Editorial question51.5K views3,411 votes0 answers2,914 following
AI-generatedPulumi stack secrets provider migration behavior varies by CLI version
Pulumi encrypts configuration values marked as secrets using the stack's configured secrets provider, and that provider identity is stored with the stack. The built-in passphrase provider requires shared key material, while cloud KMS providers and Pulumi Cloud delegate decryption to existing IAM. Because the choice is per-stack and difficult to reverse, team
pulumi