Pulumi CLI Adds Direct Cloud OIDC Setup to Streamline Agentic and Non-Interactive Authentication

Pulumi has introduced native OpenID Connect (OIDC) cloud onboarding directly inside the Pulumi CLI with the release of the `pulumi env setup` command. Pulumi ESC (Environments, Secrets, and Configuration) serves as an OIDC provider, allowing AWS, Azure, and Google Cloud to issue short-lived, cryptographically signed credentials without storing static access keys. While this configuration flow was previously confined to guided wizards within the Pulumi Cloud web console, the new functionality embeds interactive prompts and headless, non-interactive flags directly into the CLI. For platform and security teams, shifting authentication initialization into the CLI removes a persistent friction point in cloud enablement. Static, long-lived API tokens remain one of the leading vectors for cloud security posture regressions and credential leaks. By automating the OIDC exchange pattern natively through the command-line interface, platform teams can establish identity federation with AWS, Azure, and GCP without forcing developers or automation scripts into manual browser interactions. This update reflects a wider industry pivot toward agent-native infrastructure engineering and least-privilege automation. As organizations deploy AI coding assistants, autonomous platform agents like Pulumi Neo, and ephemeral CI runners, manual web console configuration creates severe operational bottlenecks. Infrastructure-as-code tooling must provide complete headless self-service, allowing both human operators and automated agents to establish zero-trust identity baselines programmatically. In practice, engineering teams should evaluate their initial account bootstrapping workflows and replace remaining static credential provisioning with `pulumi env setup`. Because the command supports non-interactive execution with target-specific cloud flags, it can be integrated into provisioning scripts, developer setup runbooks, and automated agent environments. Teams should ensure their organization's Pulumi Cloud access tokens and trust policies are updated to govern these automated OIDC exchanges appropriately.