Every engineering team has a version of this problem. There is an API key buried in a CI/CD pipeline that was configured by someone who left the company a year ago. It still works. It has full access to whatever service it was originally scoped for. Nobody wants to rotate it because the last time someone tried, three pipelines broke and two deploys rolled back. The key just sits there, a quiet liability accumulating risk every day.
Pulumi ESC just shipped a feature that attacks this problem directly. ESC stands for Environments, Secrets, and Configuration. It is Pulumi’s platform for managing the credentials and configuration your infrastructure needs to operate. The new capability lets any ESC environment generate a short-lived OIDC token on demand, for any service that accepts one. OIDC, or OpenID Connect, is an identity protocol that lets a system prove who it is without transmitting a static secret. The token gets minted at the moment you need it, carries an expiration window of up to one hour, and cannot be reused after it expires.
The stored key is the weak link in most teams’ security posture. It works from anywhere, for anyone who reads it, for as long as it exists. Rotate it and you break everything that depends on it. Leave it alone and you carry indefinite exposure. The OIDC approach inverts this entirely. Nothing is stored. Nothing requires rotation. Every token is fresh.
For teams running AI-integrated pipelines, this has immediate relevance. An agent that needs access to the Anthropic API, a container registry, and a deployment platform can now receive a scoped, time-limited credential for each connection within the same pipeline run. If a token is somehow exposed, it is worthless within the hour. The blast radius of any credential leak shrinks dramatically.
The configuration is minimal. You declare the provider inside your ESC environment file, specify the audience, which is the name the target service expects, set a duration between one minute and one hour, and the token becomes available as an environment variable. Anthropic, AWS, Cloudsmith, JFrog Artifactory, and Aembit already support this pattern. More services are adding OIDC federation support as the approach gains traction.
Security improvements usually require significant rework to justify. This one mostly layers on top of what you already have. If your team uses Pulumi today, adding short-lived credentials for a single service takes under an hour to configure.