Pulumi Adds Native CLI Support for Setting Up Cloud OIDC Authentication

Pulumi announced the introduction of `pulumi env setup`, a new CLI command enabling practitioners to configure OpenID Connect (OIDC) integration directly from the terminal for AWS, Azure, and Google Cloud. Operating in tandem with Pulumi ESC (Environments, Secrets, and Configuration) as an OIDC provider, the feature allows clouds to issue short-lived, cryptographically signed tokens exchanged for ephemeral cloud credentials. The command offers interactive prompts for guided setup and non-interactive flags designed for unattended automation and scripting. Securing infrastructure pipelines against secret leakage remains an enduring operational priority. Traditional continuous integration and automation pipelines have historically depended on static access tokens or service account keys stored in configuration repositories. Moving to OIDC-based federation drastically reduces credential exposure, but initial trust relationship provisioning often creates operational drag when forced through graphical consoles. Bringing OIDC bootstrap flows to the CLI shortens this initial friction point for engineering teams rolling out federated credentials. This update aligns with a wider industry shift away from long-lived cloud credentials toward ephemeral, identity-based trust relationships across multi-cloud environments. As infrastructure management increasingly incorporates autonomous agents, scriptable and repeatable authentication bootstrapping has become essential. Modern developer platforms must offer fully headless, deterministic setup paths that allow tools and agents to operate without human intervention in web consoles, ensuring that modern security baselines do not impede developer velocity. In practice, DevOps teams can immediately update their Pulumi CLI installations and replace manual console-based OIDC steps with standard `pulumi env setup` routines across their repositories. Platform engineers should incorporate non-interactive command flags into automated environment provisioning scripts and CI/CD pipelines to ensure consistent identity federation across multi-account deployments. Teams currently managing static keys for cloud access should treat this capability as an opportunity to audit and retire long-lived secrets across their environments.