Is anyone else out there having a rough time getting Pulumi to use aws Profiles? I have a shared credentials file in ~/.aws/credentials that has a default profile which has my access key and secret then I created another profile named sandbox which references a role_arn and source_profile of default. In the pulumi config I set aws:profile to use sandbox. However when I do a pulumi preview and write out the callidentity is still pointed to my main account.

Yep. I have this exact problem. It's being tracked here: https://github.com/pulumi/pulumi/issues/4665

yuck. Ok was hoping this would work since I am putting this in a pipeline to manage multiple accounts..

just out of interest, does it work with the

AWS_PROFILE

environment variable?

@billowy-army-68599 no I tried both setting just Environment Variable and aws:profile, then also setting both

hmm that's interesting, I

I can manually using the same config do an STS:Assume Role call and get back temp creds. Just Pulumi isn't recognizing the Profile to assume

Can you open an issue in Pulumi/pulumi for this, I’d like to track it

ok

I’m also assuming you’re using the aws provider?

I think I am hitting the same issue. Fresh Pulumi / awscli installed. I have profiles configured correctly, and the Pulumi stack configured to use a working profile. Consistently seeing:

You should print the getcallidentity accountid see if you are working in the expected account @microscopic-article-39213

@chilly-hairdresser-56259 Attempting to call

aws.getCallerIdentity

fails with the same error as above: The

pulumi diagnostic

line prints out the named profile I want to use, which confirms to me that Pulumi knows about the named profile configured, but it does not seem to be using it. Using that named profile with aws-cli directly works fine ala:

aws s3 ls --profile=<profile name>

Happy to try other things to help debug.

Im going to start looking at this again today, try to figure out if maybe I am doing something wrong and comment on the github issue if I find anything.

thanks, I didn't get time to look at this yet, but would appreciate a comment on the issue with your workaround

will do thanks