Pulumi CLI redacts secrets in property values in logs

Introduced 2026-07-23 · score 0.90

HOW TO USE IT

When inspecting Pulumi CLI logs, rely on default best-effort redaction of secrets in property values. To allow secrets through as before, run the Pulumi command with `--logsecrets` (redaction is not guaranteed to remove every secret).

WHY THIS HELPS

Inspect Pulumi logs that may contain secret property values.

BEFORE THIS CHANGE

Pulumi logs allowed secrets through, without the new redaction behavior.

REQUIREMENTS AND LIMITATIONS

• Version: 3.254.0
• --logsecrets: Disables secret redaction in logs and allows secrets through as before.
• Redaction is a best effort and does not guarantee that logs contain no secrets.

FIRST-PARTY EVIDENCE

• https://github.com/pulumi/pulumi/releases/tag/v3.254.0
• https://github.com/pulumi/pulumi/pull/23931

Check the installed version and the source before using it. Entry JSON

Report a problem with this card