Is it not possible to lock down

Pulumi,<stack>.yaml

in a way that you can encrypt secrets, but not decrypt them? Apparently having

Microsoft.KeyVault/vaults/keys/encrypt/action

is not enough, one also needs decrypt?

no, that’s not possible. Anyone who runs the CLI need to decrypt the secret in order to send it to the cloud provider API

So the CLI requires me to decrypt every secret in the file, if I want to add a new line? In my head this is not an encrypt operation so I would expect it not to need PK access.

I’m not following I’m afraid, what do you mean “add a new line” ?

I wanted to be able to add new secrets to a config without having to decrypt (azure kv rbac with only encrypt). But after reading more it seems pulumi uses a symmetric and not asymmetric approach so it had to decrypt its key within the confit. Right?

yes that’s correct

Thanks, I was a bit confused but the docs clears that up as well 👍🏻

there’s no way around it no

Thanks for the help, @billowy-army-68599 ☺️