Figuring out arrays in YAML was a huge pain in the ass. It wasn't until I found this page, that I discovered what it was expecting: https://www.pulumi.com/docs/intro/concepts/config/#strongly-typed-configuration

config:
  apiAccessKeyWhitelist:
    type: array
    items:
      type: string

The errors weren't super helpful:

Pulumi.yaml': 8 errors occurred:
        * #/config/apiAccessKeyWhitelist: oneOf failed
        * #/config/apiAccessKeyWhitelist: expected string, but got object
        * #/config/apiAccessKeyWhitelist: expected integer, but got object
        * #/config/apiAccessKeyWhitelist: expected boolean, but got object
        * #/config/apiAccessKeyWhitelist: expected array, but got object
        * #/config/apiAccessKeyWhitelist: doesn't validate with '/$defs/configTypeDeclaration'
        * #/config/apiAccessKeyWhitelist/items: doesn't validate with '/$defs/configItemsType'
        * #/config/apiAccessKeyWhitelist/items: expected object, but got string