Pulumi "constructing secrets manager: incorrect passphrase" in CI

By Kaveh Alemi·Latchkey

Pulumi received a passphrase but it does not decrypt the stack config, so it reports an incorrect passphrase. The variable is present; its value is simply wrong for this stack.

What this error means

A Pulumi step fails with "error: constructing secrets manager of type passphrase: incorrect passphrase". Unlike the "must be set" error, the variable is populated, just not the right value.

error: constructing secrets manager of type "passphrase": incorrect passphrase

Common causes

The secret holds the wrong passphrase

The CI secret was rotated, mistyped, or copied from a different stack, so it no longer matches what encrypted this stack.

Trailing whitespace or newline in the secret

A stored passphrase with a trailing newline decrypts differently than the original, so Pulumi rejects it.

How to fix it

Set the exact passphrase that encrypted the stack

1. Confirm which passphrase was used when the stack was created or last re-encrypted.
2. Update the CI secret to that exact value with no extra whitespace.
3. Re-run the Pulumi command.

env:
  PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

Re-encrypt the stack if the passphrase was lost

If the original passphrase is unrecoverable, change the secrets provider so config is re-encrypted under a known passphrase or a cloud KMS key.

pulumi stack change-secrets-provider passphrase

How to prevent it

• Store one canonical passphrase per stack in a secrets manager.
• Avoid trailing newlines when writing the secret value.
• Rotate the passphrase deliberately and re-encrypt config when you do.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation