Hi All- I'm getting my feet with Pulumi on AWS. We use roles for interacting with AWS APIs, and they have a hard timeout of 1 hour. I'm also using S3 as the backend at the moment. I'm wondering what advice you might have that would help me deal with STS token timeouts during a stack deployment? For example, if I have an STS token that's valid for another 15 minutes, and I run a

pulumi up

that might take 30 minutes, about half way through Pulumi will lose access to the S3 bucket backend, and then it gets all sorts of confused. Is there any way to launch asynchronous deployments with a non-SaaS backend? With CloudFormation, it submits the stack to AWS and runs asynchronously, so your token only needs to be valid for the length of time it takes to run

CreateStack

or

UpdateStack

. I'm kind of hoping for something similar for Pulumi.

Sounds like the issue is the "hard limit" of the 1 hour situation. I'd work to get that fixed first, but past that, theres no way for pulumi to check your session and send a request to some outside system asking for a refresh? Wont happen.. so, what you should try is see what happens if you manually update the role variables during execution of pulumi. My guess is that you'll want to use some type of side process that is checking the creds and refreshing them as needed. Or maybe, you use a script to get temp creds, write them to a file, and update that file. Something like that. Pulumi uses the terraform providers, and those make a bunch of individual calls so your question about a single asynchronous call is not likely to happen, unfortunately.

Thanks -I'll have a poke around.

@great-vr-65723 2.5 year open issue on the TF front: https://github.com/terraform-providers/terraform-provider-aws/issues/1351 Since the pulumi provider is based on the TF one, this issue is applicable here too.