You don't have to use the secret from the config directly in your resources (and as a matter of policy, I suggest that you don't use Pulumi config directly in your resources). You can use a secret in config to create new secrets that are the right shape for your needs, and pass those to where they're needed.