Pulumi preview fails with permission errors on ESC

Not specified by the original author.

TL;DR

After granting, re-run preview. Maintainer pgavlin confirms the cause is access control: the identity running the command is not granted on the environment, and each environment must be added to teams individually.

Steps

1. In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. After granting, re-run preview. In CI, check which identity the pipeline authenticates as and grant that team or service account access to the environment.

When to use

You are seeing this: In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. Use this skill when you run into "Pulumi preview fails with permission errors on ESC environments".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: GitHub issue pulumi/pulumi#15484 (closed, 16 comments): pulumi preview suddenly fails on every stack with You do not have permission to perform this operation when opening the ESC environment. Maintainer pgavlin confirms the cause is access control: the identity running the command is not granted on the environment, and each environment must be added to teams individually.

Verified resolution: In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. After granting, re-run preview. In CI, check which identity the pipeline authenticates as and grant that team or service account access to the environment.

Source URL: https://github.com/pulumi/pulumi/issues/15484

Not specified by the original author.

Error: Preview failed: unable to discover AWS AccessKeyID and/or SecretAccessKey

TL;DR

Pulumi cannot find AWS credentials anywhere in the chain. Verify with aws sts get-caller-identity, then provide credentials via environment variables, the shared credentials file, or an SSO profile, and make sure aws:region is set in stack config.

The error

error: Preview failed: unable to discover AWS AccessKeyID and/or SecretAccessKey - see https://pulumi.io/install/aws.html for details on configuration

Fix it

1. Confirm the symptom is real: run aws sts get-caller-identity with the same environment Pulumi uses.

   • Success check: it returns your caller identity. If it fails, fix AWS CLI auth first.

2. If you keep keys in stack config, check pulumi config shows aws:accessKey and a secret aws:secretKey. If a dependency update changed how stack config is read, re-set them with pulumi config set aws:accessKey [key] and pulumi config set --secret aws:secretKey [secret].

   • Success check: pulumi config lists both keys.

3. If you use profiles, set aws:profile in stack config and confirm the profile exists in ~/.aws/config.

   • Success check: aws --profile [profile] sts get-caller-identity works.

4. Re-run pulumi preview.

   • Success check: the preview renders instead of failing at provider configuration.

When to use this

You hit this at pulumi preview when AWS credentials that used to work stopped being picked up, often after a dependency or CLI update.

When NOT to use this

Do not use this for SSO token expiry (Failed to refresh cached SSO credentials) or for region-only misconfiguration. This error is specifically about the access key pair being undiscoverable.

Compatibility

Pulumi CLI 3.x, Pulumi AWS provider v6.x. Applies to TypeScript, Python, Go, and .NET programs alike.

Variants

• Error: invocation of aws:index/getCallerIdentity:getCallerIdentity returned an error: unable to discover AWS AccessKeyID and/or SecretAccessKey
• error: unable to discover AWS AccessKeyID and/or SecretAccessKey - see https://pulumi.io/install/aws.html for details on configuration as a per-resource diagnostic

Root cause

In the reported issue, aws:accessKey, aws:region, and aws:secretKey in Pulumi.[stack].yaml stopped being honored after a dependency update, so the provider fell back to the SDK chain, found nothing, and failed at preview time.

Edge cases

• CI runners do not have your ~/.aws directory. Provide credentials via environment or OIDC there.
• aws:skipCredentialsValidation does not help here; validation is not the problem, discovery is.

Asked: how to fix Error: Preview failed: unable to discover AWS AccessKeyID and/or SecretAccessKey. Verified answer: Fixes Pulumi preview failing because the AWS provider cannot find an access key. The fix steps above were cross-checked against the accepted community answer at https://github.com/pulumi/pulumi-aws/issues/791, which confirms the same resolution.

Not specified by the original author.

Short answer: make the AWS CLI work first with the same profile and environment, then point Pulumi at that profile. Pulumi uses the standard AWS credential chain, so if aws sts get-caller-identity fails, Pulumi will too. 1. Test outside Pulumi. Run aws sts get-caller-identity in the same shell that runs Pulumi. Expected: it prints an account id and ARN. If it fails, fix AWS auth first (steps 2-3); Pulumi is not the problem yet. 2. For profile-based auth, create the profile with aws configure --profile YOUR_PROFILE (or aws configure sso for SSO), then tell Pulumi which one to use: pulumi config set aws:profile YOUR_PROFILE, or export AWSPROFILE with the profile name before running Pulumi. A profile that exists but is never selected is the most common cause of this error. 3. For SSO profiles, refresh the login with `aws sso login --profile YOURPROFILE. Cached SSO credentials expire, and the provider error about failing to refresh cached SSO credentials means exactly that. 4. For environment credentials, confirm the three variables are set in the shell that launches Pulumi (access key id, secret access key, and session token for temporary credentials) and that no stale expired set is shadowing your profile. Expected: aws configure list shows the source you intend. 5. Set the region as well: pulumi config set aws:region YOUR_REGION. Some credential-chain failures surface only when the provider also has no region. 6. Re-run pulumi preview`. Expected: the provider configures with no credential error and the preview plan prints. Root cause: the provider walks the AWS default chain and stops at the first source it finds, working or not. An expired SSO cache, an unselected profile, or stale environment variables all win over the valid credentials you configured elsewhere, which is why the error appears even though you set credentials up. When to use: local development and CI where Pulumi reports AWS credential errors before any resource operation. When NOT to use: an error that names a specific IAM permission (AccessDenied on a resource action) is an authorization problem on working credentials; fix the IAM policy instead. On EC2/ECS, credentials come from the instance or task role and step 2-4 do not apply. Variant phrasings: "pulumi no valid credential sources found", "pulumi invalid credentials configured", "pulumi aws provider failed to refresh cached sso credentials". Edge cases: in CI, prefer OIDC short-lived credentials (Pulumi ESC aws-login or the AWS OIDC action) over stored keys. Named (explicit) providers ignore aws:profile config; set the profile on the provider itself.

Context: Pulumi's AWS provider does not have its own credential store. It resolves credentials through the standard AWS chain: environment variables, the shared config and credentials files, SSO, and instance/container roles, in that order. A credentials error at pulumi up or preview time (messages like No valid credential sources found, Invalid credentials configured, or Failed to refresh cached SSO credentials) means that chain found nothing usable, found an expired session, or found a profile the provider was not told to use.

Source: Pulumi's AWS provider does not have its own credential store. It resolves credentials through the standard AWS chain: environment variables, the shared config and credentials files, SSO, and instance/container roles, in that order. A credentials error at pulumi up or preview time (messages like No valid credential sources found, Invalid credentials configured, or Failed to refresh cached SSO credentials) means that chain found nothing usable, found an expired session, or found a profile the provider was not told to use.

Verified resolution: Short answer: make the AWS CLI work first with the same profile and environment, then point Pulumi at that profile. Pulumi uses the standard AWS credential chain, so if aws sts get-caller-identity fails, Pulumi will too. 1. Test outside Pulumi. Run aws sts get-caller-identity in the same shell that runs Pulumi. Expected: it prints an account id and ARN. If it fails, fix AWS auth first (steps 2-3); Pulumi is not the problem yet. 2. For profile-based auth, create the profile with aws configure --profile YOUR_PROFILE (or aws configure sso for SSO), then tell Pulumi which one to use: pulumi config set aws:profile YOUR_PROFILE, or export AWSPROFILE with the profile name before running Pulumi. A profile that exists but is never selected is the most common cause of this error. 3. For SSO profiles, refresh the login with `aws sso login --profile YOURPROFILE. Cached SSO credentials expire, and the provider error about failing to refresh cached SSO credentials means exactly that. 4. For environment credentials, confirm the three variables are set in the shell that launches Pulumi (access key id, secret access key, and session token for temporary credentials) and that no stale expired set is shadowing your profile. Expected: aws configure list shows the source you intend. 5. Set the region as well: pulumi config set aws:region YOUR_REGION. Some credential-chain failures surface only when the provider also has no region. 6. Re-run pulumi preview`. Expected: the provider configures with no credential error and the preview plan prints. Root cause: the provider walks the AWS default chain and stops at the first source it finds, working or not. An expired SSO cache, an unselected profile, or stale environment variables all win over the valid credentials you configured elsewhere, which is why the error appears even though you set credentials up. When to use: local development and CI where Pulumi reports AWS credential errors before any resource operation. When NOT to use: an error that names a specific IAM permission (AccessDenied on a resource action) is an authorization problem on working credentials; fix the IAM policy instead. On EC2/ECS, credentials come from the instance or task role and step 2-4 do not apply. Variant phrasings: "pulumi no valid credential sources found", "pulumi invalid credentials configured", "pulumi aws provider failed to refresh cached sso credentials". Edge cases: in CI, prefer OIDC short-lived credentials (Pulumi ESC aws-login or the AWS OIDC action) over stored keys. Named (explicit) providers ignore aws:profile config; set the profile on the provider itself.

Source URL: https://www.pulumi.com/registry/packages/aws/installation-configuration/