Hi, I'm setting up OIDC. In which AWS account do I set up the provider ? e.g. I have multiple accounts, such as $project-$env i.e. project1-develop, project1-staging, etc. These are usually managed centrally by controltower/aws identity center. Do I set up the identity provider in each account? or the central account?

I believe you need to configure the identity provider in each account. Have you taken a look at our docs on this? • blog • AWS OIDC docs • python example

Thanks Evan, yes I was following that guide. When it got to the part about adding the provider in AWS IAM, that's when I became unsure. I'll do it once per account

Great, let me know if you hit any roadblocks. I'm curious, what drew you to ESC and what are you hoping to use it for?

The two main things were • The inconvenience of having to paste my aws temporary credentials in my

~/.aws/credentials

file daily. And sharing account access between colleagues. • Also, the issue of safely and securely granting pulumi access to the account in CI/CD. I don't like creating a service IAM account and creating a long-lived secret key. I'm hoping that using ESC, I can use Pulumi in CI/CD with temporary credentials. As a side benefit, I'm hoping to use ESC with the 'esc run' feature to quickly switch between environments, and avoid needing to save multiple credentials for multiple AWS accounts on my workstation. but still getting my head around how to do that.

ESC does integrate with pulumi teams and the rest of the RBAC model, that should help here.