tool · inferred from evidence
pulumi change-secrets-provider
A Pulumi CLI command to migrate between secrets providers (e.g., passphrase to KMS).
- Error: passphrase must be the same as the last time the stack was updated
Fixes Pulumi rejecting a changed secrets passphrase on an existing stack. For engineers who rotated PULUMI_CONFIG_PASSPHRASE and now cannot update, the passphrase is baked into state encryption and cannot be changed in place.