pulumi/pulumi · error

exporting audit logs requires the Pulumi Cloud backend; run

Error message

exporting audit logs requires the Pulumi Cloud backend; run `pulumi login`

What it means

Audit log export is a Pulumi Cloud-only feature. The command resolves the current backend and type-asserts it to the HTTP state (cloud) backend; any other backend (local, object-store) fails this assertion and gets this error.

Source

Thrown at pkg/cmd/pulumi/org/org_audit_log_export.go:139

	return cmd
}

// defaultOrgAuditLogExportClientFactory is the production wiring: resolve the
// cloud backend, pick the effective organization, and hand back the
// underlying *client.Client.
func defaultOrgAuditLogExportClientFactory(
	ctx context.Context, orgFlag string,
) (orgAuditLogExportClient, string, error) {
	ws := pkgWorkspace.Instance
	opts := display.Options{Color: cmdutil.GetGlobalColorization()}

	be, err := cmdBackend.CurrentBackend(ctx, ws, cmdBackend.DefaultLoginManager, nil, opts)
	if err != nil {
		return nil, "", err
	}
	cloudBackend, ok := be.(httpstate.Backend)
	if !ok {
		return nil, "", errors.New(
			"exporting audit logs requires the Pulumi Cloud backend; run `pulumi login`")
	}

	userName, orgs, _, err := cloudBackend.CurrentUser()
	if err != nil {
		return nil, "", err
	}

	org := orgFlag
	if org == "" {
		defaultOrg, err := cloudBackend.GetDefaultOrg(ctx)
		if err != nil {
			return nil, "", err
		}
		org = defaultOrg
	}
	if org == "" {
		org = userName

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Run `pulumi login` against the Pulumi Cloud backend and retry
2. Verify with `pulumi whoami` that you're on the Pulumi Cloud backend
3. Ensure PULUMI_BACKEND_URL / credentials point to a cloud backend in CI

Example fix

// before
pulumi org export-audit-logs my-org --from 2024-01-01  # local backend
// after
pulumi login
pulumi org export-audit-logs my-org --from 2024-01-01

pulumi whoami | grep -q pulumi.com || { echo "audit log export needs Pulumi Cloud backend; run pulumi login"; exit 1; }

cloudBackend, ok := be.(httpstate.Backend)
if !ok {
	// not on Pulumi Cloud backend
}

if err != nil && strings.Contains(err.Error(), "requires the Pulumi Cloud backend") {
	// run pulumi login then retry
}

When it happens

Trigger: Running `pulumi org export-audit-logs` (or similar) while logged into a local or DIY backend instead of app.pulumi.com or a Pulumi Cloud endpoint.

Common situations: CI environments defaulting to a local backend; developers who forgot to `pulumi login` before running export in a fresh container.

Related errors

• could not determine current cloud: %w
• %s is not a valid self-hosted backend, use `pulumi login` wi
• oidc-token, oidc-org, oidc-team, oidc-user, and oidc-expirat
• unable to set default org for this type of backend
• could not log in to the state backend %q: %w %s

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/62819e87f74f37c8. Report an issue: GitHub.