No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

In example 4, is the secret stored as part of the function text, or using something like secret manager?

For this example it would be `pulumi config set --secret &lt;key&gt; &lt;value&gt;` <https://pulumi.io/reference/config.html#secrets>

<@UB22XNXS8> right, but if it were captured in the lambda would it appear in the program text or does it store it out of band?

It is currently stored in the program text. <https://github.com/pulumi/pulumi/issues/397> will address that. Really hoping we can get to this soon because as you point out, serializing as plain text isn't good. And if done right (auditing, easy rotation etc) it should address the 80% case for secrets management -- and in a way that's pretty easy to use.