pulumi-esc

Manage secrets and configuration across cloud environments using centralized environments that layer settings for dev, staging, and prod. Pulumi ESC provides a unified structure to securely store database passwords and API keys while ensuring consistent deployments across projects.

Pulumi ESC generates dynamic cloud credentials by obtaining short-lived credentials via OIDC for cloud providers. This approach securely provides temporary AWS credentials for CI/CD pipelines, eliminating the need to store long-lived static secrets in your automation systems.

Yes, Pulumi ESC integrates with external secret stores like AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and 1Password. This allows you to connect existing secret management infrastructure and securely pull credentials into your Pulumi environments.

Structure configuration for different staging environments using environment composition to define and layer configurations. Pulumi ESC lets you create distinct dev, staging, and prod environments, linking them to securely manage environment variables and configuration settings.

Set the database_url secret for a production environment using the Pulumi ESC CLI commands. You create the my-app/production environment, then use the CLI to securely inject and manage the database_url secret and other configuration settings.