Pulumi S3 backend "blob (key ...) ... AccessDenied" in CI

By Daniel Zoghalchali·Latchkey

Pulumi stores state in an S3 bucket, and the AWS identity in CI was denied access to the state object. The backend URL is right; the credentials lack the S3 permissions to read or write state.

What this error means

A Pulumi step using an s3:// backend fails with "error: blob (key \".pulumi/stacks/...\") ...: AccessDenied" while listing or writing state.

error: blob (key ".pulumi/stacks/dev.json") (code=Unknown):
AccessDenied: Access Denied
	status code: 403, request id: ...

Common causes

The CI role lacks S3 permissions on the state bucket

The assumed role or key can authenticate to AWS but is not granted GetObject/PutObject/ListBucket on the state bucket and prefix.

Wrong bucket, region, or missing credentials entirely

The backend points at a bucket in another account or region, or no AWS credentials were configured, so every object request is denied.

How to fix it

Grant the state bucket permissions to the CI identity

1. Configure AWS credentials for the job, ideally via OIDC role assumption.
2. Attach a policy granting ListBucket on the bucket and Get/Put/Delete on the state prefix.
3. Re-run so Pulumi can read and write state.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/pulumi-ci
    aws-region: us-east-1

Confirm the backend bucket and region

Point the backend at the correct bucket and set the region so requests go to the right endpoint.

pulumi login s3://my-pulumi-state?region=us-east-1

How to prevent it

• Use OIDC role assumption so CI gets scoped, short-lived AWS credentials.
• Grant least-privilege access to the state bucket and prefix only.
• Keep the backend bucket and region consistent across environments.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation