How are dynamic providers supposed to use Pulumi secrets? Configuration A provider may accept a set of configuration variables. After a provider is instantiated, the instance must be configured before it may be used, even if its set of configuration variables is empty. Configuration variables may be of any type. Because it has no connection to the Pulumi engine during configuration, a provider’s configuration variables should not rely on the ability to resolve resource references. ref: https://pulumi-developer-docs.readthedocs.io/en/latest/providers/implementers-guide.html?highlight=secrets#configuration Are secrets resolvable through resource references? The only example I found seems to pass secrets in plain text: https://github.com/pulumi/examples/blob/2f0bd7762d6c8597066a2b9725e4b155f1d2035c/aws-py-dynamicresource/__main__.py#L101C7-L101C7