The Resource Providers concept page documents default and explicit providers, and shows an example of creating an explicit AWS provider scoped to a different region than the default provider. It doesn't mention that explicit providers start from an empty configuration and never inherit values (such as profile, assumeRole, or allowedAccountIds) set on the default provider of the same type.
This is a long-standing source of confusion: pulumi/pulumi#4779 (open since 2020, with an independent corroborating comment hitting the same gap with allowedAccountIds/assumeRole), a related pulumi/pulumi discussion, and a Stack Overflow question about the same behavior with a different cloud all describe users expecting explicit providers to pick up default provider settings and being surprised when they don't.
The engine doesn't inherit this configuration today, so the fix here is documentation: add a note to the "Explicit provider configuration" section clarifying the behavior and showing the pattern of reading shared config once and passing it explicitly to every provider that needs it.
The Resource Providers concept page documents default and explicit providers, and shows an example of creating an explicit AWS provider scoped to a different region than the default provider. It doesn't mention that explicit providers start from an empty configuration and never inherit values (such as
profile,assumeRole, orallowedAccountIds) set on the default provider of the same type.This is a long-standing source of confusion: pulumi/pulumi#4779 (open since 2020, with an independent corroborating comment hitting the same gap with
allowedAccountIds/assumeRole), a related pulumi/pulumi discussion, and a Stack Overflow question about the same behavior with a different cloud all describe users expecting explicit providers to pick up default provider settings and being surprised when they don't.The engine doesn't inherit this configuration today, so the fix here is documentation: add a note to the "Explicit provider configuration" section clarifying the behavior and showing the pattern of reading shared config once and passing it explicitly to every provider that needs it.