Registry / aws / pulumi-aws-native

pulumi-aws-native

library1.69.0pypypi✓ verified 88d ago

Pulumi AWS Native, currently at version 1.61.0, is a Python package for defining and managing AWS resources using the AWS Cloud Control API. It provides same-day access to new AWS resources and properties as they become available in Cloud Control. The library maintains a rapid release cadence, often with multiple updates per month, reflecting its close alignment with AWS Cloud Control API updates.

aws devops

pip install pulumi-aws-native

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PULUMI-AWS-NATIVE

pulumi-aws-native

awspythonv1.69.0

Install

15.8s avg

Import

1256ms

Disk

271MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.69.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.910 runs

installs and imports cleanly · install 0.0s · import 1.585s · 254.1MB

glibc

py 3.10–3.910 runs

installs and imports cleanly · install 15.8s · import 0.927s · 240MB

271MB installed

● package 271MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

aws_native

✓ import pulumi_aws_native as aws_native

Commonly aliased as `aws_native` for brevity and clarity when defining resources.

✓ import pulumi_aws_native.s3 as s3

Importing specific service modules (e.g., S3) can make code cleaner.

This quickstart program provisions a new S3 bucket using the `pulumi-aws-native` provider. It demonstrates how to import the provider and create a basic AWS resource, then exports the bucket's name. Remember to configure your AWS credentials and region before running `pulumi up`.

import pulumi import pulumi_aws_native as aws_native import os # Configure AWS region (e.g., via pulumi config set aws-native:region us-east-1 # or AWS_REGION environment variable) and AWS credentials. # For quickstart, ensure AWS CLI is configured or env vars are set: # export AWS_ACCESS_KEY_ID='YOUR_ACCESS_KEY' # export AWS_SECRET_ACCESS_KEY='YOUR_SECRET_KEY' # export AWS_REGION='us-east-1' # Create an AWS S3 Bucket # Pulumi will automatically assign a unique name if 'my-bucket' is used as the URN part. # You can also pass a specific bucket_name property if a fixed name is required (must be globally unique). bucket = aws_native.s3.Bucket("my-first-aws-native-bucket", bucket_name="my-unique-pulumi-bucket-name-12345") # Use a unique name for actual deployment # Export the name of the bucket pulumi.export("bucket_name", bucket.bucket_name) # To deploy this, navigate to your project directory in the terminal and run: # pulumi up

Debug

Known issues

gotchaThe provider was originally named 'AWS Native' but was officially renamed to 'AWS Cloud Control Provider' in March 2024. While the Python package retains `pulumi-aws-native`, official Pulumi documentation often refers to it by its new name.

fix

Be aware of the name change when consulting documentation or community resources; search for 'AWS Cloud Control Provider' if 'Pulumi AWS Native' doesn't yield results.

affects: All versions

gotchaFor new projects, Pulumi generally recommends starting with the `pulumi_aws` (classic) provider and integrating `pulumi-aws-native` (AWS Cloud Control) for specific resources only available via the Cloud Control API or for same-day feature access. `pulumi-aws-native` is not intended as a direct replacement for `pulumi_aws` but rather as a complement.

fix

Evaluate your project's needs. If a resource is well-supported in `pulumi_aws`, prefer it. Use `pulumi-aws-native` when you need a resource that is very new, only available through Cloud Control, or requires specific behaviors exposed by Cloud Control.

affects: All versions

breakingPerforming `pulumi refresh` can sometimes cause `pulumi-aws-native` to add default values for optional attributes to the state, even if they were not explicitly set in your code. This can lead to subsequent `pulumi up` operations attempting to recreate resources if these default attributes are marked as `replaceOnChange`.

fix

Manually inspect `pulumi preview` output carefully after a `refresh`. If unintended resource replacements are planned due to attribute defaults, you might need to manually edit the Pulumi state file or explicitly define the attribute in your code to match the default, preventing a perceived drift.

affects: All versions

gotchaUsers integrating with AWS SSO (e.g., via `granted.dev` or `aws-vault`) have reported issues where `pulumi up` with `pulumi-aws-native` fails with `STS: GetCallerIdentity` errors, indicating credential problems, even when the `pulumi_aws` provider works correctly in the same shell session.

fix

Ensure your AWS SSO session is active and that environment variables (like `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`) are correctly exported and refreshed in the shell where `pulumi` commands are run. This can sometimes be a more sensitive area for `aws-native` due to underlying provider differences.

affects: All versions

Errors

Common errors & fixes

error configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found.

Pulumi, and its underlying Terraform AWS provider, may not automatically detect IAM instance profile credentials on EC2 instances.

fix

Set the Pulumi stack configuration `aws:skipMetadataApiCheck` to `false` (`pulumi config set aws:skipMetadataApiCheck false`) or export the environment variable `export AWS_SKIP_METADATA_API_CHECK=false` to ensure credential detection.

error: could not get AWS account ID: operation error STS: GetCallerIdentity, get identity: get credentials: failed to refresh cached credentials, the SSO session has expired or is invalid.

The AWS SSO session or temporary credentials have expired or were not correctly picked up by the `pulumi-aws-native` provider.

fix

Re-authenticate your AWS SSO session using your preferred method (e.g., `aws sso login` or your SSO tool) to refresh credentials and ensure they are active and correctly exported as environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`).

Pulumi wants to recreate a resource after `pulumi refresh` even though my code hasn't changed.

`pulumi-aws-native` detected a difference in default values for optional attributes in the cloud state versus what's implicitly managed by your code, and these attributes are flagged to cause replacement.

fix

Examine the `pulumi preview` output carefully to identify the specific attribute causing the replacement. If the default value is acceptable, explicitly set that attribute in your Pulumi code. If not, manual state editing might be required, or open an issue with Pulumi for specific resource behavior.

Upgrade

Version history

1.69.0latest on PyPI · released Jun 15, 2026

Audit

Dependencies

pulumirequiredCore Pulumi SDK is required to define and deploy infrastructure.

pulumi_awsoptionalOften used alongside `pulumi-aws-native` for comprehensive AWS resource coverage, as `aws-native` covers resources available via AWS Cloud Control API.

Agent activity

9 hits · last 30 days

node

Resources

githubhttps://github.com/pulumi/pulumi-aws-native ↗

packagehttps://pypi.org/project/pulumi-aws-native/ ↗

homepagehttps://pulumi.com ↗