I use an array in the config to make multiple services

proj:services:
    - name: svc1
      secret: 123zyx
    - name: svc2
      secret: 456zyx
    - name: svc3
      secret: 999abc

and read it in using

requireObject()

. I am trying to find a way to make the 'secret' attribute a config secret. It seems you can only have secrets at the yaml top level and can not construct your own in code. Is there an equivalent to

config.getSecret()

where I pass in the ciphertext?

interface MyService {
  name: string
  secret: string
}
const services = stackConfig.requireObject<MyService[]>('services')
services.forEach((service) => {
   ... pulumi make magic resources
}

You can definitely have secrets deeper in the config than the top level. Use the

pulumi

CLI to do so:

pulumi config set --path 'services[0].secret' --secret

wow this worked perfectly, thanks heaps.