pulumi/pulumi · error

could not determine current cloud: %w

Error message

could not determine current cloud: %w

What it means

With no URL/flag, logout infers the current cloud from the project and credentials via GetCurrentCloudURLWithAgentFallback. If that inference fails for any reason other than undecryptable credentials, the error is wrapped as 'could not determine current cloud'.

Source

Thrown at pkg/cmd/pulumi/auth/logout.go:105

				if cloudURL == "" {
					cwd, err := os.Getwd()
					if err != nil {
						return fmt.Errorf("getting current working directory: %w", err)
					}

					// Try to read the current project
					project, _, err := ws.ReadProject(cwd)
					if err != nil && !errors.Is(err, workspace.ErrProjectNotFound) {
						return err
					}

					cloudURL, err = pkgWorkspace.GetCurrentCloudURLWithAgentFallback(ws, env.Global(), project)
					if err != nil {
						// Removing everything does not require reading the file.
						if workspace.IsUndecryptableCredentials(err) {
							return logOutOfEverything()
						}
						return fmt.Errorf("could not determine current cloud: %w", err)
					}

					// Default to the default cloud URL. This means a `pulumi logout` will delete the
					// credentials for pulumi.com if there's no "current" user set in the credentials file.
					cloudURL = httpstate.ValueOrDefaultURL(ws, cloudURL)
				}

				err = deleteAccount(cloudURL)
				if workspace.IsUndecryptableCredentials(err) {
					return logOutOfEverything()
				}
				fmt.Fprintf(cmd.OutOrStdout(), "Logged out of %s\n", cloudURL)
			}

			return err
		},
	}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Log in first (`pulumi login`) or pass the URL explicitly: `pulumi logout <url>`
2. Use `pulumi logout --all` to clear all stored credentials without needing to resolve a current cloud
3. cd into a valid Pulumi project directory so the cloud can be inferred from Pulumi.yaml
4. Unset or fix PULUMI_BACKEND_URL if it points somewhere invalid

Example fix

// before
pulumi logout   # in a non-project dir with no login state
// after
pulumi logout --all

// shell: verify login state before bare logout
if [ ! -f ~/.pulumi/credentials.json ] && [ ! -f Pulumi.yaml ]; then
  echo "no login state and no project; use: pulumi logout <url> or --all"; exit 1
fi

// fallback to explicit URL when current cloud can't be determined
if ! pulumi logout; then
  pulumi logout "${PULUMI_URL:-https://api.pulumi.com}"
fi

When it happens

Trigger: Running `pulumi logout` outside a Pulumi project with no default cloud URL set in the credentials file (e.g. never ran `pulumi login`), or a backend that errors while resolving the current cloud (PULUMI_BACKEND_URL issues, corrupted credentials file).

Common situations: Fresh machines or CI containers with no `pulumi login` state; running in a non-project directory; stale PULUMI_BACKEND_URL pointing at an unreachable backend.

Related errors

• could not determine current cloud: %w
• %s is not a valid self-hosted backend, use `pulumi login` wi
• oidc-token, oidc-org, oidc-team, oidc-user, and oidc-expirat
• unable to set default org for this type of backend
• could not log in to the state backend %q: %w %s

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/a139bcacc712708b. Report an issue: GitHub.