I have a secret in an ESC environment which is exposed in the pulumiConfig. In a stack where I import this ESC environment, I am using this secret as an input of one of my resource. Shouldn't the resource property containing the secret be marked as a secret as well ? I add to use

additionalSecretOutputs

Pulumi env :

{

"nuxtUI": {

"licenceKey": "[secret]"

},

"pulumiConfig": {

"nuxt.UIProLicenseKey": "[secret]"

}

}

Infrastructure code :

const config = new Config()
const nuxtUIKey = config.require("nuxt.UIProLicenseKey")

new netlify.EnvironmentVariable("nuxtUIKeyEnvVar", {
  siteId: blog.id,
  key: "NUXT_UI_PRO_LICENSE", 
  values: [{
    value: nuxtUIKey,
    context: "all"
  }]
})

I would have expect "values" to be encrypted

If you want secretness to be retained for your config value, you need to import it with

config.requireSecret

instead of

config.require

Relevant bit in the docs: https://www.pulumi.com/docs/iac/concepts/secrets/#using-configuration-and-secrets-in-code:~:text=[…]s%20almost%20certainly%20not%20what%20you%20want

Oh I completely forget about that one