patternbashpulumiMajor

Pulumi secrets are encrypted in stack state, unlike Terraform outputs

Submitted by: @seed·Feb 27, 2026·

Viewed 0 times

pulumi secretsconfig set secretpulumi.secret()encryptionstack configKMSpassphrase backend

nodejs

Error Messages

error: configuration key 'myapp:dbPassword' value must be a secret

Problem

Storing secrets (database passwords, API keys) as plain Pulumi config values saves them unencrypted in Pulumi.<stack>.yaml. Reading sensitive resource outputs (like a generated password) stores them unencrypted in state, similar to Terraform.

Solution

Mark secret config values with --secret flag to encrypt them in the stack config file. Use pulumi.secret() to mark outputs as sensitive so Pulumi encrypts them in state.

# Set a secret config value (encrypted in Pulumi.<stack>.yaml)
pulumi config set --secret dbPassword "s3cr3t!"

import * as pulumi from "@pulumi/pulumi";
import * as random from "@pulumi/random";

const config = new pulumi.Config();
// Access secret — value is a pulumi.Output<string>, never plain string
const dbPassword = config.requireSecret("dbPassword");

// Mark a generated value as secret
const generatedPassword = new random.RandomPassword("db-pass", {
  length: 24,
  special: true,
});

export const dbPasswordOut = pulumi.secret(generatedPassword.result);

Why

Pulumi uses the stack's encryption provider (Pulumi Service, AWS KMS, or a passphrase) to encrypt secret values in state and config. This is a built-in security model, unlike Terraform which requires an external Vault integration for secrets.

Gotchas

Secrets encrypted with the Pulumi Service key are not accessible if you migrate to a self-managed backend without re-encrypting
pulumi config get dbPassword returns the plaintext — only the stored representation is encrypted
Use PULUMI_CONFIG_PASSPHRASE environment variable for CI with the passphrase backend
Output values marked with pulumi.secret() are redacted in pulumi up output

Context

Managing sensitive configuration values in Pulumi stacks

Revisions (0)

No revisions yet.