Pulumi "missing required configuration key" - Provider Config in CI

A Pulumi provider could not be configured because a required setting - most often the cloud region or credentials - is not present in the stack config or the runner environment.

What this error means

pulumi up/preview fails while configuring a provider, naming a missing config key like aws:region, or reporting it cannot validate credentials. This is deterministic: the same config fails the same way every run.

pulumi output

error: missing required configuration key "aws:region": The region where AWS
operations will take place.
    Set a value using `pulumi config set aws:region us-east-1`.

Common causes

Region / required key not set on the stack

The provider needs aws:region (or gcp:project, etc.) and the stack config does not define it, nor does the environment supply an equivalent (AWS_REGION).

Credentials not configured on the runner

The provider cannot find valid cloud credentials - no OIDC role assumed, no AWS_ACCESS_KEY_ID, or an expired profile - so it fails to initialize.

How to fix it

Set provider config on the stack

Terminal

pulumi config set aws:region us-east-1 --stack org/proj/dev
# or via environment
export AWS_REGION=us-east-1

Wire cloud credentials before Pulumi runs

Assume the deploy role (OIDC is preferred) so the provider has valid credentials.

.github/workflows/deploy.yml

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::1234567890:role/pulumi-deploy
    aws-region: us-east-1
- uses: pulumi/actions@v6
  with:
    command: up

How to prevent it

Commit required provider config (region, project) to the stack settings file.
Use OIDC role assumption so credentials are always present and short-lived.
Validate config early with pulumi preview in PR checks before deploy.