AWS Classic: Installation & Configuration

Installation

The AWS Classic provider is available as a package in all Pulumi languages:

• JavaScript/TypeScript: @pulumi/aws
• Python: pulumi-aws
• Go: github.com/pulumi/pulumi-aws/sdk/v5
• .NET: Pulumi.Aws
• Java: com.pulumi.aws

Credentials

1. Create an IAM user in the AWS console with programmatic access and ensure it has sufficient permissions to deploy and manage your Pulumi program’s resources.
2. Set up AWS credentials for your user.

Your AWS credentials are never sent to pulumi.com. Pulumi uses the AWS SDK and the credentials in your environment to authenticate requests from your computer to AWS.

Configuration

There are a few different ways you can configure your AWS credentials to work with Pulumi.

Set credentials as environment variables

You can authenticate using environment variables. Doing so will temporarily override the settings in your credentials file.

$ export AWS_ACCESS_KEY_ID=<YOUR_ACCESS_KEY_ID>
$ export AWS_SECRET_ACCESS_KEY=<YOUR_SECRET_ACCESS_KEY>
$ export AWS_REGION=<YOUR_AWS_REGION> # e.g.`ap-south-1`

$ export AWS_ACCESS_KEY_ID=<YOUR_ACCESS_KEY_ID>
$ export AWS_SECRET_ACCESS_KEY=<YOUR_SECRET_ACCESS_KEY>
$ export AWS_REGION=<YOUR_AWS_REGION> # e.g.`ap-south-1`

> $env:AWS_ACCESS_KEY_ID = "<YOUR_ACCESS_KEY_ID>"
> $env:AWS_SECRET_ACCESS_KEY = "<YOUR_SECRET_ACCESS_KEY>"
> $env:AWS_REGION = "<YOUR_AWS_REGION>"

You may alternatively set the AWS region in your Pulumi.yaml:

$ pulumi config set aws:region <your-region> # e.g.`ap-south-1`

Create a shared credentials file using the AWS CLI

1. Install the AWS CLI

2. Configure your AWS credentials.

   $ aws configure
   AWS Access Key ID [None]: <YOUR_ACCESS_KEY_ID>
   AWS Secret Access Key [None]: <YOUR_SECRET_ACCESS_KEY>
   Default region name [None]: <YOUR_AWS_REGION>
   Default output format [None]:
   

Your AWS credentials file is now located in your home directory at .aws/credentials.

You can also create the shared credentials file by hand. For example:

[default]
aws_access_key_id = <YOUR_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_SECRET_ACCESS_KEY>

Set up multiple profiles

As an optional step, you can set up multiple profiles Here’s what that looks like in your ~/.aws/credentials file:

[default]
aws_access_key_id = <YOUR_DEFAULT_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_DEFAULT_SECRET_ACCESS_KEY>

[test-account]
aws_access_key_id = <YOUR_TEST_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_TEST_SECRET_ACCESS_KEY>

[prod-account]
aws_access_key_id = <YOUR_PROD_ACCESS_KEY_ID>
aws_secret_access_key = <YOUR_PROD_SECRET_ACCESS_KEY>

You can specify which profile to use with Pulumi through one of the following methods:

• Set AWS_PROFILE as an environment variable

  $ export AWS_PROFILE=<YOUR_PROFILE_NAME>
  

• Set aws:profile in your Pulumi.yaml

  pulumi config set aws:profile <profilename>
  

Authenticating via EC2 Instance Metadata?

As of pulumi-aws v3.28.1, the default behaviour for the provider was changed to disable MetadataApiCheck by default. This means, you need to do either of the following

1. When using the default provider:

   pulumi config set aws:skipMetadataApiCheck false
   

2. When using a named provider

   const myProvider = new aws.Provider("named-provider", {
     // other config
     skipMetadataApiCheck: false,
   });
   

   var provider = new Aws.Provider("named-provider", new Aws.ProviderArgs
   {
     // other config
     SkipMetadataApiCheck = false,
   });
   

   provider, err := aws.NewProvider(ctx, "named-provider", &aws.ProviderArgs{
       // other config
       SkipMetadataApiCheck: pulumi.Bool(false),
   })
   

   provider = pulumi_aws.Provider('named-provider', skip_metadata_api_check=False)
   

Configuration options

Use pulumi config set aws:<option> or pass options to the constructor of new aws.Provider.