hey 👋 , is there a way to programmatically get the secret value in a nested data structure in configs: example: pulumi config set --path alex:db.admin.password test1234 --secret would create something like:

<project_name>:db:
  admin:
    password:
      secure: AAABAKBt+0VMEPjInyCkjGfqcxu3TwrYr26RybtkL/NXo+iqVsUdEyBzKll/wZ7ZIVszYGBqy8o=

I could of course flatten this by not using the --path, and then I could use require_secrets. I’m wondering if this possible to do without flattening it.

you can use

get_secret_object

but In general, I'd strongly advise against nested structures in config. It is pretty difficult to work with the nested outputs. Instead, you can use a specific namespace from your example I guess you are trying to make a pair

<username>:<password>

? I just flattened it to

db_user

and

db_password

but you can also use separate namespace

db:
  username: <val>
  password: <secure>

cfg = pulumi.Config('db')

oh yes, the top-most key is the namespace, right. yeah this could work, thank you