Currently there is no automated way to do this. We just released a building block that can likely help with this - I am working on some docs updates today that show how a few scenarios like this can be addressed using that feature (
pulumi stack export —show-secrets
). And we expect to add simpler support for a few of these specific scenarios in future CLI releases.