September 2026 Summaries

Pulumi ESC now supports OIDC onboarding for AWS, Azure, and Google Cloud directly through the Pulumi CLI via the new `pulumi env setup` command, allowing users, scripts, and agents to configure short-lived cloud credentials without relying on hard-coded secrets or completing setup in the Pulumi Cloud console. The command provides interactive, cloud-specific prompts to collect authentication details, target accounts, and access policies, then displays a proposed configuration before creating the required identity provider, roles, policy attachments, and an ESC environment for each account. For AWS, users can authenticate with existing credentials or AWS SSO and select policies such as AdministratorAccess, ReadOnlyAccess, or a custom policy ARN. Non-interactive flags are also available for automation, and the feature is included in the latest Pulumi CLI after authenticating with Pulumi Cloud.