https://pulumi.com
Join Slack
This message was deleted.
# general
s
This message was deleted.
b
Hey Welcome :) you will be able to use the secret engine built into Pulumi to do this import * as pulumi from "@pulumi/pulumi"; import * as random from "@pulumi/random"; const username = new random.RandomString("my-string", { length: 16, special: true, }, { // RandomString has an output of 'result' where the string actually is stored additionalSecretOutputs: ["result"] }); export const secret = username.result;
As a small example
Notice that the CustomResourceOptions includes that secret options
g
Hi, thanks for the response
I thought the secrets functionality was only for marking whether the items should be shown to the user or not
b
No that also encrypts in the state as well
g
Is this two way encryption or is it a one way hash?
b
2 way as the engine will know how to decrypt it
But you won’t be able to do it directly - the cli will need access to the kms key to be able to do it
g
I can see that this is quite secure
Still, is there no way to choose how the information is stored? For example, the Terraform provider hashes the value before storing it in the state (it seems the there is a setting called 
StateFunc
which allows this). https://github.com/terraform-providers/terraform-provider-digitalocean/blob/726215a1fd1d897296e22b7f5c28fb3a766e0f33/digitalocean/resource_digitalocean_droplet.go#L172
b
Pulumi have a number of secrets providers
🙏 1
👍 1
2 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by