Hello, in Pulumi Enterprise an admin can demote in

Organization-wide role settings

the Member role to only

read

ESC

environment

, in order to protect login environments and disallow org members privilege escalation in cloud providers. This has an unintended side effect which breaks Pulumi cloud deployments:

$ /pulumi-deploy-executor pulumi preview --stackIdentity="Chamelio-ai/rds/dev" --workDir="/deployment/pulumi/1-platform/rds"
Error: Preview failed: error: getting stack configuration: opening environment: [0]
Diags: You do not have permission to perform this operation.

While the option to change the role which the deployment utilizes exists, it is only available in the UI, and if I'm not missing anything, it is not configurable via pulumiservice.DeploymentSettings. What is the correct way to by-default disable ESC access org-wide and only allow Admins, Automation API Tokens, and Cloud Deployments?

Hey @nice-toothbrush-68985 does the error still persist today? We've been working on a related issue yesterday which should also resolve your problem. Let me know if your setup works today.

I reverted my changes in global org roles, and flipped the logic, so that all members have write access to ESC, but, all users are assigned a lesser member role that can only read ESC..

Ok I see. I'll escalate your issue internally. Your use case makes totally sense and setting up the permissions correctly should be more clear.

@nice-toothbrush-68985 the

operationContext.role.id

field wasn't documented in our API docs (but is now): https://www.pulumi.com/docs/reference/cloud-rest-api/deployments/#properties-1 We are tracking internally adding that to the pulumiService provider. Roles themselves aren't supported via the pulumiService provider today either - are you managing those manually?

@able-magician-37192 Yes, I manage the roles manually, but it would have been nice for pulumiService provider to support that as well, but that would be a nice to have, as it is usually just a one time setup, while deployment settings are evolving with stacks and are essential infrastructure related configuration

Hey @nice-toothbrush-68985 we're tracking this via an internal issue, I'll ping the team about this to ensure it gets another look!