This message was deleted.

Does the following work with your profile?

aws --profile my-profile sts get-caller-identity

$ aws --profile my-profile sts get-caller-identity
{   
    "UserId": "XXXXXXXXXXXXXXXX:botocore-session-1234567890",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/my-profile-role/botocore-session-1234567890"
}

yeah, returns what you'd expect, yet pulumi preview/up throws the 403 error

How are you managing your Pulumi state? self-hosted or the Pulumi service?

in a cloud storage bucket(using pulumi for GCP for over a year and now venturing into AWS)

Sorry, your state backend for this AWS deployment is managed in GCP or is it in AWS as well?

s3 for AWS 🙂

pulumi login <s3://my-pulumi-bucket?profile=my-profile>

this is the login cmd and it works fine

Okay, that's the question I was leading towards, whether your pulumi bucket was declared in in the backend of your

Pulumi.yaml

theres no issue with the login cmd, can do stack select etc after it. It's purely with up/preview/destroy not asuming the role

Alright

no MFA on this, all profiles are like so:

[profile my-profile]
source_profile=default
role_arn = arn:aws:iam::123456789012:role/my-profile-role
output = json
region = ap-northeast-1

That looks okay. You could try specifying an explicit provider if you aren't already, and passing that in the opts of your resource declarations.

I've set AWS_REGION in the env as sts complained without it. Just find it odd that with boto/aws cli the way my config/credentials are setup work without issue, and for pulumi to use them I have to run the assume-role/export cmd above (so its not really using them, I'm forcing it around them)

If you're using the latest MAJOR AWS provider, you should be aware that there was a breaking change in the underlying terraform provider. You cannot expect environment variables to override profile values like you could in the previous version.

Thanks for the info. Ideally I'd like to not have to set env vars but when I add these values to the pulumi config yaml I get the same false error. The only way I've gotten pulumi to work is by exporting the results from the sts cmd as env vars