pulumi/pulumi · error

the Pulumi Cloud backend must be used for remote operations;

Error message

the Pulumi Cloud backend must be used for remote operations; use `pulumi login` without arguments to log into the Pulumi Cloud backend

What it means

RunDeployment requires the Pulumi Cloud (httpstate) backend; remote deployments are a Pulumi Cloud feature and cannot run against local, file, or self-hosted object-storage backends. The CLI detects the backend type after login and fails fast if it is not the cloud backend.

Source

Thrown at pkg/cmd/pulumi/deployment/remote.go:461

	if err != nil {
		return fmt.Errorf("getting current working directory: %w", err)
	}

	// Try to read the current project
	project, _, err := ws.ReadProject(cwd)
	if err != nil && !errors.Is(err, workspace.ErrProjectNotFound) {
		return err
	}

	b, err := backend.CurrentBackend(ctx, ws, backend.DefaultLoginManager, project, opts)
	if err != nil {
		return err
	}

	// Ensure the cloud backend is being used.
	cb, isCloud := b.(httpstate.Backend)
	if !isCloud {
		return errors.New("the Pulumi Cloud backend must be used for remote operations; " +
			"use `pulumi login` without arguments to log into the Pulumi Cloud backend")
	}

	stackRef, err := b.ParseStackReference(stack)
	if err != nil {
		return err
	}

	var gitAuth *apitype.GitAuthConfig
	if args.GitAuthAccessToken != "" || sshPrivateKey != "" || args.GitAuthPassword != "" ||
		args.GitAuthUsername != "" {
		gitAuth = &apitype.GitAuthConfig{}
		switch {
		case args.GitAuthAccessToken != "":
			gitAuth.PersonalAccessToken = &apitype.SecretValue{Value: args.GitAuthAccessToken, Secret: true}

		case sshPrivateKey != "":
			sshAuth := &apitype.SSHAuth{

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Run `pulumi login` with no arguments to log into the Pulumi Cloud backend
2. Unset PULUMI_BACKEND_URL if it forces a non-cloud backend, then log in again
3. Verify with `pulumi whoami -v` (or `pulumi about`) that the current backend is app.pulumi.com

Example fix

// before
pulumi login file:///state   # then: pulumi deployment run mystack
// after
unset PULUMI_BACKEND_URL
pulumi login
pulumi deployment run mystack

pulumi about --json | jq -e '.backend | test("app\\.pulumi\\.com|pulumi cloud")' \
  || { echo 'remote operations require the Pulumi Cloud backend'; exit 1; }

function isCloudBackend(info) { return typeof info.url === 'string' && info.url.includes('pulumi.com') }

try { run(cmd) } catch (e) { if (e.message.includes('Pulumi Cloud backend must be used')) { /* pulumi login then retry */ } else throw e }

When it happens

Trigger: Running `pulumi deployment run` (or similar remote commands) while logged into `file://`, `s3://`, `azblob://`, or a local backend.

Common situations: Developers with mixed backends whose PULUMI_BACKEND_URL or default org points at file storage; CI configured for a state bucket instead of Pulumi Cloud; forgetting to `pulumi login` after switching stacks.

Related errors

• could not determine current cloud: %w
• unable to set default org for this type of backend
• could not log in to the state backend %q: %w %s
• getting latest configuration: %w
• failed to save stack tags: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/66fa98351febbf91. Report an issue: GitHub.