This message was deleted.

Environment variables are stored encrypted. They are decrypted and sent to a single use VM that runs your deployment. The VM is deleted after the deployment completes. We've been working on OIDC integration to support temporary credentials that are scoped to an individual deployment run to give more fine grain security options. The code is live, and we're working on publishing documentation and blog posts right now: https://github.com/pulumi/service-requests/issues/144 https://github.com/pulumi/pulumi-hugo/pull/2369

Sounds great! That's relieve our concerns a lot. Hoping the documents will be ready soon. Thanks

Here you go! https://www.pulumi.com/docs/guides/oidc/

For AWS China, there seems is a trust issue of OIDC for pulumi api. Could it be resolved possible somehow?

Hey @flat-engineer-30260 thanks for pointing that out, there was an error in the docs on our end. The URL should be

<https://api.pulumi.com/oidc>

- we're updating the docs now but just wanted to give you a heads up.