Pulumi v3.274.0 Release Notes: Policy CLI Upgrades, Automation API Additions, and Resource Existence Checks

Introduction

Pulumi v3.274.0 was published on 2026-11-03, one minor release after v3.273.0. This release focuses heavily on the policy-as-code CLI surface (pulumi policy, pulumi stack policy), expands the generated Automation API with several new command groups, and adds resourceExists/<Resource>Exists helpers to Go and Python SDK generation. It also ships a batch of bug fixes around OIDC login, secrets decryption, and dynamic-resource recursion. This article covers what matters for teams writing and operating Pulumi programs, with upgrade and verification steps.

What Is New

Policy CLI

The policy command set gets several new subcommands and flags:

• pulumi policy get shows a policy pack's policies (#25297).
• pulumi stack policy ls lists the policy groups and policy packs that apply to a given stack (#25345).
• pulumi policy group new and edit accept --stack-rule and --account-rule, and match rules are now shown in policy group console output (#25345).
• --output json is now supported on pulumi policy publish, enable, disable, rm, and validate-config; enable/disable also print the updated policy group (#25347).
• pulumi policy issue edit sets status, priority, and assignee on a policy issue; pulumi policy issue ls gains filter/sort flags, and pulumi policy issue export is new (#25334, #25333).
• pulumi policy group ls now shows each group's mode and Insights account count, including new mode and numAccounts keys in JSON output (#25345).

# List policy groups/packs attached to the current stack
pulumi stack policy ls
 
# Inspect a policy pack's rules
pulumi policy get my-org/my-policy-pack
 
# Restrict a policy group to specific stacks/accounts
pulumi policy group new prod-guardrails --stack-rule "env:prod" --account-rule "acct-123"
 
# Machine-readable output for CI pipelines
pulumi policy publish my-org/my-policy-pack --output json

Automation API additions

The generated Automation APIs for NodeJS, Python, and Go gain four new command groups mirroring recent CLI additions: schema (#25058), org usage (#25059), api (#25060), and org audit-log (#25062). Teams driving Pulumi from custom orchestration code (CI jobs, internal platforms) can now call these without shelling out to the CLI directly.

Resource existence checks (Go, Python)

Generated Go SDKs now expose <Resource>Exists functions, and generated Python SDKs expose static exists methods, that check whether a resource with a given ID exists without adopting it into the stack (#25326, #25336). The corresponding resourceExists construct is also supported in programs generated by programgen for Go and Python (#25326, #25336).

# Python: check existence without importing the resource into state
exists = aws.s3.Bucket.exists("my-bucket-id")
if exists:
    print("bucket already present")

Notable bug fixes

• OIDC login now normalizes backend URLs before authenticating (#25477).
• @opentelemetry/api is pinned to 1.9.x in the NodeJS SDK so bun/pnpm no longer pull an incompatible 1.10.0 (#25444).
• pulumi stack init --copy-config-from now loads the source stack before creating the new stack, so a missing source stack no longer leaves an empty stack behind (#25421).
• Snapshot integrity is preserved when a protected resource has multiple pending-delete copies of its parent (#25384).
• hideDiffs in PCL now resolves both resource input and output properties correctly (#25450).
• Invokes and calls of extension packages are fixed (#25478).
• A RecursionError after creating many dynamic resources in one Python process is fixed (#25492).
• Secret decryption errors when running from a workspace without local stack configuration (Automation API, or a saved update plan applied from another directory) are documented as fixed by setting PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER (#24535).

# Workaround/fix for secret decryption when running outside the project directory
export PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER=true

The release notes list additional smaller improvements (credentials helpers for backend/HTTP/cloud auth, AI-agent routing hints for pulumi api policy calls) that are incremental rather than user-facing changes to day-to-day workflows; see the release page for the full, unabridged list since the published notes for the Improvements section were truncated at source.

Upgrade Steps

Upgrade the Pulumi CLI directly:

curl -fsSL https://get.pulumi.com | sh -s -- --version 3.274.0
# or, with Homebrew
brew upgrade pulumi

If you consume the SDKs in a program, bump the package version too:

# NodeJS
npm install @pulumi/pulumi@3.274.0
 
# Python
pip install --upgrade pulumi==3.274.0
 
# Go
go get github.com/pulumi/pulumi/sdk/v3@v3.274.0

For Automation API consumers relying on the new schema, org usage, api, and org audit-log commands, regenerate or re-vendor the language-specific Automation API client after bumping the SDK version so the new command wrappers are available.

Verify

pulumi version
# expect: v3.274.0
 
pulumi about
 
# confirm the new policy commands are present
pulumi policy group ls --output json | grep -E 'mode|numAccounts'
pulumi stack policy ls

Conclusion

v3.274.0 is primarily a policy-tooling and automation-surface release: pulumi stack policy ls, richer policy group/policy issue management, and JSON output across more policy subcommands make it easier to audit and automate policy enforcement from CI. The new resourceExists/<Resource>Exists helpers for Go and Python close a long-standing gap for safely checking resource presence without importing it into state. The bug-fix list addresses real operational pain points (OIDC login, dynamic-resource recursion, snapshot integrity for protected resources), so teams on recent 3.27x releases should upgrade without expecting breaking changes. Review the full release page for any additional improvements not fully captured in these notes: https://github.com/pulumi/pulumi/releases/tag/v3.274.0