Hi, I'm new to plumi and trying to run the cli inside AWS code build. I'm using an

S3

bucket as the backend. I believe the

Pulumi.<stack>.yaml

should not be committed (pls correct me if I'm wrong). May I please know the recommended way of setting the configs? Should I set the each config from environment variable using

pulumi config set/set-all

command? If so How should I set the

secretsprovider

and the

encryptedkey

? Or can I retrieve those configs from backend?

I believe the

Pulumi.<stack>.yaml

should not be committed

You should commit it if others are using the same stack.

Should I set the each config from environment variable using

pulumi config set/set-all

command?

If you've just got an envvar that controls things you could just read the envvar in your pulumi program, it doesn't have to go via config.

If so How should I set the

secretsprovider

and the

encryptedkey

?

Those should normally be set for you on stack initialisation.

Thanks @echoing-dinner-19531

Hi Fraser ! Please let me know if a separate post is required. But when you said committed, is it possible for Pulumi to look for the

Pulumi.<STACK>.yaml

file from another location say S3 bucket or Github? Something like this perhaps

pulumi preview -s STACK_NAME --config-file <s3://pulumi-backend-aws/stack_files/Pulumi.STACK_NAME.yaml>

Not really. There is the

stackConfigDir

option in Pulumi.yaml (https://www.pulumi.com/docs/reference/pulumi-yaml/) but that's just a folder path (and the docs do say relative to Pulumi.yaml, although I suspect an absolute path there would happen to work)

Oh k. The use case was to try to save the STACK file somewhere while using a self managed backend.

Hi Sushant & Fraser, I'm wondering if it is ok to make

encryptionSalt

value visible in

Pulumi.<STACK>.yaml

file in a public git repository.

Salts are not secrets, so yes this should be ok

Thanks a lot @echoing-dinner-19531