GCP OIDC provider for Pulumi Cloud

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set gcp-ts-oidc-provider-pulumi-cloud
$ cd pulumi-examples/gcp-ts-oidc-provider-pulumi-cloud

This Pulumi program enables Pulumi Cloud to authenticate with an OIDC provider in a Google Cloud project, and creates a Pulumi ESC environment that allows both the gcloud CLI and the Pulumi Google Cloud provider to consume temporary (admin) credentials.

Last update: September 2025

Prerequisites#

1. Install Pulumi
2. Configure GCP credentials
3. Install Node.js
4. A Pulumi Cloud account
5. A Google Cloud project

Deploying the example#

This Pulumi example is written as a template. It is meant to be copied via pulumi new.

1. Log in to your Pulumi Cloud account if you haven’t already:

   pulumi login

2. Copy the template to a new directory (--dir is optional; it will use the current directory if omitted):

   pulumi new https://github.com/pulumi/examples/gcp-ts-oidc-provider-pulumi-cloud --dir my-gcp-oidc
   cd my-gcp-oidc

   Once copied to your machine, feel free to edit as needed.

3. Install dependencies:

   npm install

4. Deploy the stack. This template will pick up the thumbprint from the URL that you set in the stack configuration. By default it will use the OIDC IDP URL for Pulumi Cloud:

   pulumi up

   Note: due to propagation delays, the OIDC connection may take a few minutes before it is usable.

Cleaning up#

Once you’re finished experimenting, destroy your stack and remove it to avoid incurring any additional cost:

pulumi destroy
pulumi stack rm

Additional notes#

This project is generally useful as a baseline setup for using ESC with Google Cloud. You may want to refine the scope of the accounts permissions (e.g. from roles/admin to roles/writer or roles/reader), or you may want to import the generated ESC environment into a new ESC environment to enable scenarios like accessing Google Secret Manager secrets.