I recommend trying named profiles. Put config like this in

~/.aws/config

(This is from the article)

[profile personal-management]
sso_start_url = <https://lbrlabs.awsapps.com/start>
sso_region = us-west-2
sso_account_id = <account-id>
sso_role_name = AWSAdministratorAccess
region = us-west-2
output = json

You can put multiple profiles in your AWS config file, and then select them with

AWS_PROFILE=

. You can also set that profile in your stack config. For configuring the provider, see: https://www.pulumi.com/registry/packages/aws/installation-configuration/#set-up-multiple-profiles

And you definitely only want to get short-lived access keys via

aws sso login

because you probably need full admin, and if those credentials leak somehow (like committing them to git by accident), that's really bad.