Pulumi Brings CLI-Native OIDC Onboarding to Kill Static Cloud Secrets

Pulumi has introduced the `pulumi env setup` command in the latest Pulumi CLI, allowing engineers and automation pipelines to configure OpenID Connect (OIDC) integration directly from the terminal. Previously available only through the Pulumi Cloud web console, this workflow automates the creation of trust policies and identity providers across AWS, Azure, and Google Cloud. The command provides interactive prompts for human engineers as well as non-interactive flags designed for autonomous scripts and AI agents, automatically configuring Pulumi ESC (Environments, Secrets, and Configuration) environments to generate short-lived, signed tokens for cloud access. Eliminating static, long-lived credentials like IAM access keys and service account JSON secrets is an essential baseline for modern infrastructure security. However, setting up the necessary identity federation infrastructure—such as Workload Identity Pools in GCP, OIDC identity providers in AWS IAM, or federated credentials in Microsoft Entra ID—is notorious for friction. Because the initial onboarding historically required manual console navigation or custom bootstrapping scripts, teams often delayed adopting short-lived credentials. Bringing OIDC configuration natively into the CLI makes credential-less workflows the path of least resistance for both human operators and programmatic agents. This release reflects two converging macro trends across platform engineering: the universal shift toward federated, ephemeral machine identities and the rise of autonomous coding agents. As organizations deploy AI agents to manage and modify infrastructure, requiring human intervention via web consoles creates severe operational bottlenecks. Modern infrastructure tools must expose complete, scriptable control planes via CLI and API interfaces. By making identity exchange establishment purely non-interactive, Pulumi aligns with zero-trust architecture standards while simultaneously ensuring that agentic workflows operate within secure, temporary credential boundaries. In practice, DevOps teams should immediately audit their onboarding flows and replace static credential provisioning with `pulumi env setup` in their provisioning repositories. When implementing non-interactive setup across multi-account cloud environments, engineers should enforce least-privilege role bindings by passing explicit role ARN or policy parameters rather than falling back on broad administrative defaults. While this command dramatically reduces initial federation overhead, security practitioners must continue to monitor and audit the lifecycle of the underlying IAM trust relationships created in their cloud tenancies.