We need to rotate some secrets manually on some Azure resources. Our idea is to change the secondary secret, update our services to use that secret and then change the primary secret. So this way there should be no downtime.

As Pulumi has to access a few of those resources the configuration to those are stored in its stack. As we do not want to change the secrets by Pulumi-code but manually, is Pulumi “smart” enough to update either the primary or secondary secret if we run a pulumi up including a resource that had changed only one of those secrets?

So the idea is:

1. Change secondary secret from a blob storage for example
2. Run pumuli refresh/up. (Expectation: Pulumi updates its secondary secret, too, because the primary still works)
3. Change primary secret
4. Run pulumi refresh/up (Expectation: Pulumi now updates its primary secret for that resource in its stack because it already knows the secondary)
5. Everything works as if nothing happened.

Does it work this way or do we have to modify the pulumi-stacks manually?