I'm trying to create a dynamic resource (i.e. a

pulumi.dynamic.ResourceProvider

). I need credentials that will come from Config. I'm struggling to get config working in the dynamic provider though. I could pass the credentials in as arguments, but that forces every user of the resource to set them. Which I want to avoid as the values should be ambient from config (like the built in ones) I've tried getting the secrets form outside the closure, but that fails with

Error: Secret outputs cannot be captured by a closure

, and trying inside I just get

Error: undefined

on the line that tries to

requireSecret.

What am I doing wrong? Can

pulumi.Config

not be used within a

ResourceProvider

? Code snippet showing config _outside_:

const config = new pulumi.Config('activeDirectoryAdmin');
const usernameSecret = config.requireSecret('username');
const passwordSecret = config.requireSecret('password');

async function runSql(a: pulumi.Unwrap<SqlCommandArgs>, command: string): Promise<never> {
    return new Promise((resolve, reject) => {
        pulumi.all([usernameSecret, passwordSecret]).apply(([username, password]: [string, string]) => {
            const sqlConnection = new tedious.Connection({

Code snippet showing config _inside_:

async function runSql(a: pulumi.Unwrap<SqlCommandArgs>, command: string): Promise<never> {
    return new Promise((resolve, reject) => {
        const config = new pulumi.Config('activeDirectoryAdmin');
        const usernameSecret = config.requireSecret('username');
        const passwordSecret = config.requireSecret('password');