No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Your best bet is to use the `import` argument, I think. That way the secret becomes "managed". Pulumi's model doesn't work really well with conditional infrastructure.

<https://www.pulumi.com/docs/guides/adopting/import/>

Hmm, looking at your other message I think I'm asnwering a different question. I was assumign the secret already existed and was (currently) managed outside pulumi.

Nope. I want to create it once, then use it going forward on subsequent runs

<https://www.pulumi.com/docs/reference/pkg/random/>

Unlcear to me how to avoid plaintext in the state file with that tho :disappointed:

Found this in an azure exmaple <https://github.com/pulumi/examples/blob/master/azure-ts-msi-keyvault-rbac/index.ts#L24>