pulumi stack migrate | CLI commands

Migrate a stack from another backend to the currently logged-in backend

Synopsis

Migrate a stack from another backend (e.g. a DIY backend) to the currently logged-in backend.

This command exports the source stack’s checkpoint, creates a new stack on the currently logged-in backend, re-encrypts any encrypted configuration values and stack secrets with the target stack’s secrets provider, and imports the checkpoint into the new stack. If –target names the stack differently from the source, every URN in the imported state is rewritten to reference the new name. The source stack’s backend state is left untouched.

Note: if the source and target stacks share a name, the local Pulumi..yaml file is rewritten with the target’s secrets configuration. The pre-migration content is saved as a sibling Pulumi.<stack>.yaml.bak.* backup so you can recover the source’s secrets metadata if needed.

To migrate a stack from a DIY backend (e.g. file://, s3://, azblob://, gs://) to the currently logged-in Pulumi Cloud backend:

• pulumi stack migrate file://~ my-app-production

To target a specific organization on Pulumi Cloud, supply the fully qualified target stack name:

• pulumi stack migrate s3://my-bucket production --target acmecorp/my-app/production

If no stack name is given and the terminal is interactive, you will be prompted to choose one from the source backend, like pulumi stack select.

To use a non-default secrets provider for the target stack, pass --secrets-provider. Valid values are the same as those accepted by pulumi stack init: default, passphrase, awskms, azurekeyvault, gcpkms, hashivault.

pulumi stack migrate <url> [stack-name] [flags]

Options

  -f, --force                            Force the migration to proceed even if the source state fails integrity checks.
  -h, --help                             help for migrate
      --secrets-provider string          The type of the provider that should be used to encrypt and decrypt secrets
                                         (possible choices: default, passphrase, awskms, azurekeyvault, gcpkms, hashivault) (default "default")
      --target <org>/<project>/<stack>   The name of the stack to create in the target backend. Defaults to the source stack name. For Pulumi Cloud, may be qualified as <org>/<project>/<stack>
  -y, --yes                              Skip confirmation prompts and proceed

Options inherited from parent commands

      --color string                 Colorize output. Choices are: always, never, raw, auto (default "auto")
  -C, --cwd string                   Run pulumi as if it had been started in another directory
      --disable-integrity-checking   Disable integrity checking of checkpoint files
  -e, --emoji                        Enable emojis in the output
  -Q, --fully-qualify-stack-names    Show fully-qualified stack names
      --logflow                      Flow log settings to child processes (like plugins)
      --logtostderr                  Log to stderr instead of to files
      --memprofilerate int           Enable more precise (and expensive) memory allocation profiles by setting runtime.MemProfileRate
      --non-interactive              Disable interactive mode for all commands
      --otel-traces string           Export OpenTelemetry traces to the specified endpoint. Use file:// for local JSON files, grpc:// or https:// for remote collectors
      --profiling string             Emit CPU and memory profiles and an execution trace to '[filename].[pid].{cpu,mem,trace}', respectively
  -s, --stack string                 The name of the stack to operate on. Defaults to the current stack
      --tracing file:                Emit tracing to the specified endpoint. Use the file: scheme to write tracing data to a local file
  -v, --verbose int                  Enable verbose logging (e.g., v=3); anything >3 is very verbose

SEE ALSO

• pulumi stack - Manage stacks and view stack state