This message was deleted.

The

random

package in particular unfortunately puts the secret value in both the

value

field and the

id

field. Blocking out the secret in the latter requires addressing https://github.com/pulumi/pulumi/issues/2717. Blocking out any other property can be done with the

additionalSecretOutputs: ["value"]

resource option. This tells Pulumi that that output from the resource should be marked as secret.

oh, cool, looks like

additionalSecretOutputs

is just what I need. The

random.SecureString

resource isn’t setting an

id

(or at least, not one I can see in the state) so I think this is sufficient.