Skip to main content
Sign in Dashboard Get started
  1. Docs
  2. Secrets & Configuration
  3. Providers

Providers

    Reference catalog of every first-party plugin shipped with Pulumi ESC. For an introduction to the plugin model — how providers and rotators differ, when each runs, and how they fit into the evaluation flow — see Providers and rotators.

    Login providers

    Issue short-lived credentials for downstream services. Prefer OpenID Connect over static keys where supported; see OIDC setup for per-provider trust configuration.

    ProviderDescription
    aws-loginLog in to AWS using OIDC or static credentials.
    azure-loginLog in to Azure using OIDC or static credentials.
    doppler-loginLog in to Doppler using OIDC.
    gcp-loginLog in to Google Cloud using OIDC or static credentials.
    gh-loginLog in to GitHub using app credentials.
    infisical-loginLog in to Infisical using OIDC or static credentials.
    snowflake-loginAuthenticate to Snowflake using OIDC.
    vault-loginLog in to HashiCorp Vault using OIDC or static credentials.

    Secrets and configuration providers

    Dynamically import values from an external system of record into your environment. Invoked through fn::open::<name>.

    ProviderDescription
    1password-secretsImport secrets from 1Password.
    aws-parameter-storeImport parameters from AWS Systems Manager Parameter Store.
    aws-secretsImport secrets from AWS Secrets Manager.
    azure-secretsImport secrets from Azure Key Vault.
    doppler-secretsImport secrets from Doppler.
    gcp-secretsImport secrets from Google Cloud Secret Manager.
    infisical-secretsImport secrets from Infisical.
    vault-secretsImport secrets from HashiCorp Vault.
    pulumi-stacksImport outputs from a Pulumi stack (includes Terraform state stored in Pulumi Cloud).
    terraform-stateImport outputs from a Terraform state file in S3 or Terraform Cloud.
    externalImport secrets from a custom service adapter.

    Rotators

    Replace a stored credential with a freshly issued one, manually or on a schedule. Invoked through fn::rotate::<name>. Some rotators need a rotation connector to reach targets in private networks.

    RotatorRequired connectorDescription
    aws-iamNoneRotate access credentials for an AWS IAM user.
    azure-app-secretNoneRotate client secrets for an Azure app registration.
    mysqlaws-lambda (private networks only)Rotate user credentials for a MySQL database.
    passwordNoneRotate any user-defined key using password generation rules.
    passphraseNoneRotate any user-defined key using memorable passphrase generation rules.
    postgresaws-lambda (private networks only)Rotate user credentials for a PostgreSQL database.
    snowflake-userNoneRotate RSA keypairs for a Snowflake user.
    externalNoneRotate credentials using a custom service adapter.