---
title: "Enforce Access Token Expiry Policies in Pulumi Cloud"
url: https://daily.dev/posts/enforce-access-token-expiry-policies-in-pulumi-cloud-mij0qyjhx
source_url: https://www.pulumi.com/blog/access-token-expiry-policy
type: article
source: "Pulumi"
published: 2026-07-27T16:10:19.572Z
updated: 2026-07-27T16:10:39.444Z
tags: ["security", "iac", "pulumi"]
reading_time: 4
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Enforce Access Token Expiry Policies in Pulumi Cloud

**[Pulumi](https://daily.dev/sources/pulumi)** · 4 min read · 0 upvotes · 0 comments

## Summary

Pulumi Cloud now lets organization admins enforce a maximum expiry cap (in days) on personal, organization, and team access tokens. Tokens without an expiration or with remaining lifetime exceeding the cap are rejected with a 403 error. The policy applies to existing tokens based on remaining lifetime rather than original creation date. A preview tool shows which tokens would be affected before the policy is saved, enabling safe rollouts. Web console sessions and OIDC-issued short-lived tokens are exempt.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.pulumi.com/blog/access-token-expiry-policy>

## Similar posts on daily.dev

- [Project-scoped Tokens](https://daily.dev/posts/project-scoped-tokens-dcz6uakob) · Vercel · 0 upvotes · 0 comments
- [Native OIDC Token Exchange for Pulumi CLI](https://daily.dev/posts/native-oidc-token-exchange-for-pulumi-cli-bcpcer7ek) · Pulumi · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#iac](https://daily.dev/tags/iac), [#pulumi](https://daily.dev/tags/pulumi)

[View this post on daily.dev](https://daily.dev/posts/enforce-access-token-expiry-policies-in-pulumi-cloud-mij0qyjhx)