👋 Hi everyone! Is it possible to have a stack's backend/kms to be on different account than the stack resources'?

Yes. Assuming you mean all AWS: • the backend is configured via backed

pulumi login

, and uses the default AWS profile. • The encryption key is configured via the secrets provider configuration (https://www.pulumi.com/docs/concepts/secrets/#aws-key-management-service-kms); I can't remember if it uses the stack's creds, or the default profile. • Each resource is associated with a single

aws.Provider

instance, which is either the default one (using the default profile) or an explicit one, constructed in the Pulumi program and passed into the resource's constructor.