Search code examples
pulumiamazon-kms

Is exposing Pulumi ecnryptedKey safe?

I have a stack that utilizes AWS KMS key for, I believe, secrets and state encryption in Pulumi stack configuration file Pulumi..yaml

enter image description here

Is it safe to expose this in a public repository? As I understand secrets are stored within stack configuration files as well in encrypted form; would it be reasonably safe to expose those as well in a public repository?

How exactly this key is generated and what are the inner mechanics behind secrets management in Pulumi?

Solution

  • Yes, exposing these values in your code is complete safe.

    The key is asymmetrically encrypted using your key provider, in this case an AWS KMS key, its only possible to retrieve the value if someone has access to the AWS KMS key itself to decrypt the value, and even then, is a bit of a hoop jumping exercise.

    I expose these values myself in source control, so you should be absolutely okay to leave them in your repo