Prompt: Enter your passphrase to unlock config/secrets on every Pulumi command

Prompt: Enter your passphrase to unlock config/secrets (set PULUMICONFIGPASSPHRASE or PULUMICONFIGPASSPHRASE_FILE to remember)

TL;DR

This is a prompt, not an error. Your stack encrypts secrets with a passphrase. Export PULUMI_CONFIG_PASSPHRASE (or use the _FILE variant) so Pulumi stops asking, or upgrade the CLI so read-only commands no longer need it.

The prompt

Enter your passphrase to unlock config/secrets
    (set PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE to remember):

Fix it

1. For the current shell: export PULUMI_CONFIG_PASSPHRASE='[your passphrase]'.

   • Success check: the next pulumi command runs without prompting.

2. For persistence without the value in shell history, write the passphrase to a file and export PULUMI_CONFIG_PASSPHRASE_FILE=[path].

   • Success check: new shells pick it up from your profile.

3. In CI, store the passphrase as a secret env var on the job and export it before any Pulumi step. Never commit it.

   • Success check: unattended runs never block on the prompt.

4. If you only run read-only commands (stack output without --show-secrets, about), upgrade the CLI: recent versions mask secrets as [secret] instead of prompting.

   • Success check: those commands work with no passphrase set.

When to use this

You see this prompt on every Pulumi command for a passphrase-encrypted stack and want it gone.

When NOT to use this

Do not set a different passphrase than the stack was created with. That fails with "passphrase must be the same as the last time the stack was updated", which is a different problem.

Compatibility

Pulumi CLI 3.x, passphrase secrets provider.

Variants

• Enter your passphrase to protect config/secrets: (at pulumi stack init time, when choosing the passphrase)
• Re-enter your passphrase to confirm: (the confirmation half of the same flow)

Root cause

Passphrase-encrypted stacks need the passphrase to derive the data key for any state access. Without it in the environment, the CLI prompts interactively, which hangs CI and annoys humans.

Edge cases

• Typing the passphrase at the prompt works, but every new shell asks again. The env var is the durable fix.
• --show-secrets always needs the real passphrase, even on new CLIs. There is no read-only bypass for revealing secrets.