Pulumi Esc

This handles secrets and config management for Pulumi through their ESC service. You get centralized storage, dynamic OIDC credentials for AWS/Azure/GCP, and integration with external vaults like 1Password or HashiCorp Vault. The main value is composable environments that layer base config with cloud-specific and stack-specific settings, all version controlled with RBAC. Commands are straightforward: pulumi env init to create, pulumi env set for values, pulumi config env add to link to stacks. One thing to note is the distinction between get (shows structure, hides secrets) and open (resolves everything including credentials), which matters when you're debugging versus just checking configuration layout.

skills.sh installs: 1.5K
GitHub stars: 79
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add pulumi/agent-skills --skill pulumi-esc --agent claude-code

Installs into .claude/skills of the current project.

Files

Pulumi ESC (Environments, Secrets, and Configuration)

Pulumi ESC is a centralized service for managing environments, secrets, and configuration across cloud infrastructure and applications.

What is ESC?

ESC enables teams to:

Centralize secrets and configuration in one secure location
Compose environments by importing and layering configuration
Generate dynamic credentials via OIDC for AWS, Azure, GCP
Integrate external secret stores (AWS Secrets Manager, Azure Key Vault, Vault, 1Password)
Version and audit all configuration changes
Control access with fine-grained RBAC

Essential CLI Commands

# Create a new environment
pulumi env init <org>/<project-name>/<environment-name>

# Edit environment (opens in editor)
pulumi env edit <org>/<project-name>/<environment-name>

# Set values
pulumi env set <org>/<project-name>/<environment-name> <key> <value>
pulumi env set <org>/<project-name>/<environment-name> <key> <value> --secret

# View definition (secrets hidden)
pulumi env get <org>/<project-name>/<environment-name>

# Open and resolve (reveals secrets)
pulumi env open <org>/<project-name>/<environment-name>

SKILL.md on GitHub