https://pulumi.com
Join Slack
This message was deleted.
# general
s
This message was deleted.
b
lots of options here, putting secrets in Secrets Manager is a good idea. • you can still store the secret in Pulumi config • You would then store that secret in secrets manager using 
SecretsVersion
: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secretversion/ • you can also take the Output from your Pulumi database creation and store it directly, instead of ever storing it in config • you then need to get that secret into you app, which is up to you. Depends on how you're running your application, are you using ECS or something else?
I can maybe put an example together for you using something like wordpress if that helps?
c
An example would be super helpful 🙂 Re: "how are you running your app" it's primarily going to be running on EKS, though I expect we might end up with some vanilla EC2 instances as well, at least when doing testing and dev.
Regarding using SecretsVersions - it sounds like in that case the secret starts off in Pulumi's config and then is put in SM. I was thinking of using SM as the canonical/originating source for secrets, because it also solves the problem of having a system that people can look at to see what the secrets are - eg if I need to give an engineer the database credentials so they can connect locally. Secrets could still go into Pulumi's config for doing Pulumi things, but the canonical home would be SM. Though I don't know if that's a good idea
Oh I just remembered that Pulumi's config files are encrypted and get checked into Git. So the secrets could safely start off in Pulumi and then be put in SM...
b
@crooked-laptop-67565 something I often advocate for in these situations is using pulumi-random to generate a password per stack, sotring that in secrets manager and then having users who need that password grabbing it from there or from the Pulumi stack output, as it'd audited that way
c
Oh I like that idea
b
4 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by