Pulumi Wants to Replace Your Risky API Keys

Pulumi's tool now generates short-lived tokens, helping teams eliminate the major security risk of static, long-lived API keys.

Infrastructure-as-code company Pulumi has announced a significant security upgrade for its configuration and secrets management tool, Pulumi ESC. According to a post on the company's blog, the platform can now create, or "mint," short-lived access tokens for any third-party service that supports the OpenID Connect (OIDC) standard. This development directly targets one of the most persistent security vulnerabilities in modern software development: the reliance on static, long-lived API keys. These keys, often stored in configuration files or environment variables, are required for automated pipelines to access services like package registries or monitoring tools. However, if leaked, they provide attackers with a durable and often powerful entry point into a company's systems. By enabling a dynamic, temporary credential system, Pulumi is aiming to make the entire infrastructure management process more secure by default, moving teams away from the risky practice of hard-coded secrets.

The new feature works by positioning Pulumi ESC as a trusted identity provider. OpenID Connect is a widely adopted authentication layer built on top of the OAuth 2.0 framework, allowing applications to verify user identities and obtain basic profile information in a standardized way. In this scenario, when an automated process like a CI/CD pipeline needs to access an external service such as JFrog Artifactory, it first requests a credential from Pulumi ESC. Instead of handing over a static API key, ESC generates a short-lived OIDC token. This token is a digitally signed JSON Web Token (JWT) that contains claims about the identity of the requester and is only valid for a brief period, often just a few minutes. The target service, having been pre-configured to trust tokens issued by Pulumi ESC, can then validate the token's signature and grant temporary access. Once the token expires, access is automatically revoked, effectively closing the security window.

This update aligns Pulumi with a powerful industry-wide movement toward zero-trust security principles and the elimination of static secrets. For years, major cloud providers like AWS, Google Cloud, and Microsoft Azure, along with platforms like GitHub Actions, have championed the use of OIDC for providing workloads with secure, temporary access to cloud resources without needing to store long-term credentials. This approach has become a best practice for cloud-native security, as leaked credentials remain a leading cause of major data breaches. Pulumi's innovation is to extend this proven security model beyond the walled gardens of the major cloud platforms to the broader ecosystem of developer tools. By acting as a central OIDC provider for any service, Pulumi is helping to standardize a higher level of security across the entire toolchain, addressing a critical gap that often exists between cloud infrastructure and the many third-party services that support it.

For engineering and security teams, the practical takeaway is a clear path to reducing their organization's attack surface. This feature provides a tangible way to audit systems, identify static API keys used in deployment pipelines, and systematically replace them with a more secure, dynamic alternative. The immediate benefit is the peace of mind that comes from knowing a credential accidentally committed to a code repository or exposed in system logs will expire in minutes, not months. This also drastically simplifies the operational burden of secret management, replacing cumbersome manual or automated key rotation policies with a system where secrets are never stored long-term in the first place. Looking ahead, we can expect to see wider adoption of OIDC across the software-as-a-service landscape, as more tools recognize the competitive and security advantages of passwordless, token-based authentication. This will likely push other infrastructure and secrets management platforms to offer similar capabilities to keep pace in an increasingly security-conscious market.

For developers and security teams, this feature directly addresses the persistent problem of credential sprawl. By minting short-lived OIDC tokens on-demand, it automates securing access to third-party tools, significantly reducing the attack surface created by static, easily compromised API keys.

Eliminating long-lived credentials dramatically lowers a company's risk of a costly data breach from a leaked API key. This simplifies security audits, strengthens compliance posture, and reduces the operational overhead of manually rotating secrets, allowing engineering teams to move faster.