Hm. I thought I found away around the issue above by passing environment variables through to the

LocalWorkspaceOptions

interface like:

const opts: LocalWorkspaceOptions = {
        secretsProvider: secretsProvider,
        envVars: {
            AWS_ACCESS_KEY_ID: credentials.Credentials!.AccessKeyId!,
            AWS_SECRET_ACCESS_KEY: credentials.Credentials!.SecretAccessKey!,
            AWS_SESSION_TOKEN: credentials.Credentials!.SessionToken!,
        },

where

credentials

is the output of an STS

AssumeRoleCommand

action. According to the docs, those environment variables should be passed to “every Pulumi command”. However, when the automation runs:

const stack = await LocalWorkspace.createOrSelectStack(args, opts);

I get an access denied error on the bucket, which makes me think

createOrSelectStack

is not using the environment variables as expected (though I’m not sure how to prove this). If I set the process’ environment like I was originally (e.g.

process.env.AWS_ACCESS_KEY_ID = xxx

) immediately before the

createOrSelectStack

, it works as expected. Any thoughts on how I can get

createOrSelectStack

to honour the

envVars

set in the

opts

object?