{"record":{"id":"d9c9fcc85e3b57a9","repo":"pulumi/pulumi","slug":"decrypting-secrets-w","errorCode":null,"errorMessage":"decrypting secrets: %w","messagePattern":"decrypting secrets: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/stack/stack_history.go","lineNumber":106,"sourceCode":"\t\t\t}\n\t\t\tb := s.Backend()\n\t\t\tupdates, err := b.GetHistory(ctx, s.Ref(), pageSize, page)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"getting history: %w\", err)\n\t\t\t}\n\t\t\tvar decrypter config.Decrypter\n\t\t\tif showSecrets {\n\t\t\t\tproject, _, err := ws.ReadProject(\"\")\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"loading project: %w\", err)\n\t\t\t\t}\n\t\t\t\tps, err := LoadProjectStack(ctx, cmdutil.Diag(), project, s, \"\")\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"getting stack config: %w\", err)\n\t\t\t\t}\n\t\t\t\tcrypter, state, err := ssml.GetDecrypter(ctx, s, ps)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"decrypting secrets: %w\", err)\n\t\t\t\t}\n\t\t\t\tif state != SecretsManagerUnchanged {\n\t\t\t\t\tif err = SaveProjectStack(ctx, s, ps, \"\"); err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"saving stack config: %w\", err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tdecrypter = crypter\n\t\t\t}\n\n\t\t\tif showSecrets {\n\t\t\t\tLog3rdPartySecretsProviderDecryptionEvent(ctx, s, \"\", \"pulumi stack history\")\n\t\t\t}\n\n\t\t\treturn output.Get()(cmd.OutOrStdout(), updates, decrypter)\n\t\t},\n\t}\n\n\tconstrictor.AttachArguments(cmd, constrictor.NoArgs)","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/stack/stack_history.go#L88-L124","documentation":"Wraps a failure from ssml.GetDecrypter when `pulumi stack history --show-secrets` cannot construct a secret decrypter for the stack. This typically means the secrets provider (passphrase, cloud KMS, or service provider) is misconfigured or unreachable, so historical encrypted config values cannot be decrypted.","triggerScenarios":"Running `pulumi stack history --show-secrets` when the stack's secrets provider fails to initialize: missing PULUMI_CONFIG_PASSPHRASE for the passphrase provider, inaccessible KMS key, or changed/lost secretsprovider setting.","commonSituations":"PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE not set (or wrong) in the environment/CI, cloud KMS credentials absent, team changed the secrets provider so old history entries can't be decrypted.","solutions":["Set PULUMI_CONFIG_PASSPHRASE (or PULUMI_CONFIG_PASSPHRASE_FILE) to the correct passphrase and retry","Verify cloud KMS credentials/key access (AWS/GCP/Azure env vars, roles) if using a KMS-backed provider","Check the `secretsprovider` value in Pulumi.<stack>.yaml matches the provider used to encrypt","Run `pulumi stack change-secrets-provider` if the provider needs to be re-keyed"],"exampleFix":"// before\npulumi stack history --show-secrets   # PULUMI_CONFIG_PASSPHRASE unset\n\n// after\nexport PULUMI_CONFIG_PASSPHRASE=\"my-secret-passphrase\"\npulumi stack history --show-secrets","handlingStrategy":"validation","validationCode":"grep -q secretsprovider Pulumi.dev.yaml && [ -n \"$PULUMI_CONFIG_PASSPHRASE\" ] && echo decrypter-ready || echo missing-passphrase","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"pulumi\", \"stack\", \"history\", \"--show-secrets\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"decrypting secrets\") {\n    // check PULUMI_CONFIG_PASSPHRASE / KMS credentials before retry\n}","preventionTips":["Set PULUMI_CONFIG_PASSPHRASE in CI via secret store, not plain env files","Document the stack's secrets provider for the team","Test KMS key access from CI before running show-secrets commands"],"tags":["cli","secrets","decrypter","kms"],"backgroundTag":"secret-decryption-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}