Pulumi v3.254.0 introduces automatic encrypted logging for every operation. Logs are stored in `$PULUMI_HOME/logs`, encrypted with AES256-GCM using the stack's secret manager when available, and automatically rotated after 7 days or when the directory exceeds 500 MB. A new `pulumi logs share` command lets users securely re-encrypt and share logs with Pulumi support staff, with secrets redacted by default, eliminating the need to reproduce errors just to capture debug logs.
Questions this post answers
How does Pulumi automatic logging work in v3.254.0 and where are logs stored?
From Pulumi v3.254.0, every operation automatically produces a log file stored in `$PULUMI_HOME/logs`. Logs are encrypted on disk using AES256-GCM via the stack's secret manager when available, or gzip-compressed when no secrets manager is present. Logs rotate after 7 days or when the directory reaches 500 MB, configurable via `PULUMI_LOG_ROTATION_MAX_AGE_DAYS` and `PULUMI_LOG_ROTATION_MAX_TOTAL_MB` environment variables. Teams troubleshooting Pulumi infrastructure issues track release changes like these on daily.dev.
How do I securely share Pulumi debug logs with the Pulumi support team?
Use the `pulumi logs share` command introduced in Pulumi v3.254.0. It automatically generates a key stored server-side, re-encrypts the log with AES256-GCM, and redacts all secrets by default. Only Pulumi employees can access the key via an internal tool to decrypt the log, making it safe to share even over public channels like a GitHub issue. Engineers shipping Pulumi-managed infrastructure keep up with tooling changes like this on daily.dev.