We have been using Pulumi for quite a while now and everything is working fine. However I am running into the issue that for developers setting secrets with the pulumi CLI is something the forget or not know. Of course I can educate them but in the past they could just add a secret through the aws webinterface. Is Pulumi esc the solution for us? We use Pulumi to fill the parameter store and our backend apps get the secrets from there on runtime.

So instead of something like

get:
          email_section_example:
            ref: "<op://Management/PagerDuty/Admin/email>"

You'd want to be able to specify a wildcard? If so, it's not clear how the mapping of names would work, given that you have to map a path in 1Password (

Management/PagerDuty/Admin/email

) to a single name of a secret (

email_section_example

).

The idea would be that instead of something like:

get:
          email_section_example:
            ref: "<op://Management/PagerDuty/Admin/email>"

We would do something like this (note I just came up with this on the spot):

values:
  aws_vault:
    fn::op.vault:
      reference: "<op://AWS/>"

const config = new pulumi.Config()

const awsVault = config.requireSecretObject('aws_vault')

const pulumiCredential = awsVault.apply(v => v['xxx']['credential'])
const awsUsername      = awsVault.apply(v => v['yyy']['username'])
const awsPassword      = awsVault.apply(v => v['zzz']['password'])