I would probably rely on an external secret store which I access "normally" for generic shared secrets.. i.e. vault or keyvault or stuff like that which is accessed programmatically and separately within the pulumi code.. i.e. mySecretVault = (connection to external secret), pulumiConfigNeedingSecret = mySecretVault.getCommonSecret("thing")