Stacks in the Pulumi Console are grouped by organizations. In order to access the stacks within an organization, a Pulumi user must have a specific role within that organization.
This only applies to newer organizations on the per-member subscription plan. Organizations billed per stack have slightly different rules regarding membership.
To become a member of a Pulumi organization, you must be added by an existing Pulumi organization administrator. However, depending on the organization type, you must also be a member of the third-party organization or group backing the Pulumi organization.
For example, to become a member of a Pulumi organization backed by a GitLab Group, you must associate a GitLab identity with your Pulumi account, and also be a member of that GitLab group.
There are several kinds of organization roles a user may be assigned.
A member of a Pulumi organization can be added to organization teams, and depending on organization settings, may be able to create or delete stacks.
Pulumi organization admins have
ADMIN access to all organization stacks,
and can manage organization settings and team memberships.
A Pulumi organization administrator can change the permissions available to members of the organization.
Default Stack Permission
Any organization member with the
ADMIN role automatically has
permissions for all of the organization’s stacks. Regular organization members
are granted the organization’s base permissions instead.
For example, if the organization’s base permissions is
any organization member can update any organization stack.
Pulumi organization admins can configure whether or not members can create stacks.
If enabled, any organization member can create a new stack. Otherwise, only organization admins can.
When a stack is created within an organization, the creator is given
ADMIN permissions to the stack. So even if the default
stack permission is
NONE, the creator will be able to update the stack. Organization admins
can remove a creator’s access to the stack.
Similar to stack creation, Pulumi organization admins can configure whether or not organization members can delete stacks.
If enabled, any organization member with
ADMIN permission on the stack can delete
it. Otherwise, only Pulumi organization admins can.
If enabled, organization members will be able to transfer stacks to another Pulumi organization.
Transfering a stack to another organization requires that the user performing the action
ADMIN permission to the stack being moved, and has the
within the organization the stack is being transferred to.