If I some structural config in an ESC environment which has mixed secret and non-secret fields, like the following:

pulumicConfig:
  objConfig:
    nonSecret: not_a_secret
    secret:
      fn::secret: top_secret

then inside my program must I use

config.requireSecretObject

to get the whole object as a secret if I wish to keep

objConfig.secret

derived values encrypted in the state?

Hi Billy, that is correct

This stems from the keys in pulumiConfig matching how it works in the Pulumi.stack.yaml files on your local machine. If you want to pull

objConfig.nonSecret

without using requireSecret you need to set up the ESC environment like this:

pulumicConfig:
  objConfig:nonSecret:
  objConfig:secret:
      fn::secret: top_secret

Might be worth pulling the values out into a separate structure and referencing them in

pulumiConfig

instead?