Pulumi Environment Variables

export PULUMI_ACCESS_TOKEN=pul-xxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Pulumi Cloud (default)
export PULUMI_BACKEND_URL=https://api.pulumi.com

# Self-hosted Pulumi Cloud
export PULUMI_BACKEND_URL=https://pulumi.mycompany.com

# S3 backend
export PULUMI_BACKEND_URL=s3://my-bucket

# Azure Blob backend
export PULUMI_BACKEND_URL=azblob://my-container

# GCS backend
export PULUMI_BACKEND_URL=gs://my-bucket

# Local filesystem
export PULUMI_BACKEND_URL=file://~/.pulumi-state

export PULUMI_STACK=dev

# Now these are equivalent:
pulumi up --stack dev
pulumi up

export PULUMI_CONFIG_PASSPHRASE=my-secret-passphrase

export PULUMI_CONFIG_PASSPHRASE_FILE=/path/to/passphrase-file

export PULUMI_CI=true

export PULUMI_SKIP_UPDATE_CHECK=true

export PULUMI_SKIP_CONFIRMATIONS=true

# Limit to 10 concurrent operations
export PULUMI_PARALLEL=10

# Unlimited (default)
export PULUMI_PARALLEL=0

# Sequential (for debugging)
export PULUMI_PARALLEL=1

export PULUMI_EXPERIMENTAL=true

export PULUMI_DEBUG_COMMANDS=true

export PULUMI_DEBUG_GRPC=/path/to/grpc-log

# Error only
export PULUMI_LOG_LEVEL=error

# Warnings and errors
export PULUMI_LOG_LEVEL=warning

# Info level (default)
export PULUMI_LOG_LEVEL=info

# Debug level
export PULUMI_LOG_LEVEL=debug

export PULUMI_DEBUG_PROVIDERS=aws,kubernetes

export PULUMI_ENABLE_LEGACY_DIFF=true

export PULUMI_SKIP_PROVIDER_INSTALL=true

export PULUMI_PLUGIN_PATH=/custom/plugin/path

export PULUMI_PREFER_YARN=true

# Standard AWS credentials
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...  # For temporary credentials
export AWS_REGION=us-west-2
export AWS_DEFAULT_REGION=us-west-2

# AWS profile
export AWS_PROFILE=my-profile

# Service principal authentication
export ARM_CLIENT_ID=...
export ARM_CLIENT_SECRET=...
export ARM_TENANT_ID=...
export ARM_SUBSCRIPTION_ID=...

# Managed identity
export ARM_USE_MSI=true
export ARM_MSI_ENDPOINT=...

# Service account key file
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

# Project and region
export GOOGLE_PROJECT=my-project
export GOOGLE_REGION=us-central1
export GOOGLE_ZONE=us-central1-a

# Kubeconfig location
export KUBECONFIG=/path/to/kubeconfig

# In-cluster configuration
export KUBERNETES_SERVICE_HOST=...
export KUBERNETES_SERVICE_PORT=...

name: Pulumi
on: push

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pulumi/actions@v5
        with:
          command: up
          stack-name: prod
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: us-west-2

deploy:
  image: pulumi/pulumi:latest
  variables:
    PULUMI_ACCESS_TOKEN: $PULUMI_ACCESS_TOKEN
    PULUMI_STACK: prod
    PULUMI_CI: "true"
    PULUMI_SKIP_UPDATE_CHECK: "true"
  script:
    - pulumi login
    - pulumi stack select $PULUMI_STACK
    - pulumi up --yes

pipeline {
    agent any
    environment {
        PULUMI_ACCESS_TOKEN = credentials('pulumi-token')
        AWS_ACCESS_KEY_ID = credentials('aws-access-key')
        AWS_SECRET_ACCESS_KEY = credentials('aws-secret-key')
        PULUMI_CI = 'true'
        PULUMI_SKIP_UPDATE_CHECK = 'true'
    }
    stages {
        stage('Deploy') {
            steps {
                sh 'pulumi login'
                sh 'pulumi stack select prod'
                sh 'pulumi up --yes'
            }
        }
    }
}

version: 2.1

orbs:
  pulumi: pulumi/pulumi@2.1.0

jobs:
  deploy:
    docker:
      - image: pulumi/pulumi:latest
    environment:
      PULUMI_CI: "true"
      PULUMI_SKIP_UPDATE_CHECK: "true"
    steps:
      - checkout
      - run:
          name: Deploy
          command: |
            pulumi login
            pulumi stack select prod
            pulumi up --yes

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  - name: PULUMI_CI
    value: 'true'
  - name: PULUMI_SKIP_UPDATE_CHECK
    value: 'true'

steps:
  - task: Pulumi@1
    inputs:
      command: 'up'
      stack: 'prod'
      args: '--yes'
    env:
      PULUMI_ACCESS_TOKEN: $(PULUMI_ACCESS_TOKEN)

import * as automation from "@pulumi/pulumi/automation";

const stack = await automation.LocalWorkspace.createOrSelectStack({
    stackName: "dev",
    projectName: "my-project",
    program: async () => { /* ... */ },
}, {
    envVars: {
        AWS_REGION: "us-west-2",
        PULUMI_CONFIG_PASSPHRASE: process.env.PASSPHRASE,
    },
});

# Authentication
export PULUMI_ACCESS_TOKEN=pul-xxx

# Automation behavior
export PULUMI_CI=true
export PULUMI_SKIP_UPDATE_CHECK=true

# Optional: secrets passphrase (if not using cloud KMS)
export PULUMI_CONFIG_PASSPHRASE=xxx

# Optional: performance tuning
export PULUMI_PARALLEL=10

# Cloud provider credentials (choose one)
# AWS
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
export AWS_REGION=us-west-2

# OR use OIDC via Pulumi ESC (recommended)
# ESC environments inject credentials automatically