Guides

How-to guides for consuming Pulumi ESC from the tools you already use. Each page is a self-contained walkthrough — install steps, the YAML or commands you need, and where ESC fits in the flow.

For first-party ESC integrations (the Pulumi Service Provider, Automation API, the VS Code extension, the External Secrets Operator, and the Secrets Store CSI Driver), see Integrations.

Authentication

• Configuring OIDC — set up OpenID Connect trust between ESC and AWS, Azure, GCP, Doppler, Infisical, or Vault.

Use with Pulumi IaC

• Use ESC with Pulumi IaC — how the integration works, plus guides for adopting ESC and migrating existing patterns to it.
• Adopt ESC for config and secrets — move the config and secrets in your stack files into ESC, safely and at scale.
• Migrate from stack references to pulumi-stacks — replace StackReference resources with the ESC pulumi-stacks provider.
• Sync secrets to external platforms — push ESC secrets and config to AWS Secrets Manager, Azure Key Vault, GitHub, Vault, and more.

Run commands

• Run commands with pulumi env run — inject environment values into any command or script.
• Migrate from the ESC CLI — map every esc command to its pulumi env equivalent now that the standalone CLI is retired.

Integrate with external tools

Use ESC with tools that don’t have a dedicated Pulumi-built integration component:

• GitHub Actions — inject ESC values and short-lived cloud credentials into workflows.
• Docker — load environment variables and secrets into Docker workflows.
• direnv — load ESC values automatically when you cd into a directory.
• Terraform — supply temporary credentials and input variables to the Terraform CLI via pulumi env run.
• Cloudflare — manage Cloudflare Workers secrets via ESC.
• Kubernetes cluster access — store and consume kubeconfig files and cluster credentials in ESC.