Hi, Is there any way of adding the project name as a prefix for pulumi resource names? This will be useful to easily identify from the AWS console what project pertains to some resource.

Hi, I'm wondering how others handle the issue of checking Pulumi configs with encrypted secrets into Git (and a GitHub private repo). Do most people take the position that because they're properly encrypted, it's perfectly safe? Or is there some way of keeping secrets out of Git, like is there a way they can be stored only remotely in The Pulumi Service or something else? Thanks in advance!

Newest pulumi is much quicker in building preview and running! Thanks for the improvements.

This is ad umb question but what is the advantage of AWS Native vs the regular AWS libs?

Hey everyone, I have a weird issue & wondering if anyone has come across the same • I have an elasticache redis instance, created via pulumi • Recently upgraded the instance size type via pulumi, and that went fine • At some point I enabled logs on the elastiCache instance, but via AWS GUI not Pulumi • But this caused our pulumi deployments to fail , so I disabled the logs via AWS GUI • After all this, when I try to deploy to pulumi it still fails because of this log issue, error: ◦ Error updating ElastiCache cluster (prod-main), error: InvalidParameterValue: To modify the log delivery configuration, set the apply-immediately parameter to *. ◦ Note my pulumi config has "logDeliveryConfigurations": [] so not clear why the error is happening if logs disabled • But oddly enough, if I retry this same deployment the 2nd time (shortly after the failed deployment), it works and does not generate this error ◦ Issue still remains though -- by tomorrow if I run a new deployment, it will fail due to above error, I'll use my workaround of just rerunning the deployment and it works. But this initial failure I cannot seem to figure out - anyone ran into this issue before ?

In Pulumi.yaml, is it possible to use an environment variable?

🎉* Zscaler Internet Access Pulumi Provider - Initial Release* 🎉 Hey Folks, I am happy to announce that we have published in the registry our second Pulumi Provider for Zscaler Internet Access. If you are a Zscaler customer, and is looking to automate your Zero Trust infrastructure using a Pulumi’s multi language IaC tool, visit our GitHub repository for detailed examples and instructions on how to get started. Feel free to also visit our Zenith Community to follow all the articles and videos on DevOps/DevSecOps. Feel free to reach out.

Hi Everyone. Quick question regarding the aws:allowedAccountIds config setting - I've noticed that even with using this setting, there are cases where I've accidentally connected to the wrong AWS account, which has caused all sorts of issues where the stack then references resources in two different accounts. From there, I get a bunch of access denied errors, which makes sense because I'm connected to one AWS account but referencing another. Am I missing something here? What I was hoping for is that pulumi would stop in it's tracks as soon as it finds that it is referencing a non-approved account. Is there a better setting to use to achieve this? Does

forbiddenAccountIds

work any differently?

PULUMI_API='-' PULUMI_CONSOLE_DOMAIN='-' pulumi whoami -v

hangs for ~15s using local state, on a host not connected to the Internet, backtrace in reply

Hi everyone, I’m a rookie in the field of IaC and pulumi and I already like it. The pulumi docs is awesome. But there is a question: I want to create a new GCP bucket with the storage class

Nearline

and enabled data object protection with this config as shown in the images. How can I implement that? My code:

import * as gcp from "@pulumi/gcp";

// Create a GCP resource (Storage Bucket)
const bucket = new gcp.storage.Bucket("name", {
  location: "US",
  name: "name",
  storageClass: "NEARLINE",
  uniformBucketLevelAccess: true,
});

// Export the DNS name of the bucket
export const bucketName = bucket.url;

Hello, Is there any idea to improve the TS intelligence for Pulumi? The type file is too big, so all the IDE got issues with it.

pulumi stack rename

seems kinda busted for me for a stack in an organization. First, there's a simple bug in the error message if I put the wrong organization name in the new-stack-name - it reverses the "new stack owner" and "existing owner" fields. But if include the correct owner in the new name, it tells me I don't have permission [403], which is bizarre considering the web shows me as the "Stack Creator" with "Stack admin access".

Hello! I'm trying to clean up a few stack that I have completely botched...

pulumi destroy

takes its time and eventually returns

Retrieving Application with object ID "...": Application was not found

.

pulumi stack rm ...

returns

error: '...' still has resources; removal rejected. Possible actions: ...

Overriding with --force works just fine to get this stack out of my records... But as I understand it the resources themselves will linger on and incur costs? What other way could I go about deleting these stacks and associated resources completely? Thanks!

Hi, I'm trying to create a transformation that sets 2 tags on all resources, one with the stack name and the other with the project name. It should keep existing tags. I have this code but not really sure how to continue:

pulumi.runtime.registerStackTransformation((args) => {
  return {
    args: {tags: }
  }
});

Am I trying to do something that is not possible?

when runnning

pulumi about

i get the following error:

warning: Failed to get information about the Pulumi program's dependencies: failed to get modules: exit status 1

with -v=7 i can see i get:

I0210 11:56:35.288506 1326938 langruntime_plugin.go:348] langhost[go].GetProgramDependencies(proj=aws-cluster-0-stage,pwd=/home/hans/work/fiveteninfra/provider/aws/live/stage/aws-cluster-0-stage,program=.,transitiveDependencies=false) failed: err=failed to get modules: exit status 1

I think its this call that fails:

c.cc.Invoke(ctx, "/pulumirpc.LanguageRuntime/GetProgramDependencies", in, out, opts...)

which uses RPC I think, am I lacking some requirements ?

[Solved] I’m trying to use Pulumi Automation API using NodeJS, but I can’t get past the following problem; namely when I run the automation part I get the error below. The “automation” script is more or less an exact copy of this https://github.com/pulumi/automation-api-examples/blob/main/nodejs/localProgram-tsnode/automation/index.ts For some reason Automation API fails to find pulumi executable (or that’s how I interpret this error). Running,

pulumi version --non-interactive

by hand works just fine. I got python based examples work, so it seems that the issue is somehow related to nodejs. Running macos.

./node_modules/ts-node/dist/bin.js index.ts

❯ ./node_modules/ts-node/dist/bin.js index.ts
CommandError: code: -2
 stdout:
 stderr: Command failed with ENOENT: pulumi version --non-interactive
spawn /bin/sh ENOENT
 err?: Error: Command failed with ENOENT: pulumi version --non-interactive
spawn /bin/sh ENOENT

    at Object.createCommandError (/Users/massive/code/provisioner/provisioner/node_modules/@pulumi/automation/errors.ts:75:27)
    at Object.<anonymous> (/Users/massive/code/provisioner/provisioner/node_modules/@pulumi/automation/cmd.ts:79:15)
    at Generator.throw (<anonymous>)
    at rejected (/Users/massive/code/provisioner/provisioner/node_modules/@pulumi/pulumi/automation/cmd.js:19:65)
    at processTicksAndRejections (node:internal/process/task_queues:95:5) {
  commandResult: CommandResult {
    stdout: '',
    stderr: 'Command failed with ENOENT: pulumi version --non-interactive\n' +
      'spawn /bin/sh ENOENT',
    code: -2,
    err: Error: Command failed with ENOENT: pulumi version --non-interactive
    spawn /bin/sh ENOENT
        at Process.ChildProcess._handle.onexit (node:internal/child_process:283:19)
        at onErrorNT (node:internal/child_process:476:16)
        at processTicksAndRejections (node:internal/process/task_queues:82:21) {
      errno: -2,
      code: 'ENOENT',
      syscall: 'spawn /bin/sh',
      path: '/bin/sh',
      spawnargs: [Array],
      originalMessage: 'spawn /bin/sh ENOENT',
      shortMessage: 'Command failed with ENOENT: pulumi version --non-interactive\n' +
        'spawn /bin/sh ENOENT',
      command: 'pulumi version --non-interactive',
      escapedCommand: 'pulumi version --non-interactive',
      exitCode: undefined,
      signal: undefined,
      signalDescription: undefined,
      stdout: '',
      stderr: '',
      failed: true,
      timedOut: false,
      isCanceled: false,
      killed: false
    }
  }
}

Hi guys, where I can find a complete sample of EKS cluster ? (With coredns, loadbalancer controlle…)

Hi, due to some API limitations, we might need to expose something in plain text in the pulumi runtime. whats the best way, if any, to hide a resource? it will probably be

pulumi local.Command

specifically so it doesnt show in the pulumi logs

We recently ran into issues with Pulumi creating and tracking two resources in the state with the same URN. Took a lot of work to manually clean up as it stopped letting us deploy new changes or tear down the entire environment. Seems like it's possible to create two resources with the same URN (by accident), but I'm assuming this is not normal behavior?

This happened after we accidently called pulumi on an environment that had a bucket created via aws.s3.BucketV2 (TypeScript) but used aws.s3.Bucket in the script, with the same bucket name defined.

Created two buckets with the same URN (but different ids), and also caused a number of other resources to create resources with dupe URNs. Not sure if the Bucket switch back to aws.s3.Bucket is the root cause, but that's the thing that stands out.

Hello everyone, there's something i must be missing: i have a snowflake password for the pulumi user in my config (with config set --secret) and I had to change it on the DB, so changed it with pulumi config set as well. When running pulumi, the password used is the old one, so of course all the operations fail. Using -v5 I can clearly see the password used by the TF provider is the old one. What am I doing wrong? Or, more to the point: why is pulumi using the old configuration and not the local, updated one?

Ola, have i missed it in the cli help or is there not a way for the pulumi up output to auto scroll or keep active tasks on screen so i can see what its actively running without scrolling more with the arrow keys?

Is there a flag for pulumi CLI to make the output more readable in CI? Looks great for manual exec, but the resource updates each generate a new line in logs when all I need is the summary?

Is it safe to have multiple overlapping

pulumi up

or

pulumi down

commands running in the same directory if they're on different stacks? I thought/hoped so, but then I think I saw it get confused once.

Is there a way to get/view update logs and preview logs with Pulumi CLI? With Git, for instance, I can use something like

git show 0551a51

to see information about commit ``0551a51` , or

git log

to see the list of commits. Is there something similar for Pulumi CLI?

Is there a general way to suppress pulumi's

[secret]

hiding technique on an Output that is marked as a secret, temporarily, while running a preview/update with a diff?

Hi all, I'm working on an inline program using the Automation API. When

await LocalWorkspace.createOrSelectStack

is called, I'm having the same error as this one from earlier, however I'm using InlineProgramArgs. Any advice is appreciated!

import * as aws from "@pulumi/aws";

const cachingOptimizedPolicy = aws.cloudfront.getCachePolicyOutput({
  name: "Managed-CachingOptimized",
});

const distribution = new aws.cloudfront.Distribution("distribution", {
  orderedCacheBehaviors: [
    {
      cachePolicyId: cachingOptimizedPolicy.id,
      ...
    }
  ],
  ...
});

This code has a type error.

cachingOptimizedPolicy.id

is of type

Output<string | undefined>

but

cachePolicyId

expects something of type

string

. I had a similar code with Terraform but didn't have any issue.