is PULUMI_CONFIG_PASSPHRASE still used if we're using an s3 backend with a kms secret provider? just wondering if i need to set that to something random still, or if kms is all it needs. i ask because it's still asking me to set that when i run the automation api, even though the secrets backend is set to a kms alias

hmmm... if it's an inline automation api program, you might be running into https://github.com/pulumi/pulumi/issues/17905#issuecomment-2527311285 ?

oooh ok i'll give that a shot. thanks!

Nice high five

Hi @careful-balloon-42392 @future-hairdresser-70637 I facing hard time with same issue. I have set

export PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER=true

But it still asks for passphrase in preview job, even tough in base job I have set

PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER

and

pulumi stack init "$PULUMI_STACK_NAME" \

--secrets-provider="<awskms://alias/pulumi-key=$AWS_REGION>"