Pulumi preview fails with permission errors on ESC environments

TL;DR

After granting, re-run preview. Maintainer pgavlin confirms the cause is access control: the identity running the command is not granted on the environment, and each environment must be added to teams individually.

Steps

1. In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. After granting, re-run preview. In CI, check which identity the pipeline authenticates as and grant that team or service account access to the environment.

When to use

You are seeing this: In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. Use this skill when you run into "Pulumi preview fails with permission errors on ESC environments".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: GitHub issue pulumi/pulumi#15484 (closed, 16 comments): pulumi preview suddenly fails on every stack with You do not have permission to perform this operation when opening the ESC environment. Maintainer pgavlin confirms the cause is access control: the identity running the command is not granted on the environment, and each environment must be added to teams individually.

Verified resolution: In the Pulumi Cloud console, grant each ESC environment to the appropriate team explicitly; there are no wildcards, so every environment needs its own grant, and the default environment permission is the closest thing to one. After granting, re-run preview. In CI, check which identity the pipeline authenticates as and grant that team or service account access to the environment.

Source URL: https://github.com/pulumi/pulumi/issues/15484