As I understand it (noting that I’ve used Pulumi for about 48 hours) if you don’t pass it like that, it’ll default to your machine credentials in ~/.aws or similar relative to whatever provider you’re deploying to

You are right about this