s3_bucket_stack.yaml

apiVersion: v1
kind: Secret
metadata:
  name: pulumi-aws-secrets
type: Opaque
stringData:
  AWS_ACCESS_KEY_ID: "<REDACTED: AWS_ACCESS_KEY_ID>"
  AWS_SECRET_ACCESS_KEY: "<REDACTED: AWS_SECRET_ACCESS_KEY>"
  AWS_SESSION_TOKEN: "<REDACTED: AWS_SESSION_TOKEN>"
---
apiVersion: pulumi.com/v1
kind: Stack
metadata:
  name: s3-bucket-stack
spec:
  backend: "s3://<S3 BUCKET>"
  secretsProvider: "awskms:///<KMS KEY ARN>?region=<REGION>"
  envRefs:
    AWS_DEFAULT_REGION:
      type: Literal
      literal:
        value: <REGION>
    AWS_ACCESS_KEY_ID:
      type: Secret
      secret:
        name: pulumi-aws-secrets
        key: AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY:
      type: Secret
      secret:
        name: pulumi-aws-secrets
        key: AWS_SECRET_ACCESS_KEY
    AWS_SESSION_TOKEN:
      type: Secret
      secret:
        name: pulumi-aws-secrets
        key: AWS_SESSION_TOKEN
  stack: "s3backend.s3-op-project.dev"
  projectRepo: https://github.com/joeduffy/test-s3-op-project
  commit: 3edeafe930e2121358f56c7a9adc41f18505149e
  config:
    aws:region: us-east-2