CriticalFile-scopeJavaScript / TypeScript Plug & play

Pulumi TS: secrets must use Config.requireSecret

In Pulumi TypeScript programs, load sensitive values with new Config().requireSecret and pass as Secret<T>, never plain strings.

Add to Mesrai Open workspace

Why this matters

Secrets stay encrypted in state and are redacted in logs.

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

import * as pulumi from "@pulumi/pulumi";
const dbPassword = "supersecret";
export const pass = dbPassword;

Prefer

import * as pulumi from "@pulumi/pulumi";
const cfg = new pulumi.Config();
const dbPassword = cfg.requireSecret("dbPassword");
export const pass = dbPassword;

More snippets

Good

const s = new pulumi.Config().requireSecret("dbPassword");

Bad

const s = process.env.DB_PASSWORD;

Related rules

From the same buckets as this rule.

Critical
Disallow public ingress without explicit allowlist
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
infra-as-codesecurity-hardening+1
Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
High
Default-deny NetworkPolicy required when adding a namespace
If a PR introduces workloads in a namespace that lacks a default-deny NetworkPolicy, add one plus explicit allow rules.
infra-as-codesecurity-hardening+1

Why this matters

Bad vs. good

More snippets

Related rules

Disallow public ingress without explicit allowlist

Pods must run as non-root with read-only root filesystem

Default-deny NetworkPolicy required when adding a namespace

Why this matters

Bad vs. good

More snippets

Related rules

Disallow public ingress without explicit allowlist

Pods must run as non-root with read-only root filesystem

Default-deny NetworkPolicy required when adding a namespace