Pulumi Brings CLI-Driven Cloud OIDC Configuration to Streamline Agentic and CI Workflows

Pulumi announced the introduction of `pulumi env setup`, a new CLI command that enables developers and automated agents to configure OpenID Connect (OIDC) trust relationships across major cloud providers directly from the terminal. The capability extends Pulumi ESC's role as an OIDC identity provider for Amazon Web Services, Microsoft Azure, and Google Cloud, shifting onboarding from a browser-based web console wizard into the command-line interface with support for both interactive prompts and scripted non-interactive execution. Historically, establishing OIDC federated authentication between an orchestration platform and cloud providers required manual navigation through web UI consoles to set up identity trust, configure IAM roles, and download trust parameters. By shifting this capability entirely to the CLI surface, platform engineers and automated systems can bootstrap identity trust without context switching. The addition is particularly consequential for autonomous AI agents and automated ephemeral environments, which cannot rely on human operators clicking through web consoles to establish credentials before executing infrastructure changes. This release reflects a broader shift across the cloud infrastructure and platform engineering landscape toward agent-native infrastructure management and zero-trust credential architectures. Static cloud access keys and long-lived service account tokens have become one of the primary vectors for supply chain attacks and CI/CD security compromises. While the industry has embraced workload identity federation and short-lived tokens via OIDC, onboarding friction has often slowed adoption. Moving administrative setup workflows into scripted CLI commands allows organizations to standardize and enforce ephemeral secret generation as a default practice rather than a manual governance hurdle. In practice, DevOps teams should evaluate their existing cloud bootstrapping and onboarding scripts to replace static credential provisioning with `pulumi env setup` workflows. Because the command supports non-interactive execution via explicit provider flags, platform teams can embed OIDC role generation directly into bootstrap templates and internal developer platforms (IDPs). Security practitioners should ensure that the dynamic token permissions configured through these CLI flows adhere strictly to least-privilege scoping, as the ease of generating automated credentials raises the importance of rigorous downstream policy-as-code controls.