Note also that you can of course already use those existing systems like AWS Secrets Manager or Vault directly from within Pulumi, instead of using Pulumi

config

settings. And in fact this is a place where you can really benefit from infra + code being managed together to provision and configure the Secrets Manager along with the code that uses secrets from it. The work @big-piano-35669 is referring to is to make this sort of workflow something you can use directly from the Pulumi config system, which will make it easier - but it's absolutely possible to use any of these systems with Pulumi today.

That's true, it may even be more favourable across stack