Customer asked me this today: Could I run pulumi completely cut off from the pulumi service by using state on S3 and using pulumi login against that state? I wasn't 100% sure about this, I saw some GitHub issues and PRs that worked on S3 state (although I can't find any documentation on how to configure and log in to S3 state), but I also wasn't sure about the "not using the pulumi service" aspect of this question.

I think that's the idea, but the docs are lacking indeed: https://github.com/pulumi/docs/issues/1279

geez, why am I so bad at searching GitHub?!

definitely can, we only use local state

maybe something for @big-piano-35669 to comment on then.

and just take care to commit the state file changes to a common git repo

@better-rainbow-14549 meaning you're not using the pulumi web UI at all? No need for a project and stack on pulumi?

my point being - if you put and retrieve the files to any other storage it will be fine with no pulumi account / access at all

okay, these guys like the pulumi approach, but are wary of the whole "startup" thing and want to avoid a dependency on a web service that they don't control

ours was more a certification reason but yeah

I think that's my point as well that I want to drive home with them, the service really adds value, but isn't a hard dependency

That's a good way of putting it. Note that you can always start with the service and migrate away from it later on (via `pulumi stack export`/`import`). We definitely believe the service adds value (it's just way easier, in our experience, in addition to the various team, policy, webhooks, etc features), but we certainly want you to be able to use Pulumi's SDK goodness independent of the service if you wish. We'll be doing a better job of documenting the options here in the weeks ahead.

@big-piano-35669 thanks, is there a quick tldr though on how to configure the S3 backend?

If you do

pulumi login <s3://my-bucket>

then Pulumi will use

my-bucket

, via your local AWS configuration (e.g.,

.aws/credentials

) to store the checkpoint state.

oh, okay, that simple? I'll try that. So as long as the CI server has some sort of access keys in the environment that'll work then? Cool.