like plugins)
      --logtostderr                  Log to stderr instead of to files
      --memprofilerate int           Enable more precise (and expensive) memory allocation profiles by setting runtime.MemProfileRate
      --non-interactive              Disable interactive mode for all commands
      --otel-traces string           Export OpenTelemetry traces to the specified endpoint. Use file:// for local JSON files, grpc:// or https:// for remote collectors
      --profiling string             Emit CPU and memory profiles and an execution trace to '[filename].[pid].{cpu,mem,trace}', respectively
      --tracing file:                Emit tracing to the specified endpoint. Use the file: scheme to write tracing data to a local file
  -v, --verbose int                  Enable verbose logging (e.g., v=3); anything >3 is very verbose
```

## SEE ALSO

* [pulumi env setup](/docs/iac/cli/commands/pulumi_env_setup/)	 - [EXPERIMENTAL] Set up cloud provider OIDC integrations