Infisical Provider - Khanh Docs

The Infisical provider enables you to manage secrets, projects, and access controls in Infisical using Pulumi. This provider is dynamically bridged from the Terraform Infisical Provider.

Installation#

Install the Infisical provider package using your preferred package manager:

bun add pulumi-infisical

pnpm add pulumi-infisical

yarn add pulumi-infisical

npm install pulumi-infisical

Configuration#

Getting Service Token#

Log in to Infisical at app.infisical.com
Navigate to your project → Settings → Service Tokens
Create a new service token
Copy the token value

Provider Setup#

pulumi config set infisical:token YOUR_SERVICE_TOKEN --secret

Or using environment variables:

export INFISICAL_TOKEN="your-service-token"

Self-Hosted Infisical#

If you're using a self-hosted Infisical instance, configure the custom host URL:

pulumi config set infisical:hostUrl https://infisical.your-domain.com

Or using environment variables:

export INFISICAL_HOST_URL="https://infisical.your-domain.com"

import * as pulumi from "@pulumi/pulumi";import * as infisical from "pulumi-infisical";// Configure provider for self-hosted instanceconst provider = new infisical.Provider("self-hosted", {    hostUrl: "https://infisical.your-domain.com",    token: config.requireSecret("token"),});// Use the providerconst project = new infisical.Project("project", {    name: "Backend Service",    slug: "backend-service",}, { provider });

Quick Start#

import * as pulumi from "@pulumi/pulumi";import * as infisical from "pulumi-infisical";// Create a projectconst project = new infisical.Project("api-project", {    name: "API Service",    slug: "api-service",});// Create a secretconst secret = new infisical.Secret("api-key", {    projectId: project.id,    environment: "production",    key: "API_KEY",    value: "super-secret-value",});export const projectId = project.id;

Key Features#

Project Management#

const project = new infisical.Project("backend-project", {    name: "Backend Service",    slug: "backend-service",});

Secret Management#

const secret = new infisical.Secret("database-password", {    projectId: project.id,    environment: "production",    key: "DATABASE_PASSWORD",    value: dbPassword,    type: "shared",});

Identity Management#

const identity = new infisical.Identity("api-identity", {    name: "API Service",    roleSlug: "developer",    projectId: project.id,});