Yes, assuming that the secrets are not managed in the same Pulumi project, then you can use the various get functions appropriate to that secret type (AWS SSM parameters, Hashivorp Vault secrets, etc.). And there's Pulumi ESC, which is designed for this, and handles things like different secrets and secret sources for different stacks.