Pulumi ESC now issues OIDC tokens for any service

Pulumi ESC now offers the fn::open::oidc provider, which generates short-lived OIDC tokens for external services such as Anthropic, Cloudsmith, JFrog Artifactory, and Aembit, reducing reliance on long-lived API keys stored in environments. When an environment is opened, ESC signs a token for a specified audience, with configurable lifetimes from one minute to one hour, and the target service verifies it against Pulumi’s published OIDC keys before exchanging it for its own credential. Trust policies should pin the token’s issuer, audience, and unique environment-based subject to prevent tokens from other Pulumi organizations or environments from being accepted. The feature is especially intended to limit risks for automated pipelines and AI agents by providing narrowly scoped, temporary access rather than credentials that can be copied or used indefinitely. Users can declare the provider once in an environment and import it elsewhere while retaining one stable subject and centralized access controls, with token issuance recorded in audit logs. Existing Pulumi ESC cloud-login providers continue to operate unchanged, while fn::open::oidc is intended for services that require the raw OIDC token directly.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.