This message was deleted.

If you've lost the passphrase there's no way to recover any encrypted info, that passphrase isn't stored anywhere and the encryption keys are generated directly from it. If you use the pulumi service you don't have to worry about passphrases as the service manages encryption keys for you. You might be able to just remove all the current secret values from your project by manually editing the Pulumi.<stack>.yaml file to remove any secret config and using

pulumi stack export

to get the stack state and remove any secret values from that as well then running

pulumi stack change-secret-provider

Thank you @echoing-dinner-19531 I lost the PULUMI_CONFIG_PASSPHRASE, which means that if I use the pulumi stack change-secret-provider, pulumi will ask me for the old passphrase that I've forgotten. Without knowing the original passphrase, is it possible to recover or reset PULUMI_CONFIG_PASSPHRASE?

No it's not possible to recover it. It is possible to reset it but it needs some manual work because these's no built in command to do this (we could probably add one, but this scenario is rare) You'll need to remove all secret values from the stack config file (Pulumi.stackName.yaml) and also remove all references to secrets from the state.

pulumi stack export > state.json

then edit the json file to remove any values marked secure (they'll have the value "1b47061264138c4ac30d75fd1eb44270" in their object) and the remove the secretProvider block, then reimport that state

pulumi stack import < state.json

and then try

change-secret-provider

Thank you, then i need to be extra careful with PULUMI_CONFIG_PASSPHRASE