pulumi/pulumi · error

decrypting secrets: %w

Error message

decrypting secrets: %w

What it means

Wraps a failure from ssml.GetDecrypter when `pulumi stack history --show-secrets` cannot construct a secret decrypter for the stack. This typically means the secrets provider (passphrase, cloud KMS, or service provider) is misconfigured or unreachable, so historical encrypted config values cannot be decrypted.

Source

Thrown at pkg/cmd/pulumi/stack/stack_history.go:106

			}
			b := s.Backend()
			updates, err := b.GetHistory(ctx, s.Ref(), pageSize, page)
			if err != nil {
				return fmt.Errorf("getting history: %w", err)
			}
			var decrypter config.Decrypter
			if showSecrets {
				project, _, err := ws.ReadProject("")
				if err != nil {
					return fmt.Errorf("loading project: %w", err)
				}
				ps, err := LoadProjectStack(ctx, cmdutil.Diag(), project, s, "")
				if err != nil {
					return fmt.Errorf("getting stack config: %w", err)
				}
				crypter, state, err := ssml.GetDecrypter(ctx, s, ps)
				if err != nil {
					return fmt.Errorf("decrypting secrets: %w", err)
				}
				if state != SecretsManagerUnchanged {
					if err = SaveProjectStack(ctx, s, ps, ""); err != nil {
						return fmt.Errorf("saving stack config: %w", err)
					}
				}
				decrypter = crypter
			}

			if showSecrets {
				Log3rdPartySecretsProviderDecryptionEvent(ctx, s, "", "pulumi stack history")
			}

			return output.Get()(cmd.OutOrStdout(), updates, decrypter)
		},
	}

	constrictor.AttachArguments(cmd, constrictor.NoArgs)

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Set PULUMI_CONFIG_PASSPHRASE (or PULUMI_CONFIG_PASSPHRASE_FILE) to the correct passphrase and retry
2. Verify cloud KMS credentials/key access (AWS/GCP/Azure env vars, roles) if using a KMS-backed provider
3. Check the `secretsprovider` value in Pulumi.<stack>.yaml matches the provider used to encrypt
4. Run `pulumi stack change-secrets-provider` if the provider needs to be re-keyed

Example fix

// before
pulumi stack history --show-secrets   # PULUMI_CONFIG_PASSPHRASE unset

// after
export PULUMI_CONFIG_PASSPHRASE="my-secret-passphrase"
pulumi stack history --show-secrets

grep -q secretsprovider Pulumi.dev.yaml && [ -n "$PULUMI_CONFIG_PASSPHRASE" ] && echo decrypter-ready || echo missing-passphrase

out, err := exec.Command("pulumi", "stack", "history", "--show-secrets").CombinedOutput()
if err != nil && strings.Contains(string(out), "decrypting secrets") {
    // check PULUMI_CONFIG_PASSPHRASE / KMS credentials before retry
}

When it happens

Trigger: Running `pulumi stack history --show-secrets` when the stack's secrets provider fails to initialize: missing PULUMI_CONFIG_PASSPHRASE for the passphrase provider, inaccessible KMS key, or changed/lost secretsprovider setting.

Common situations: PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE not set (or wrong) in the environment/CI, cloud KMS credentials absent, team changed the secrets provider so old history entries can't be decrypted.

Related errors

• constructing secrets manager of type %q: %w
• value looks like a secret; rerun with --secret to mark it as
• internal error decoding value; try surrounding the argument
• internal error: marshaling secret: %w
• config value for '%s' looks like a secret; rerun with --secr

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/d9c9fcc85e3b57a9. Report an issue: GitHub.