No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Environment variables, vaults, parameters, files.. any of the ways you would consider doing it in another program or script.

Pulumi config has support for secrets, which is fine for protecting them from casual glances. Depending on your use case, you may want something that prevents putting even encrypted secrets in source control.

<https://www.pulumi.com/docs/intro/concepts/config/#secrets>

Yes, I am trying to avoid to hardcode those secrets in  Source Control. So I think the environment variable is the most secure I guess? Since the vault option is not an option for me.

Environment variable is easy, flexible and avoids writing the value to storage. Usually a good option.

It also avoids showing the values in the output of `ps` or whatever, while it's running.

when pulumi runs, can I output debug info as well? I would just like to output the list of environment variables to the CLI

Yes. You can do it via your language's normal outputting / logging APIs, or you can use the log API that Pulumi provides. In typescript, that's `<http://pulumi.log.info|pulumi.log.info>()`, `pulumi.log.error()`, etc.