We just shipped a Deployments OIDC integration to enable temporary, deployment scoped credentials with AWS, GCP, and Azure. https://github.com/pulumi/service-requests/issues/144 See the user guide here: https://www.pulumi.com/docs/guides/oidc/ as well as examples in the REST API documentation: https://www.pulumi.com/docs/reference/deployments-rest-api/#operationcontext OIDC can be configured within the console for push to deploy, and can be used directly with the REST API. Looking forward to feedback!