Elevated errors when decrypting ESC environments

What to do

• Check whether your product depends on Pulumi Cloud. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-05-06 19:05 UTC and 2026-04-20 10:30 UTC may need a replay.

• Subscribe to Pulumi Cloud's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=pulumi works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Pulumi Cloud 1

1. resolvedApr 20, 2026, 10:30 AM UTC

   Some Pulumi Cloud organizations experienced elevated errors when decrypting ESC environments. A subset of environment revisions were affected, and those revisions failed to decrypt 100% of the time during the window. Overall, 3.32% of decrypt-attempt requests across Pulumi Cloud failed due to this issue. At the start of the window, we rolled out a change that prevented secret ciphertext copied from an ESC environment from being decrypted in other environments. Customers who had previously copied ciphertext between environments were affected. Users saw a message: “decryption failed. If this secret's ciphertext was copied from a different environment, copy and paste the plaintext instead.” This change was intended as a security improvement, but the customer impact was higher than expected, so the change was rolled back. The ESC team has conducted an internal postmortem to understand the misjudged customer impact, improve our responsiveness to scenarios like this, and created a plan to launch this security improvement without customer disruption.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.