The Pulumi Cloud access token serves as the primary authentication mechanism for users and automated systems to interact with the Pulumi Cloud ecosystem. These tokens are critical for establishing identity and authorization, whether a developer is performing a manual deployment via the Command Line Interface (CLI) or an automated CI/CD pipeline is executing infrastructure changes via a REST API. By utilizing these tokens, the Pulumi Cloud can verify the identity of the requester and apply the corresponding permissions associated with that identity, ensuring that infrastructure state and configurations are modified only by authorized entities.
The utility of these tokens extends beyond simple authentication. The token utilized for the pulumi login command simultaneously authorizes the pulumi api command. This integration allows users to call any REST API endpoint directly from the CLI. The internal mechanism handles the Authorization header automatically, removing the requirement for the user to manually construct and inject these headers into every API request. This streamlined approach reduces the complexity of interacting with the Pulumi Cloud's backend services and minimizes the potential for manual configuration errors during API calls.
Taxonomy of Pulumi Access Tokens
Pulumi provides three distinct types of access tokens, each designed for specific use cases and security contexts. The choice of token determines how actions are attributed in audit logs and what level of permission is granted to the bearer.
Personal tokens
These tokens carry the specific permissions of the individual user who created them. They are the most common token type and are available to all Pulumi Cloud users regardless of their account tier. When a personal token is used, every action taken is attributed directly to that specific individual. This creates a clear audit trail for individual developer activities.Organization tokens
Organization tokens authenticate as the organization entity itself rather than any specific individual user. This is particularly useful for centralized automation where attributing a change to a single person would be inaccurate. Actions performed using an organization token are recorded in the audit logs as being attributed to the organization. It is important to note that organization tokens are restricted to customers on the Enterprise and Business Critical tiers.Team tokens
Team tokens authenticate as a specific team within a larger organization. Like organization tokens, these remove the focus from the individual user and instead attribute actions to the team identity. This allows for granular permission sets that are shared across a group of developers. In the audit logs, actions taken with these tokens are attributed to the team, facilitating better team-level accountability and resource management.
Token Acquisition and Manual Generation
Generating a Pulumi Access Token involves a specific workflow within the Pulumi Console to ensure that the token is created with the correct identity and permissions.
The manual generation process follows these steps:
- Log in to the Pulumi console.
- Click on the user avatar in the top right corner and select "Account Settings".
- In the Account Settings page, navigate to the "Access Tokens" tab.
- Click on the "Create Token" button.
- Enter a name for the token and select the desired permissions.
- Click on the "Create" button to generate the Access Token.
Once these steps are completed, the token is generated and presented to the user. This token can then be integrated into Pulumi applications to authenticate and access resources securely. The ability to name the token and select specific permissions allows developers to implement a more controlled security posture, ensuring the token does not have more power than it requires for its intended task.
Automated Token Exchange via GitHub Actions
For organizations utilizing GitHub for their CI/CD pipelines, Pulumi offers GitHub Auth Actions. This system eliminates the need to hardcode long-lived credentials in repositories, which is a significant security vulnerability. The action automatically generates and exchanges GitHub's OpenID Connect (OIDC) tokens for Pulumi Access Tokens, making them available for the duration of the workflow.
The following configuration demonstrates how to implement this in a GitHub Actions workflow:
yaml
name: Pulumi
on:
push:
branches:
- master
permissions:
id-token: write
contents: read
jobs:
up:
name: Preview
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pulumi/auth-actions@v2
with:
organization: contoso
requested-token-type: urn:pulumi:token-type:access_token:organization
- uses: pulumi/actions@v5
with:
command: preview
stack-name: org-name/stack-name
This configuration initiates a process where the runner checks out the existing directory and then fetches a Pulumi access token specifically for the contoso organization. Once the token is acquired, the pulumi preview command is executed. For this mechanism to function, the GitHub action requires specific permissions, particularly the id-token: write permission, to request the necessary identity token from GitHub.
The pulumi/auth-actions can be configured using several key arguments:
organization
The specific organization for which the token is being exchanged.requested-token-type
The type of token to be requested. The valid options are:urn:pulumi:token-type:access_token:organizationurn:pulumi:token-type:access_token:teamurn:pulumi:token-type:access_token:personalscope
An optional argument to specify the scope for the token request. This depends on the token type:- For personal access tokens:
user:USER_NAME For team access tokens:
team:TEAM_NAMEtoken-expiration
An optional argument that defines the requested expiration time for the token, measured in seconds.
Infrastructure as Code: Creating Access Tokens
Pulumi provides a service provider that allows the management of Access Tokens as resources. This allows for the programmatic creation and lifecycle management of tokens using various programming languages. This provider was published on Thursday, June 25, 2026, and is currently in preview.
The pulumiservice:AccessToken resource allows users to define tokens within their code. The primary input property for this resource is the description, which provides a string-based explanation of the token's purpose.
The following table outlines the resource parameters:
| Parameter | Type | Description |
|---|---|---|
| name | String | The unique name of the resource. |
| args | AccessTokenArgs | The arguments to resource properties. |
| options | CustomResourceOptions | Bag of options to control resource's behavior. |
Depending on the language used, the constructor syntax varies. Below are the implementations for various languages.
TypeScript implementation:
typescript
const accessTokenResource = new pulumiservice.AccessToken("accessTokenResource", {description: "string"});
JavaScript implementation:
javascript
var accessTokenResource = new AccessToken("accessTokenResource", AccessTokenArgs.builder()
.description("string")
.build());
Go implementation:
go
example, err := pulumiservice.NewAccessToken(ctx, "accessTokenResource", &pulumiservice.AccessTokenArgs{
Description: pulumi.String("string"),
})
Terraform implementation:
hcl
resource "pulumiservice_accesstoken" "accessTokenResource" {
replace_on_changes = ["description"]
description = "string"
}
Python implementation:
python
access_token_resource = pulumiservice.AccessToken("accessTokenResource", description="string")
Security Vulnerabilities and Token Leakage
The leakage of a Pulumi Access Token poses a significant risk to the security of an organization's infrastructure and sensitive data. Because these tokens grant access to the Pulumi Cloud, an attacker possessing a token could potentially modify infrastructure, access state files, or disrupt services.
Common causes of token leakage include:
Accidental inclusion in code repositories
Developers may inadvertently commit code that contains hardcoded Pulumi Access Tokens to public repositories. This makes the tokens instantly accessible to unauthorized individuals who scan public code.Improper storage
Storing tokens in plaintext files or other insecure local directories increases the risk of exposure. If a local machine is compromised or a backup file is leaked, the token is easily retrieved.Sharing credentials
Passing tokens to other team members via insecure channels, such as email or instant messaging, without proper security measures can lead to unauthorized access and subsequent leakage.Phishing attacks
Attackers may use social engineering to trick developers into revealing their tokens through fraudulent emails or websites.
Remediation and Security Best Practices
To mitigate the risks associated with Pulumi Access Tokens, developers and organizations must implement a multi-layered security strategy. This strategy focuses on preventing leaks, limiting the impact of leaks, and detecting unauthorized usage.
Prevention and Secure Storage:
Use environment variables or secrets managers
Tokens should never be hardcoded in source code. Instead, utilize environment variables or dedicated secrets management tools such as CyberArk, AWS Secrets Manager, or HashiCorp Vault.Secure storage
Store tokens in password managers or professional secrets management services that provide encryption and access control.Regular rotation
Periodically rotate API keys and tokens. This limits the window of opportunity for an attacker if a token has been leaked without the organization's knowledge.Restrict permissions
Follow the principle of least privilege. Only grant the token the minimum permissions necessary for its specific function. This ensures that even if a token is compromised, the attacker's reach is limited.Implement access controls
Limit the number of individuals who have access to the secret and enforce strong authentication measures to access those secrets.
Detection and Response:
If a token is suspected of being leaked, the following steps should be taken to determine if malicious actors have used it:
Review Access Logs
Check the account's access logs for unauthorized activity. Focus on requests from unfamiliar IP addresses or access occurring at unusual hours.Monitor Usage Patterns
Analyze usage logs for anomalies, such as unexpected spikes in data transfer or access to resources that are not typically utilized.Check Active Connections and Operations
Review recent operations on the database and active connections to identify unauthorized changes.
Conclusion
The Pulumi Cloud access token is a foundational element of the Pulumi ecosystem, bridging the gap between user identity and infrastructure management. Through the provision of personal, organization, and team tokens, Pulumi allows for flexible authentication that scales from individual developers to massive enterprise organizations. The integration with GitHub Actions via OIDC represents a modern approach to security, removing the reliance on long-lived secrets and reducing the surface area for potential attacks.
However, the power of these tokens necessitates a rigorous security posture. The transition from manual token generation to programmatic creation via the pulumiservice:AccessToken resource allows for better lifecycle management, yet the underlying risk of leakage remains. The tendency to hardcode credentials or store them in plaintext remains a primary vector for security breaches. By adopting the principle of least privilege, utilizing robust secrets management tools like CyberArk or AWS Secrets Manager, and implementing a strict rotation policy, organizations can effectively neutralize the threats associated with token exposure.
Ultimately, the security of a Pulumi deployment is not merely a product of the tools used, but of the operational discipline applied to credential management. Monitoring access logs and analyzing usage patterns are not optional tasks but critical components of a healthy security lifecycle. When combined with the automation provided by Pulumi's auth actions and the granular control of the Pulumi Cloud, access tokens enable a secure, scalable, and auditable approach to modern infrastructure as code.