Where Does Pulumi Store State and Credentials?
Pulumi home directory with workspaces, credentials and plugin cache, and PULUMI_HOME control.
Last updated
Pulumi roots CLI state in a .pulumi directory in your home: workspaces with stack state, backend credentials, downloaded plugins and policy packs. Project files reference into this pool, which is why fresh clones deploy immediately on a configured machine and nowhere else.
The PULUMI_HOME variable relocates the tree, the supported fix for CI caches, containers and shared runners. Plugin binaries dominate the size, so pruning unused plugins beats hand deleting internals. Credentials deserve care: the directory holds live access tokens, not just preferences.
Where Pulumi stores this, by platform
~/.pulumi
Key children include workspaces, backends, plugins and credentials.json. Set PULUMI_HOME before running pulumi commands to relocate. Project Pulumi.yaml files stay inside each repo, far from this tree.
~/.pulumi
Same layout as Linux. Homebrew and installer based CLIs share this location, so state survives switching install methods on the same machine.
%USERPROFILE%\.pulumi
Same role as on Unix for the Windows CLI builds. Relocate with PULUMI_HOME when roaming profiles or small system drives get in the way.
Frequently asked questions
how do i move the pulumi home directory
Set PULUMI_HOME to the new path, then move the .pulumi directory there. Workspaces, credentials, plugin cache and Policy Packs all resolve from that variable, so one move migrates the CLI state. Keep credentials encrypted at rest regardless of location.
is pulumi.yaml the same as the pulumi home folder
No. The Pulumi.yaml project file pins the project for collaborators, while the home directory holds your personal backends, access tokens and plugin binaries. Version the first, back up the second, and never commit credentials from either.
Notice an outdated path? Let us know.