Pulumi ESC

Secrets composition layer: pull from Vault/AWS/Doppler and expose to any runtime

Secrets ManagementFree tier; Team from $50/user/mo; Business from $90/user/mo
How we work:This listing is aggregated from Pulumi ESC's official documentation, public pricing pages, community discussions (Reddit, HN, forums), and real user feedback. We do not do hands-on testing. We aggregate and organize what's already out there. Last verified April 2026.

What is Pulumi ESC?

Pulumi ESC (Environments, Secrets, Configuration) is a secrets and configuration platform that lets you compose environments from multiple secret sources (AWS, Vault, Doppler, 1Password) and expose them as environment variables, files, or direct SDK calls. ESC is tightly integrated with Pulumi's infrastructure-as-code platform but works as a standalone tool too.

Best for: Teams using Pulumi for IaC who need a secrets layer that composes multiple backends
Pros
  • ✓ Sits cleanly on top of existing secrets stores — no migration needed
  • ✓ Composition model makes multi-cloud environments simple
  • ✓ Strong fit if you already use Pulumi for IaC
  • ✓ OIDC-based auth eliminates static Pulumi tokens
Cons
  • ✗ Newer product; smaller community than Doppler/Infisical
  • ✗ Best value only realized if you adopt Pulumi IaC too
  • ✗ Per-user pricing at the Team tier is steep
  • ✗ No self-hosted option

Key Features

→Compose environments from multiple secret sources
→Providers for AWS, Azure, GCP, Vault, Doppler, 1Password, GitHub
→Environment variables, file, or SDK access modes
→Versioned environments with rollback
→Rotation schedules and OIDC-based auth
→Native integration with Pulumi IaC
→ESC CLI and REST API
→Works with non-Pulumi workflows (CI/CD, runtime apps)
→Audit logs and access policies
→RBAC with role-based environment access

What People Are Saying

Real discussions and resources from the community.

Pulumi ESC discussions on Pulumi Community
GitHub
Quick Info
PricingFree tier; Team from $50/user/mo; Business from $90/user/mo
ModelPer-user tiers
Founded2024
CloudYes
Self-HostedNo
Rating4.1/5
Visit Website →

Last updated: Apr 23, 2026

Pulumi ESC Alternatives
View All Alternatives
Doppler
Developer-first universal secrets management platform...Infisical
Open-source end-to-end encrypted secrets management for team...HashiCorp Vault
Industry-standard open-source secrets management platform...External Secrets Operator
K8s operator that syncs secrets from external stores into Ku...
Certifications
SOC 2 Type 2