Short answer: make the AWS CLI work first with the same profile and environment, then point Pulumi at that profile. Pulumi uses the standard AWS credential chain, so if `aws sts get-caller-identity` fails, Pulumi will too. 1. Test outside Pulumi. Run `aws sts get-caller-identity` in the same shell that runs Pulumi. Expected: it prints an account id and ARN. If it fails, fix AWS auth first (steps 2-3); Pulumi is not the problem yet. 2. For profile-based auth, create the profile with `aws configure --profile YOUR_PROFILE` (or `aws configure sso` for SSO), then tell Pulumi which one to use: `pulumi config set aws:profile YOUR_PROFILE`, or export AWS_PROFILE with the profile name before running Pulumi. A profile that exists but is never selected is the most common cause of this error. 3. For SSO profiles, refresh the login with `aws sso login --profile YOUR_PROFILE`. Cached SSO credentials expire, and the provider error about failing to refresh cached SSO credentials means exactly that. 4. For environment credentials, confirm the three variables are set in the shell that launches Pulumi (access key id, secret access key, and session token for temporary credentials) and that no stale expired set is shadowing your profile. Expected: `aws configure list` shows the source you intend. 5. Set the region as well: `pulumi config set aws:region YOUR_REGION`. Some credential-chain failures surface only when the provider also has no region. 6. Re-run `pulumi preview`. Expected: the provider configures with no credential error and the preview plan prints. Root cause: the provider walks the AWS default chain and stops at the first source it finds, working or not. An expired SSO cache, an unselected profile, or stale environment variables all win over the valid credentials you configured elsewhere, which is why the error appears even though you set credentials up. When to use: local development and CI where Pulumi reports AWS credential errors before any resource operation. When NOT to use: an error that names a specific IAM permission (AccessDenied on a resource action) is an authorization problem on working credentials; fix the IAM policy instead. On EC2/ECS, credentials come from the instance or task role and step 2-4 do not apply. Variant phrasings: "pulumi no valid credential sources found", "pulumi invalid credentials configured", "pulumi aws provider failed to refresh cached sso credentials". Edge cases: in CI, prefer OIDC short-lived credentials (Pulumi ESC aws-login or the AWS OIDC action) over stored keys. Named (explicit) providers ignore aws:profile config; set the profile on the provider itself.

Context: Pulumi's AWS provider does not have its own credential store. It resolves credentials through the standard AWS chain: environment variables, the shared config and credentials files, SSO, and instance/container roles, in that order. A credentials error at pulumi up or preview time (messages like No valid credential sources found, Invalid credentials configured, or Failed to refresh cached SSO credentials) means that chain found nothing usable, found an expired session, or found a profile the provider was not told to use.