editing deployment settings requires the Pulumi Cloud backen

Error message

editing deployment settings requires the Pulumi Cloud backend; run `pulumi login`

What it means

Editing deployment settings is a Pulumi Cloud (service) feature; the local filesystem, object-store, and DIY backends do not support the deployment-settings API. After resolving the stack, the code asserts the concrete stack type is httpstate.Stack; if it is not, this error is returned. It tells the user to re-login against the Pulumi Cloud backend.

Source

Thrown at pkg/cmd/pulumi/deployment/deployment_settings_edit.go:296

	return cmd
}

func defaultDeploymentSettingsEditClientFactory(
	ctx context.Context, stackFlag string,
) (deploymentSettingsEditClient, client.StackIdentifier, error) {
	ws := pkgWorkspace.Instance
	opts := display.Options{Color: cmdutil.GetGlobalColorization()}

	s, err := cmdStack.RequireStack(ctx, cmdutil.Diag(), ws, cmdBackend.DefaultLoginManager,
		stackFlag, cmdStack.LoadOnly, opts, "")
	if err != nil {
		return nil, client.StackIdentifier{}, fmt.Errorf("resolving stack: %w", err)
	}

	cloudStack, ok := s.(httpstate.Stack)
	if !ok {
		return nil, client.StackIdentifier{},
			errors.New("editing deployment settings requires the Pulumi Cloud backend; run `pulumi login`")
	}

	ref := cloudStack.Ref()
	project := ""
	if p, ok := ref.Project(); ok {
		project = string(p)
	}
	stackID := client.StackIdentifier{
		Owner:   cloudStack.OrgName(),
		Project: project,
		Stack:   ref.Name(),
	}

	be, ok := cloudStack.Backend().(httpstate.Backend)
	if !ok {
		return nil, client.StackIdentifier{},
			errors.New("editing deployment settings requires the Pulumi Cloud backend; run `pulumi login`")
	}

View on GitHub (pinned to 793f7b2e16)

Solutions

Run `pulumi login` (no arguments) to log in to the Pulumi Cloud backend at app.pulumi.com
Alternatively set PULUMI_BACKEND_URL=https://api.pulumi.com and re-authenticate
Verify with `pulumi whoami` that you are on the Pulumi Cloud backend, not a local/file backend

Example fix

// before (terminal)
pulumi login --local
// after (terminal)
pulumi login  # or: PULUMI_BACKEND_URL=https://api.pulumi.com pulumi login

Defensive patterns

Strategy: type-guard

Validate before calling

// verify backend before running
if pulumi whoami 2>&1 | grep -q 'file://'; then echo 'local backend in use'; fi

Type guard

cloudStack, ok := s.(httpstate.Stack)
if !ok {
  return errors.New("editing deployment settings requires the Pulumi Cloud backend; run `pulumi login`")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "Pulumi Cloud backend") {
  // run `pulumi login` programmatically or instruct the user
}

Prevention

Never set PULUMI_BACKEND_URL to file:// or s3:// when editing deployment settings
Use `pulumi login` (cloud) in shared shells; `pulumi login --local` per-project shells
Check `pulumi whoami` output includes a cloud org, not a local path

When it happens

Trigger: Running `pulumi deployment settings edit` while logged into `pulumi login --local`, a file:// or s3:// backend, or any non-cloud backend, so the resolved stack does not implement httpstate.Stack.

Common situations: CI environments configured with PULUMI_BACKEND_URL=s3://... or file://, developers who previously ran `pulumi login --local` in the same workspace, or self-hosted backends (e.g. local Pulumi services not exposing the API).

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/3e81cc8e3613a779. Report an issue: GitHub.