Pulumi "error: getting secrets manager" - Fix Secrets Provider

By Daniel Zoghalchali·Latchkey

Pulumi needs the stack’s secrets provider to decrypt encrypted config values. In CI the passphrase or KMS key the stack was created with is missing, so it cannot construct the secrets manager.

What this error means

Any Pulumi command that touches config (up, preview, config) fails before doing real work, complaining it cannot get the secrets manager - usually because PULUMI_CONFIG_PASSPHRASE is unset or the configured KMS key is inaccessible to the runner.

pulumi output

error: getting secrets manager: passphrase must be set with
PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables

Common causes

Passphrase not provided in CI

A passphrase-encrypted stack needs PULUMI_CONFIG_PASSPHRASE (or _FILE) in the environment. Without it, Pulumi cannot build the secrets manager and aborts immediately.

KMS / cloud secrets provider unreachable

If the stack uses awskms://, gcpkms://, or similar, the runner’s credentials must allow decrypt on that key. Missing IAM permission or the wrong region makes the provider unavailable.

How to fix it

Supply the passphrase as a secret

Provide the exact passphrase the stack was created with via a CI secret - never hard-code it.

.github/workflows/deploy.yml

- run: pulumi up --yes --stack org/proj/dev
  env:
    PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

Grant decrypt on the KMS key

Confirm the secrets provider with pulumi stack export | grep secretsprovider or the stack settings file.
Ensure the runner’s role can kms:Decrypt (and kms:Encrypt for new secrets) on that key.
Set the correct AWS_REGION/GOOGLE_PROJECT so the key resolves.

How to prevent it

Store the passphrase or KMS key reference in your CI secret store and inject it for every Pulumi step.
Use a cloud KMS secrets provider with an IAM role the runner already assumes, rather than a shared passphrase.
Document the secrets provider per stack so new pipelines wire it correctly.

Frequently asked questions

What causes ""getting secrets manager""?

A passphrase-encrypted stack needs PULUMI_CONFIG_PASSPHRASE (or _FILE) in the environment. Without it, Pulumi cannot build the secrets manager and aborts immediately.

How do I fix "getting secrets manager"?