This message was deleted.
# generals
sparse-intern-71089
12/07/2023, 4:54 PMThis message was deleted.
b
billowy-army-68599
12/07/2023, 4:55 PM
that isn’t possible. You need to be able to be able to decrypt the values to be able to run pulumi
b
bland-dog-47600
12/07/2023, 4:56 PMNo, I’m talking about segregation of roles. We don’t want to permit everyone to run pulumi on production, but we do want to allow developers to encrypt new secrets.
b
billowy-army-68599
12/07/2023, 5:00 PM
ah, so no developer should be able to execute Pulumi locally?
b
bland-dog-47600
12/07/2023, 5:02 PMNo, we want to have only few devs being able to deploy production. But we don’t want them to be interrupted with queries like ‘Please, add this token to the prod secrets,’ we’d rather allow them to do themselves with a PR.
b
billowy-army-68599
12/07/2023, 5:03 PM
I mean, it’s possible, but you’d need to craft the permissions on the key so those people can write and not read. It’s certainly well out of the scope of community support
billowy-army-68599
12/07/2023, 5:03 PM
if the users can successfully do
pulumi config setb
bland-dog-47600
12/07/2023, 5:04 PMWe gave them permission to decrypt without encryption permissions.
The thing is the Pulumi’s implementation creates an extra key which has to be decrypted by KMS, and they are not allowed to do that.
bland-dog-47600
12/07/2023, 5:05 PMThis key
bland-dog-47600
12/07/2023, 5:08 PMIt’s certainly well out of the scope of community supportIs there a paid customer support btw? I couldn’t find it anywhere.
b
billowy-army-68599
12/07/2023, 5:08 PM
contact sales@pulumi.com
billowy-army-68599
12/07/2023, 5:08 PM
I can have someone reach out
8 Views