Is there a way to detect a change in code? I need to pass new and old credentials as env to ensure the app reconfigures itself to use the new credentials.

Could you share more details on what you are looking for? In general, Pulumi programs do only see the "new" values. But dynamic providers can get access to both new and old values, so they can be a way to accomplish this - depending on exactly what you have in mind.

So in this case, I'm providing a username/password in a secret for an application to use to both encrypt its config and then as the authentication into the web ui. If I want to change the password, I have to pass the new password in

PASSWORD

environment variable and then

PASSWORD_OLD

in another one. It requires both so it can unencyypt the config and re-encrypt it with the new value.

Can you just pass both through as Pulumi config then? You could definitely use a dynamic provider here as well - though it might potentially be overkill.

I could. But I think if I supplied both all the time, each time it starts up it would try to do the rencrypt config process which isn't ideal.