Is it just me or unsecret isn t doing anything

Question

agreeable-eye-87399 · Answer

can you give an example I m not 100 sure

high-grass-3103 · Answer

```pulumi unsecret cfg requireSecret password apply <http pulumi log info|pulumi log info> ``` results with secret

miniature-musician-31262 · Answer

I ve hit this myself It s working but the CLI will essentially never emit a secret value even one that s been unwrapped because all secret values are masked as ` secret ` I ll see if I can dig up a reference for you

miniature-musician-31262 · Answer

Ok my question was asked and answered in another Slack so I can t link directly to it but the gist is that the CLI masks all secret config with ` secret ` <https github com pulumi pulumi blob master pkg engine events go L208 L225>

high-grass-3103 · Answer

But secret values used as inputs are unwrapped anyway What s the purpose of explicit unwrap

miniature-musician-31262 · Answer

TBH I don t have a use case off the top of my head but I m sure someone else could come up with one slightly smiling face One thing that might be relevant is that only explicitly unwrapped secrets are surfaceable as plain text in checkpoint state files e g given the following code

miniature-musician-31262 · Answer

You end up with this in the state file

miniature-musician-31262 · Answer

But you re right that you re generally able to extract a raw string write that string to a file etc without having to explicitly unwrap it I suspect there are cases where unsecret is either useful or necessary I just haven t yet hit one myself slightly smiling face Hope this helps though

high-grass-3103 · Answer

Cheers

high-grass-3103 · Answer

I guess I m looking for ```pulumi output show secrets```

miniature-musician-31262 · Answer

oh yes if you ve defined secrets as outputs then you can absolutely do this slightly smiling face