Skip to main content
Sign in Dashboard Get started
  1. Docs
  2. Secrets & Configuration
  3. Providers
  4. Rotators
  5. password

password

    The password rotator enables you to rotate any user-defined key by generating random passwords.

    If you want to generate memorable passphrases use the passphrase rotator

    Example

    The password rotator can be configured for any user-defined key.

    values:
  mypassword:
    fn::rotate::password:
      inputs:
        minLower: 2
        minUpper: 3
        minSpecial: 5
        overrideSpecial: "!@#$%&*()-_=+[]{}<>:"
        length: 15

    The previous example will generate passwords like: wn#ZQH}z$[H_&h*

    When you open the environment, you should see output similar to the following:

    {
  "mypassword": {
    "current": "[secret]",
    "previous": "[secret]"
  }
}

    Schema reference

    Reference schemas last updated on 2026-07-11, synced automatically from the Pulumi Cloud ESC API.

    Inputs

    Options for generating random passwords.

    • length number optional
      The length of the generated password.
    • lower boolean optional
      Whether or not to include lowercase characters.
    • minLower number optional
      The minimum number of lowercase characters to include.
    • minNumeric number optional
      The minimum number of numeric characters to include.
    • minSpecial number optional
      The minimum number of special characters to include.
    • minUpper number optional
      The minimum number of uppercase characters to include.
    • numeric boolean optional
      Whether or not to include numbers.
    • overrideSpecial string optional
      The special characters to choose from.
    • special boolean optional
      Whether or not to include special characters.
    • upper boolean optional
      Whether or not to include uppercase characters.

    State

    • current string optional
      The most recently generated password.
    • previous string optional
      The prior generated password.

    Outputs

    • current string optional
      The most recently generated password.
    • previous string optional
      The prior generated password.

    Troubleshooting

    SymptomLikely causeResolution
    Rotation fails with an invalid input errorlength is outside 8–100, or the sum of minLower, minUpper, minNumeric, and minSpecial exceeds length.Set length within range and lower the minimum-count inputs so they fit within the password length.
    Generated passwords are missing a character classThe class is disabled (lower, upper, numeric, or special set to false) or its minimum is 0.Enable the character class and set its corresponding minimum to require at least one character.