This message was deleted.

sparse-intern-71089

11/01/2021, 7:35 PM

This message was deleted.

little-cartoon-10569

11/01/2021, 7:45 PM

Don't use the root user. Especially not for Pulumi.

little-cartoon-10569

11/01/2021, 7:45 PM

The root user should be used for recovering after a disaster, like losing the credentials of an admin user. And pretty much nothing else.

sparse-tomato-5980

11/01/2021, 7:46 PM

Yep, this is certainly not for production 🙂

little-cartoon-10569

11/01/2021, 7:46 PM

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html

little-cartoon-10569

11/01/2021, 7:46 PM

Important

We strongly recommend that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. To view the tasks that require you to sign in as the root user, see AWS Tasks That Require Root User. For a tutorial on how to set up an administrator for daily use, see Creating your first IAM admin user and user group.

✅ 1

worried-city-86458

11/01/2021, 8:14 PM

Ideally, create an iam role - with the required perms - and assume the role, which can be passed as a parameter to the aws provider.

little-cartoon-10569

11/01/2021, 8:38 PM

Root user doesn't generally assume roles. I've never even tried.. why assume role as a root user, I can already do everything?

little-cartoon-10569

11/01/2021, 8:38 PM

It's the restricted IAM user that needs to assume roles. And should.

little-cartoon-10569

11/01/2021, 8:39 PM

Your (Pulumi's) AWS profile / env vars shouldn't be the root creds.

worried-city-86458

11/01/2021, 9:29 PM

Oh I don't mean to use the root user at all. Create another user and an iam role that the user should assume.

brave-nightfall-19158

11/02/2021, 8:45 AM

@sparse-tomato-5980 you used to be able to create access keys for the root user but I don't know if you still can. It used to be in a separate section to IAM, I think in root account settings in the dropdown in the top right. If you could, you don't need to add any IAM roles / policies as the root user has access to everything anyway.

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.