Good morning, I am running into a weird issue with which I hope someone here can help me: When attempting to run a Github Action across 2 AWS accounts, I get an access denied on opening the S3 cloud_url. We have a centralised build account that deploys resources into 2 other AWS accounts: production and non-production. The Github Runners are deployed in the build account using ARC, and leverage OIDC to get an STS token attached to an IAM role. When running the Pulumi preview action, it fails to access the S3 bucket in the non-production account. The worklow runs as a container on EKS in the build account, and the runner has the necessary permissions to access the S3 bucket in the non-production account. We are using OIDC to get an STS token attached to an IAM role. Then we assume a role in the non-production account. Access to S3 using this method was tested outside of the Pulumi action and works as expected, we can download the meta.yaml file from the S3 bucket in the other account. This works fine when running this action within the build account, but fails when running in the other account. The exact error message we get is:

`
sink.go:178] defaultSink::Error(error: problem logging in: read ".pulumi/meta.yaml": blob (key ".pulumi/meta.yaml") (code=Unknown): AccessDenied: Access Denied
    status code: 403, request id: <OBFUSCATED>, host id: <OBFUSCATED>)

Pulumi configs tried: -

aws:region

set to the region of the non-production account -

aws:assumeRole

set to the ARN of the role in the non-production account -

aws:profile

set to the name of the profile in the build account that has the necessary permissions, including exporting AWS_DEFAULT_PROFILE to the profile name used - combinations of the above None of these have worked as expected. Am I doing something wrong, or is this scenario not supported?

Hi, I am trying to get the kubernetes provider to render yaml using `const provider = new k8s.Provider("render-yaml", { renderYamlToDirectory:

rendered

});` Naturally, this works on my machine but I cannot get it to create the files on other machines or the CI environment using the same plugin versions (pulumi v3.131.0 and kubernetes 4.15.0). The only difference I can spot is that locally

pulumi preview

prints the additional line with

rendered file ..

which is not printed on the other environments.

kubernetes:apps/v1:Deployment (backend-api):
    warning: rendered YAML will contain a secret value in plaintext
    warning: rendered YAML will contain a secret value in plaintext
    warning: rendered file /home/work/..../1-manifest/apps_v1-deployment-.....yaml contains a secret value in plaintext

I tried looking at the provider code and

rendered file

is printed in

Create()

and

Update()

methods so my only guess is that for some reason these are not invoked. Setting

PULUMI_K8S_ENABLE_SERVER_SIDE_APPLY=false

does not create the yaml files locally but setting it to true on the other environments does not help.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.

This message was deleted.