[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-pulumi-pulumi-overview":3,"mdc-augmkk-key":30,"related-org-pulumi-pulumi-overview":3224,"related-repo-pulumi-pulumi-overview":3378},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":20,"repoUrl":21,"updatedAt":22,"license":23,"forks":24,"topics":25,"repo":26,"sourceUrl":28,"mdContent":29},"pulumi-overview","manage cloud infrastructure with Pulumi","Use this skill for any task that creates, modifies, inspects, or destroys cloud infrastructure or SaaS configuration, from one-off CLI operations to full multi-resource projects, across providers in the Pulumi ecosystem. A typical project spans many providers (AWS or Azure or GCP, Kubernetes, Cloudflare, Auth0, Datadog, Vercel, and others), and Pulumi drives them through one CLI, one state model, and one credential layer. Trigger even when the user does not name Pulumi; phrasings like \"deploy this app,\" \"provision a database,\" \"stand up a VPC,\" \"configure Auth0,\" \"set up Datadog monitoring,\" or \"tear down staging\" qualify. Also trigger for tasks that migrate, port, or convert existing infrastructure code (Terraform, CloudFormation, CDK, Bicep, ARM) to Pulumi. Do not trigger for application runtime code that reads or writes data via cloud SDKs; that is application code, not infrastructure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"pulumi","Pulumi","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fpulumi.png",[12,14,17],{"name":9,"slug":8,"type":13},"tag",{"name":15,"slug":16,"type":13},"Deployment","deployment",{"name":18,"slug":19,"type":13},"Infrastructure as Code","infrastructure-as-code",63,"https:\u002F\u002Fgithub.com\u002Fpulumi\u002Fagent-skills","2026-06-03T07:52:39.333565",null,4,[],{"repoUrl":21,"stars":20,"forks":24,"topics":27,"description":23},[],"https:\u002F\u002Fgithub.com\u002Fpulumi\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fpulumi\u002Fskills\u002Fpulumi-overview","---\nname: pulumi-overview\ndescription: Use this skill for any task that creates, modifies, inspects, or destroys cloud infrastructure or SaaS configuration, from one-off CLI operations to full multi-resource projects, across providers in the Pulumi ecosystem. A typical project spans many providers (AWS or Azure or GCP, Kubernetes, Cloudflare, Auth0, Datadog, Vercel, and others), and Pulumi drives them through one CLI, one state model, and one credential layer. Trigger even when the user does not name Pulumi; phrasings like \"deploy this app,\" \"provision a database,\" \"stand up a VPC,\" \"configure Auth0,\" \"set up Datadog monitoring,\" or \"tear down staging\" qualify. Also trigger for tasks that migrate, port, or convert existing infrastructure code (Terraform, CloudFormation, CDK, Bicep, ARM) to Pulumi. Do not trigger for application runtime code that reads or writes data via cloud SDKs; that is application code, not infrastructure.\n---\n\n# Pulumi\n\nPulumi is a tool for creating and managing cloud infrastructure: virtual machines, storage, Kubernetes clusters, databases, anything from any provider. You write code or run CLI commands, Pulumi previews what would change, then applies it. This skill walks three levels of working with Pulumi, from a single CLI command up to a project with policies and scheduled drift. Start at the smallest level that fits the task.\n\n## The three levels\n\nLevel 1 is `pulumi do`, a CLI for direct CRUD against any provider, with no project files or programming language. Level 2 is a Pulumi project in Python, TypeScript, Go, C#, or Java, used once the work involves multiple related resources, loops or conditionals, reusable abstractions, or environment-specific variants. Level 3 layers Pulumi Cloud onto a project for ESC credentials and configuration, policy, hosted execution, drift detection, schedules, and audit.\n\n| Level | Surface | When to use |\n|-------|---------|-------------|\n| 1 | `pulumi do` | Single resource or multi-vendor bootstrapping |\n| 2 | Pulumi project (Python, TS, Go, C#, Java) | Multiple resources, abstractions, environments |\n| 3 | ESC, policy, deployments, drift, schedules | Governance, secrets, scheduled and hosted runs |\n\nWhen the directory has no existing Pulumi project, a user asking to create a single bucket is a Level 1 task; do not scaffold a new project for it. A request to provision a VPC with subnets and a Kubernetes cluster is Level 2 from the start. A request for nightly drift detection on an existing stack is Level 3.\n\nConverting existing infrastructure code from another tool (Terraform, CloudFormation, CDK, ARM, or Bicep) is a separate path: route straight to the migration skills listed in the table at the end, independent of the level model.\n\nPicking the right level requires knowing what is already in the directory. If you can inspect the filesystem, do so. If you cannot (restricted agent contexts), ask the user before any Pulumi command runs whether there is an existing Pulumi project in the directory. Don't run a Pulumi command to find out: commands that would otherwise require a login silently provision a new agent account, parallel to one the user may already own.\n\n---\n\n## Level 1: `pulumi do` for direct resource operations\n\nUse `pulumi do` for one-shot resource operations against any provider. Examples: create a Cloudflare DNS record, create an S3 bucket for backups, create a GCP storage bucket for image uploads, stand up an Azure virtual machine, configure a Datadog monitor, register a Vercel deployment's domain in Cloudflare DNS. There is no project file, directory layout, or programming language involved.\n\n`pulumi do` is stateless. Each command runs once and operates directly against the cloud provider: `create` provisions a resource and prints its cloud-side identifier, while `read`, `patch`, and `delete` act on a resource addressed by that identifier. Nothing is written to a Pulumi state file, so there is no resource graph and no `${...}` wiring between commands. To connect two resources, capture an output from one command and pass it as a literal value to the next.\n\nWhen a Pulumi project (`Pulumi.yaml`) already exists in the directory, do not use `pulumi do` to mutate resources the project manages. Changes go through the program instead.\n\n### First invocation and signup\n\nThe canonical invocation is `npx pulumi \u003Ccommand>`. It works on any machine with Node.js installed and requires no prior Pulumi setup. If `pulumi` is on PATH, the `npx` shim defers to it; otherwise the command runs from the npm registry. To confirm the CLI is available before any command that would trigger signup, run `npx pulumi version`; it does not touch Pulumi Cloud. The resource verbs (`create`, `read`, `patch`, `delete`, `list`) require CLI v3.243.0 or newer, where `pulumi do` gained resource support. `npx pulumi` fetches a current release, but a `pulumi` already on PATH may be older, so confirm the version is recent.\n\n`pulumi do` writes no Pulumi state, but it resolves provider packages through the Pulumi registry, which can reach Pulumi Cloud. In an agent context without saved credentials, that means a first `pulumi do` may silently provision an ephemeral agent account and print a claim banner.\n\nThe CLI prints one line to stderr noting the new account and a claim URL. Surface that claim URL to the user immediately and again in the final response, since it is the only way the user takes ownership of the account; a session that ends without it leaves resources stranded in the cloud. The access token expires in 3 days and the claim URL stays valid for 30 days; Pulumi Cloud sets both, so surface whatever validity the banner reports.\n\nIf the account-creation banner appears more than once in the same session, credentials may not have been cached. Agent credentials are written to `\u002Ftmp\u002F.pulumi\u002Fcredentials.json` and the claim metadata to `\u002Ftmp\u002F.pulumi\u002Fagent-claim.json`, but the claim URL itself is printed in the banner, not stored in those files. Capture it from each banner and surface the most recent one before doing more work.\n\nIf authentication fails, ask the user to run `pulumi login`. Never fall back to `pulumi login --local` or set `PULUMI_CONFIG_PASSPHRASE`; both silently change the user's setup.\n\nProvider credentials are separate from Pulumi Cloud credentials. `pulumi do` reads them from the same environment variables the provider's native CLI uses (`AWS_PROFILE`, `CLOUDFLARE_API_TOKEN`, `GOOGLE_APPLICATION_CREDENTIALS`). If they aren't set, ask the user before invoking commands that call out to the cloud. If a command fails with a provider authorization error, look up that provider's required credentials or configuration and have the user supply them rather than guessing at the cause. ESC (Level 3) is the durable place to keep them once a project exists.\n\n### Command shape\n\nHere are two invocations: create an S3 bucket, then read it back by the cloud id the create printed.\n\n```bash\nnpx pulumi do aws:s3:Bucket create --yes --bucket my-data\nnpx pulumi do aws:s3:Bucket read my-data\n```\n\nThe shape is:\n\n```text\npulumi do \u003Cpkg:mod:type> create [flags]\npulumi do \u003Cpkg:mod:type> read|patch|delete \u003Cid> [flags]\npulumi do \u003Cpkg:mod:type> list [flags]\n```\n\n- `\u003Cpkg>` is the provider package (`aws`, `azure-native`, `gcp`, `cloudflare`, `kubernetes`, etc.).\n- `\u003Cmod>` is the module within the package (`compute`, `storage`, `dns`); optional when the module is `index`. For example, `cloudflare:index\u002Frecord:Record` invokes as `cloudflare:Record`.\n- `\u003Ctype>` is the resource type (`VirtualMachine`, `Bucket`, `Record`).\n- `\u003Cid>` is the cloud provider's identifier for an existing resource, the value `create` prints as `id`. `create` and `list` take no positional argument; `read`, `patch`, and `delete` each take exactly one `\u003Cid>`.\n- `[flags]` set resource properties, or you pass a body file via `--input-file \u003Cfile>`. See Property input below for how flags and files combine, and which values must come from a file.\n\nThere is no Pulumi logical name to choose. The CLI derives an internal name from the resource type, and you address existing resources by their cloud id.\n\n### Verbs\n\n- `create` provisions the resource and prints its properties, including the cloud `id`, as JSON. Capture that `id` to read, patch, or delete the resource later. Pass `--yes` in non-interactive contexts; `read` and `list` never need it.\n- `read \u003Cid>` fetches the resource's current state from the provider and prints it as JSON. It writes nothing.\n- `patch \u003Cid>` reads the resource's current inputs, overlays the top-level properties you pass as flags or in `--input-file`, and updates the resource in place. The overlay is shallow: properties you do not mention are left as they are. `patch` only updates; it cannot replace a resource, so a change that would require replacement fails rather than recreating it. The command makes you confirm by typing the resource id; pass `--yes` to skip that prompt in non-interactive contexts.\n- `delete \u003Cid>` removes the resource from the cloud. This is irreversible. Get explicit user confirmation for the specific resource before invoking; use `--yes` only after that confirmation, not as a default for non-interactive runs.\n\n`pulumi do` also supports two non-CRUD operations. `pulumi do \u003Cpkg:mod:type> list [flags]` enumerates existing instances of a resource type, but only for types that implement listing. Native providers support it broadly. The Terraform-bridged providers (`aws`, `azure`, `gcp`) support it too, but coverage varies by resource type, so a type that lacks it rejects the verb. `pulumi do \u003Cpkg:mod:function> [flags]` invokes a stateless function the provider exposes alongside its resources.\n\n### Property input\n\nProperties come from per-property flags, a body file, or both; flags overlay the body. Flags set top-level scalar properties only, so nested or structured values (`tags`, nested blocks) must come from the body file. The body defaults to PCL, written as flat `name = value` attributes; pass `--input yaml` (which needs the YAML converter plugin) to use YAML instead.\n\n```bash\ncat > bucket.pcl \u003C\u003C'EOF'\nbucket = \"my-data\"\ntags = {\n  Environment = \"dev\"\n}\nEOF\nnpx pulumi do aws:s3:Bucket create --yes --input-file bucket.pcl\n```\n\nBefore authoring properties for a resource new to this session, run `npx pulumi package info \u003Cpkg> --module \u003Cmod> --resource \u003CType>` to list its inputs and outputs with descriptions, scoped to that one resource. Reach for `npx pulumi package get-schema \u003Cpkg>` only when you need the full machine-readable schema with the nested type definitions `info` does not expand; for a large provider it runs to tens of MB, so do not read it whole. Property names are camelCase (flags are the kebab-case form). To discover names, run `npx pulumi package info \u003Cpkg>` with no module to list its modules and resources, or browse the catalog at https:\u002F\u002Fwww.pulumi.com\u002Fregistry\u002F.\n\n### Connecting resources\n\n`pulumi do` keeps no state and has no resource graph, so there is no `${...}` reference syntax between commands. To feed one resource's output into another, read a field from the first command's JSON output and pass it as a literal flag to the next.\n\n```bash\n# create prints JSON containing \"id\": \"vpc-0abc123\"\nnpx pulumi do aws:ec2:Vpc create --yes --cidr-block 10.0.0.0\u002F16\n\n# pass that id to the subnet\nnpx pulumi do aws:ec2:Subnet create --yes --vpc-id vpc-0abc123 --cidr-block 10.0.1.0\u002F24\n```\n\nThe same pattern connects resources across providers. Here a value from the `random` provider feeds an AWS resource name, a common way to get globally-unique names.\n\n```bash\n# RandomPet prints JSON containing \"id\": \"artistic-bull\"\nnpx pulumi do random:RandomPet create --yes\n\n# use it in the bucket name\nnpx pulumi do aws:s3:Bucket create --yes --bucket assets-artistic-bull\n```\n\nWhen a command needs a value the chain does not produce, like an existing resource id or an API zone id, get it from a provider function, a `list` where the provider supports it, or the user. Do not invent it.\n\n### Output\n\nBy default, `create`, `read`, and `patch` each write one JSON object to stdout for the affected resource. Check the exit code on every invocation.\n\n```json\n{\n  \"id\":     \"my-data\",\n  \"bucket\": \"my-data\",\n  \"arn\":    \"arn:aws:s3:::my-data\"\n}\n```\n\nThe resource's properties are top-level, alongside an `id` field holding the cloud identifier. There is no nested `outputs` object, no `urn`, and the type token you passed in is not echoed back. `list` instead writes a JSON array of `{id, name}` entries, and a function writes its declared result shape.\n\n### Graduating to Level 2\n\nEject to Level 2 when one-shot commands stop fitting. Because `pulumi do` leaves no Pulumi state behind, the resources it created are ordinary cloud resources, so you adopt them into a project with `pulumi import`. From inside a Pulumi project, run `pulumi import` with each resource's full type token, a logical name, and the cloud `id` that `create` returned. Import records the resource in the stack's state and, by default, generates its program code.\n\n```bash\n# the import type token is the full pkg:mod\u002Ftype:Type form, not pulumi do's short aws:s3:Bucket\nnpx pulumi import aws:s3\u002Fbucket:Bucket assets my-data\n```\n\nMove the generated code into your program, then manage the resource there instead of with `pulumi do`. To adopt several at once, pass them in a bulk `--file`.\n\n---\n\n## Level 2: full infrastructure as code\n\nLevel 2 is a Pulumi project: code in Python, TypeScript, Go, C#, or Java that describes a set of related resources and their dependencies. Start here when the task involves multiple related resources, loops or conditionals, reusable abstractions, or environment-specific variants. It is also the right level when ad-hoc work at Level 1 has grown past what a few CLI invocations should carry. Match the user's existing codebase language when one is present; default to TypeScript otherwise.\n\nBefore writing any non-trivial program, use skill `pulumi-best-practices`, which covers `Output\u003CT>` and `apply()` usage, passing outputs directly as inputs, component structure and parenting, secrets hygiene, and safe refactoring with `aliases`.\n\n### Bootstrapping\n\nThe quickest way to start a project is with a template, though you can scaffold one by hand if you prefer:\n\n```bash\nnpx pulumi new aws-typescript\nnpx pulumi new gcp-go\n```\n\nTemplates set up the working directory, `Pulumi.yaml`, an initial stack, the language's package manifest, and a starter program. Browse the full catalog with `npx pulumi template list`, or filter by name with `npx pulumi template list --name \u003Cfilter>`.\n\n### Core lifecycle\n\nThe lifecycle commands work the same across languages:\n\n```bash\nnpx pulumi preview      # show what would change\nnpx pulumi up           # apply\nnpx pulumi refresh      # reconcile state with cloud reality\n```\n\nAlways run `preview` before `up`; it shows what will change and costs nothing.\n\n`pulumi destroy` tears down every resource in the stack. The Pulumi docs call it \"generally irreversible\"; never invoke without explicit user confirmation of the stack name.\n\n### Stacks and config\n\nA stack is an isolated instance of a project. A common pattern is one stack per environment, named `dev`, `staging`, and `prod`.\n\n```bash\nnpx pulumi stack init dev\nnpx pulumi stack select prod\n\nnpx pulumi config set aws:region us-west-2\nnpx pulumi config set --secret dbPassword \"...\"\n```\n\nRead configuration values from inside the program with the SDK's `Config` object; the exact operation names vary by language, so refer to the per-language examples at https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fiac\u002Fconcepts\u002Fconfig\u002F#code. Use skill `pulumi-best-practices` for `Output\u003CT>` \u002F `apply()` usage and broader secrets hygiene.\n\nA stack only touches resources tracked in its state, so removing a resource from your program causes `pulumi up` to delete it from the cloud. Set `protect: true` on anything you cannot afford to lose.\n\nFor the full IaC reference, see https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fiac\u002F.\n\n---\n\n## Level 3: governance and operations\n\nLevel 3 uses Pulumi Cloud for more than state. ESC holds the credentials for every provider a project touches and brokers them into runs and shells. Policy enforcement, hosted execution, drift detection, scheduled operations, and audit round out the surface.\n\n### ESC: environments, secrets, configuration\n\nAn ESC environment composes secrets and configuration from cloud secret managers, OIDC-vended credentials, and other ESC environments into a single resolved bundle that programs and stacks consume.\n\n```bash\nnpx pulumi env init my_org\u002Faws\u002Fprod\nnpx pulumi env set my_org\u002Faws\u002Fprod aws.region us-west-2\nnpx pulumi env open my_org\u002Faws\u002Fprod\nnpx pulumi env run my_org\u002Faws\u002Fprod -- aws s3 ls\n```\n\n**Where the provider supports it, vend cloud credentials through OIDC rather than static keys in environment YAML.** OIDC trust policies, IdP registration, and rotation patterns live in `pulumi-esc`; use skill `pulumi-esc` rather than invent ESC YAML by hand.\n\n`env open` resolves and prints live credentials, so avoid capturing its output into logs or transcripts. Prefer `env run -- \u003Ccommand>`, which injects the credentials into the child process rather than printing them.\n\n### Policy\n\nPulumi Policies runs policy packs against the resource graph at preview and update time. A policy can reject the deployment, require approval, or annotate resources with findings; enforcement happens before any cloud API call.\n\n```bash\nnpx pulumi policy new aws-typescript          # scaffold a pack from a policy template\nnpx pulumi policy publish my_org              # the pack name comes from PulumiPolicy.yaml\nnpx pulumi policy enable my_org\u002F\u003Cpack-name> latest --policy-group production\n```\n\nPolicies are written in TypeScript or Python, the same languages you use for programs.\n\n### Deployments\n\nPulumi Deployments runs `pulumi up`, `preview`, and `destroy` in Pulumi-managed infrastructure rather than on the local machine. Use it for CI without maintaining your own runners and for any operation that needs to run server-side.\n\n```bash\nnpx pulumi deployment run update --stack my_org\u002Fproj\u002Fprod\n```\n\nThe target stack must already exist; a wrong `--stack` value can prompt to create a new stack rather than fail.\n\n### Drift detection and scheduled operations\n\nDrift detection compares stack state against the cloud and reports anything that has diverged. For an ad-hoc local check, run a refresh in preview-only mode. Pulumi Cloud schedules operations on a cron (times are UTC), including a purpose-built drift kind.\n\n```bash\n# Ad-hoc local drift check\nnpx pulumi refresh --preview-only\n\n# Scheduled drift detection (detection only)\nnpx pulumi stack schedule new --kind drift --cron \"0 0 * * *\"\n\n# Scheduled secret rotation for an ESC environment\nnpx pulumi env schedule new my_org\u002Faws\u002Fprod --cron \"0 0 1 * *\"\n```\n\nA schedule is standing automation that keeps running after the session ends, so confirm the operation, cadence, and stack with the user before creating one. Two kinds act without a human in the loop: `--kind drift --auto-remediate` runs `pulumi up` on detected drift, and `--kind ttl` destroys the stack at a set time. Default to detection-only unless the user asks for remediation.\n\n### Further reading\n\n- ESC: https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fesc\u002F\n- Pulumi Policies: https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Finsights\u002Fpolicy\u002F\n- Deployments: https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fpulumi-cloud\u002Fdeployments\u002F\n- Drift detection: https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fpulumi-cloud\u002Fdeployments\u002Fdrift\u002F\n\n---\n\n## Reference\n\nWhen you are uncertain about a CLI flag, command shape, or resource property, look it up rather than guess. `npx pulumi \u003Ccommand> --help` documents every flag and subcommand from the CLI itself. The full reference, provider catalog, and conceptual documentation live at https:\u002F\u002Fwww.pulumi.com\u002Fdocs.\n\n---\n\n## Routing to specialized skills\n\nWhen the work moves into territory another skill covers in depth, hand off to that skill rather than reinvent its content.\n\n| Skill | Load when |\n|---|---|\n| `pulumi-best-practices` | Writing any non-trivial Level 2 program |\n| `pulumi-component` | Packaging or consuming `ComponentResource` abstractions |\n| `pulumi-esc` | Defining ESC environments, OIDC trust policies, or rotation |\n| `pulumi-automation-api` | Embedding Pulumi inside another program (IDP, custom CI) |\n| `provider-upgrade` | Upgrading a provider package version in a stack without unintended changes |\n| `package-usage` | Auditing which stacks across the org use a package and at what versions |\n| `pulumi-terraform-to-pulumi`, `pulumi-cdk-to-pulumi`, `cloudformation-to-pulumi`, `pulumi-arm-to-pulumi` | Migrating from those tools |\n\nAn agent only sees the skills the user installed, so a referenced skill may not be present. `pulumi-best-practices`, `pulumi-component`, `pulumi-esc`, `pulumi-automation-api`, `provider-upgrade`, and `package-usage` ship in the same `pulumi` plugin as this skill, so they are available whenever this one is. The migration skills install separately through the `pulumi-migration` plugin and may be absent. When a referenced skill is available, load it. When it is not, do not stall or treat the gap as an error: continue with the guidance in this skill and the docs at https:\u002F\u002Fwww.pulumi.com\u002Fdocs, and tell the user which skill or plugin covers the work in depth.\n",{"data":31,"body":32},{"name":4,"description":6},{"type":33,"children":34},"root",[35,42,48,55,69,159,164,169,174,178,191,203,253,273,280,370,387,392,413,442,476,482,487,574,579,589,815,820,826,936,982,988,1017,1134,1180,1186,1203,1321,1334,1429,1441,1447,1471,1609,1652,1658,1699,1744,1763,1766,1772,1777,1812,1818,1823,1871,1898,1904,1909,1979,2000,2011,2017,2043,2181,2223,2244,2256,2259,2265,2270,2276,2281,2414,2440,2459,2465,2470,2598,2603,2609,2634,2676,2689,2695,2700,2862,2890,2896,2943,2946,2952,2972,2975,2981,2986,3154,3218],{"type":36,"tag":37,"props":38,"children":39},"element","h1",{"id":8},[40],{"type":41,"value":9},"text",{"type":36,"tag":43,"props":44,"children":45},"p",{},[46],{"type":41,"value":47},"Pulumi is a tool for creating and managing cloud infrastructure: virtual machines, storage, Kubernetes clusters, databases, anything from any provider. You write code or run CLI commands, Pulumi previews what would change, then applies it. This skill walks three levels of working with Pulumi, from a single CLI command up to a project with policies and scheduled drift. Start at the smallest level that fits the task.",{"type":36,"tag":49,"props":50,"children":52},"h2",{"id":51},"the-three-levels",[53],{"type":41,"value":54},"The three levels",{"type":36,"tag":43,"props":56,"children":57},{},[58,60,67],{"type":41,"value":59},"Level 1 is ",{"type":36,"tag":61,"props":62,"children":64},"code",{"className":63},[],[65],{"type":41,"value":66},"pulumi do",{"type":41,"value":68},", a CLI for direct CRUD against any provider, with no project files or programming language. Level 2 is a Pulumi project in Python, TypeScript, Go, C#, or Java, used once the work involves multiple related resources, loops or conditionals, reusable abstractions, or environment-specific variants. Level 3 layers Pulumi Cloud onto a project for ESC credentials and configuration, policy, hosted execution, drift detection, schedules, and audit.",{"type":36,"tag":70,"props":71,"children":72},"table",{},[73,97],{"type":36,"tag":74,"props":75,"children":76},"thead",{},[77],{"type":36,"tag":78,"props":79,"children":80},"tr",{},[81,87,92],{"type":36,"tag":82,"props":83,"children":84},"th",{},[85],{"type":41,"value":86},"Level",{"type":36,"tag":82,"props":88,"children":89},{},[90],{"type":41,"value":91},"Surface",{"type":36,"tag":82,"props":93,"children":94},{},[95],{"type":41,"value":96},"When to use",{"type":36,"tag":98,"props":99,"children":100},"tbody",{},[101,123,141],{"type":36,"tag":78,"props":102,"children":103},{},[104,110,118],{"type":36,"tag":105,"props":106,"children":107},"td",{},[108],{"type":41,"value":109},"1",{"type":36,"tag":105,"props":111,"children":112},{},[113],{"type":36,"tag":61,"props":114,"children":116},{"className":115},[],[117],{"type":41,"value":66},{"type":36,"tag":105,"props":119,"children":120},{},[121],{"type":41,"value":122},"Single resource or multi-vendor bootstrapping",{"type":36,"tag":78,"props":124,"children":125},{},[126,131,136],{"type":36,"tag":105,"props":127,"children":128},{},[129],{"type":41,"value":130},"2",{"type":36,"tag":105,"props":132,"children":133},{},[134],{"type":41,"value":135},"Pulumi project (Python, TS, Go, C#, Java)",{"type":36,"tag":105,"props":137,"children":138},{},[139],{"type":41,"value":140},"Multiple resources, abstractions, environments",{"type":36,"tag":78,"props":142,"children":143},{},[144,149,154],{"type":36,"tag":105,"props":145,"children":146},{},[147],{"type":41,"value":148},"3",{"type":36,"tag":105,"props":150,"children":151},{},[152],{"type":41,"value":153},"ESC, policy, deployments, drift, schedules",{"type":36,"tag":105,"props":155,"children":156},{},[157],{"type":41,"value":158},"Governance, secrets, scheduled and hosted runs",{"type":36,"tag":43,"props":160,"children":161},{},[162],{"type":41,"value":163},"When the directory has no existing Pulumi project, a user asking to create a single bucket is a Level 1 task; do not scaffold a new project for it. A request to provision a VPC with subnets and a Kubernetes cluster is Level 2 from the start. A request for nightly drift detection on an existing stack is Level 3.",{"type":36,"tag":43,"props":165,"children":166},{},[167],{"type":41,"value":168},"Converting existing infrastructure code from another tool (Terraform, CloudFormation, CDK, ARM, or Bicep) is a separate path: route straight to the migration skills listed in the table at the end, independent of the level model.",{"type":36,"tag":43,"props":170,"children":171},{},[172],{"type":41,"value":173},"Picking the right level requires knowing what is already in the directory. If you can inspect the filesystem, do so. If you cannot (restricted agent contexts), ask the user before any Pulumi command runs whether there is an existing Pulumi project in the directory. Don't run a Pulumi command to find out: commands that would otherwise require a login silently provision a new agent account, parallel to one the user may already own.",{"type":36,"tag":175,"props":176,"children":177},"hr",{},[],{"type":36,"tag":49,"props":179,"children":181},{"id":180},"level-1-pulumi-do-for-direct-resource-operations",[182,184,189],{"type":41,"value":183},"Level 1: ",{"type":36,"tag":61,"props":185,"children":187},{"className":186},[],[188],{"type":41,"value":66},{"type":41,"value":190}," for direct resource operations",{"type":36,"tag":43,"props":192,"children":193},{},[194,196,201],{"type":41,"value":195},"Use ",{"type":36,"tag":61,"props":197,"children":199},{"className":198},[],[200],{"type":41,"value":66},{"type":41,"value":202}," for one-shot resource operations against any provider. Examples: create a Cloudflare DNS record, create an S3 bucket for backups, create a GCP storage bucket for image uploads, stand up an Azure virtual machine, configure a Datadog monitor, register a Vercel deployment's domain in Cloudflare DNS. There is no project file, directory layout, or programming language involved.",{"type":36,"tag":43,"props":204,"children":205},{},[206,211,213,219,221,227,229,235,237,243,245,251],{"type":36,"tag":61,"props":207,"children":209},{"className":208},[],[210],{"type":41,"value":66},{"type":41,"value":212}," is stateless. Each command runs once and operates directly against the cloud provider: ",{"type":36,"tag":61,"props":214,"children":216},{"className":215},[],[217],{"type":41,"value":218},"create",{"type":41,"value":220}," provisions a resource and prints its cloud-side identifier, while ",{"type":36,"tag":61,"props":222,"children":224},{"className":223},[],[225],{"type":41,"value":226},"read",{"type":41,"value":228},", ",{"type":36,"tag":61,"props":230,"children":232},{"className":231},[],[233],{"type":41,"value":234},"patch",{"type":41,"value":236},", and ",{"type":36,"tag":61,"props":238,"children":240},{"className":239},[],[241],{"type":41,"value":242},"delete",{"type":41,"value":244}," act on a resource addressed by that identifier. Nothing is written to a Pulumi state file, so there is no resource graph and no ",{"type":36,"tag":61,"props":246,"children":248},{"className":247},[],[249],{"type":41,"value":250},"${...}",{"type":41,"value":252}," wiring between commands. To connect two resources, capture an output from one command and pass it as a literal value to the next.",{"type":36,"tag":43,"props":254,"children":255},{},[256,258,264,266,271],{"type":41,"value":257},"When a Pulumi project (",{"type":36,"tag":61,"props":259,"children":261},{"className":260},[],[262],{"type":41,"value":263},"Pulumi.yaml",{"type":41,"value":265},") already exists in the directory, do not use ",{"type":36,"tag":61,"props":267,"children":269},{"className":268},[],[270],{"type":41,"value":66},{"type":41,"value":272}," to mutate resources the project manages. Changes go through the program instead.",{"type":36,"tag":274,"props":275,"children":277},"h3",{"id":276},"first-invocation-and-signup",[278],{"type":41,"value":279},"First invocation and signup",{"type":36,"tag":43,"props":281,"children":282},{},[283,285,291,293,298,300,306,308,314,316,321,322,327,328,333,334,339,340,346,348,353,355,361,363,368],{"type":41,"value":284},"The canonical invocation is ",{"type":36,"tag":61,"props":286,"children":288},{"className":287},[],[289],{"type":41,"value":290},"npx pulumi \u003Ccommand>",{"type":41,"value":292},". It works on any machine with Node.js installed and requires no prior Pulumi setup. If ",{"type":36,"tag":61,"props":294,"children":296},{"className":295},[],[297],{"type":41,"value":8},{"type":41,"value":299}," is on PATH, the ",{"type":36,"tag":61,"props":301,"children":303},{"className":302},[],[304],{"type":41,"value":305},"npx",{"type":41,"value":307}," shim defers to it; otherwise the command runs from the npm registry. To confirm the CLI is available before any command that would trigger signup, run ",{"type":36,"tag":61,"props":309,"children":311},{"className":310},[],[312],{"type":41,"value":313},"npx pulumi version",{"type":41,"value":315},"; it does not touch Pulumi Cloud. The resource verbs (",{"type":36,"tag":61,"props":317,"children":319},{"className":318},[],[320],{"type":41,"value":218},{"type":41,"value":228},{"type":36,"tag":61,"props":323,"children":325},{"className":324},[],[326],{"type":41,"value":226},{"type":41,"value":228},{"type":36,"tag":61,"props":329,"children":331},{"className":330},[],[332],{"type":41,"value":234},{"type":41,"value":228},{"type":36,"tag":61,"props":335,"children":337},{"className":336},[],[338],{"type":41,"value":242},{"type":41,"value":228},{"type":36,"tag":61,"props":341,"children":343},{"className":342},[],[344],{"type":41,"value":345},"list",{"type":41,"value":347},") require CLI v3.243.0 or newer, where ",{"type":36,"tag":61,"props":349,"children":351},{"className":350},[],[352],{"type":41,"value":66},{"type":41,"value":354}," gained resource support. ",{"type":36,"tag":61,"props":356,"children":358},{"className":357},[],[359],{"type":41,"value":360},"npx pulumi",{"type":41,"value":362}," fetches a current release, but a ",{"type":36,"tag":61,"props":364,"children":366},{"className":365},[],[367],{"type":41,"value":8},{"type":41,"value":369}," already on PATH may be older, so confirm the version is recent.",{"type":36,"tag":43,"props":371,"children":372},{},[373,378,380,385],{"type":36,"tag":61,"props":374,"children":376},{"className":375},[],[377],{"type":41,"value":66},{"type":41,"value":379}," writes no Pulumi state, but it resolves provider packages through the Pulumi registry, which can reach Pulumi Cloud. In an agent context without saved credentials, that means a first ",{"type":36,"tag":61,"props":381,"children":383},{"className":382},[],[384],{"type":41,"value":66},{"type":41,"value":386}," may silently provision an ephemeral agent account and print a claim banner.",{"type":36,"tag":43,"props":388,"children":389},{},[390],{"type":41,"value":391},"The CLI prints one line to stderr noting the new account and a claim URL. Surface that claim URL to the user immediately and again in the final response, since it is the only way the user takes ownership of the account; a session that ends without it leaves resources stranded in the cloud. The access token expires in 3 days and the claim URL stays valid for 30 days; Pulumi Cloud sets both, so surface whatever validity the banner reports.",{"type":36,"tag":43,"props":393,"children":394},{},[395,397,403,405,411],{"type":41,"value":396},"If the account-creation banner appears more than once in the same session, credentials may not have been cached. Agent credentials are written to ",{"type":36,"tag":61,"props":398,"children":400},{"className":399},[],[401],{"type":41,"value":402},"\u002Ftmp\u002F.pulumi\u002Fcredentials.json",{"type":41,"value":404}," and the claim metadata to ",{"type":36,"tag":61,"props":406,"children":408},{"className":407},[],[409],{"type":41,"value":410},"\u002Ftmp\u002F.pulumi\u002Fagent-claim.json",{"type":41,"value":412},", but the claim URL itself is printed in the banner, not stored in those files. Capture it from each banner and surface the most recent one before doing more work.",{"type":36,"tag":43,"props":414,"children":415},{},[416,418,424,426,432,434,440],{"type":41,"value":417},"If authentication fails, ask the user to run ",{"type":36,"tag":61,"props":419,"children":421},{"className":420},[],[422],{"type":41,"value":423},"pulumi login",{"type":41,"value":425},". Never fall back to ",{"type":36,"tag":61,"props":427,"children":429},{"className":428},[],[430],{"type":41,"value":431},"pulumi login --local",{"type":41,"value":433}," or set ",{"type":36,"tag":61,"props":435,"children":437},{"className":436},[],[438],{"type":41,"value":439},"PULUMI_CONFIG_PASSPHRASE",{"type":41,"value":441},"; both silently change the user's setup.",{"type":36,"tag":43,"props":443,"children":444},{},[445,447,452,454,460,461,467,468,474],{"type":41,"value":446},"Provider credentials are separate from Pulumi Cloud credentials. ",{"type":36,"tag":61,"props":448,"children":450},{"className":449},[],[451],{"type":41,"value":66},{"type":41,"value":453}," reads them from the same environment variables the provider's native CLI uses (",{"type":36,"tag":61,"props":455,"children":457},{"className":456},[],[458],{"type":41,"value":459},"AWS_PROFILE",{"type":41,"value":228},{"type":36,"tag":61,"props":462,"children":464},{"className":463},[],[465],{"type":41,"value":466},"CLOUDFLARE_API_TOKEN",{"type":41,"value":228},{"type":36,"tag":61,"props":469,"children":471},{"className":470},[],[472],{"type":41,"value":473},"GOOGLE_APPLICATION_CREDENTIALS",{"type":41,"value":475},"). If they aren't set, ask the user before invoking commands that call out to the cloud. If a command fails with a provider authorization error, look up that provider's required credentials or configuration and have the user supply them rather than guessing at the cause. ESC (Level 3) is the durable place to keep them once a project exists.",{"type":36,"tag":274,"props":477,"children":479},{"id":478},"command-shape",[480],{"type":41,"value":481},"Command shape",{"type":36,"tag":43,"props":483,"children":484},{},[485],{"type":41,"value":486},"Here are two invocations: create an S3 bucket, then read it back by the cloud id the create printed.",{"type":36,"tag":488,"props":489,"children":494},"pre",{"className":490,"code":491,"language":492,"meta":493,"style":493},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","npx pulumi do aws:s3:Bucket create --yes --bucket my-data\nnpx pulumi do aws:s3:Bucket read my-data\n","bash","",[495],{"type":36,"tag":61,"props":496,"children":497},{"__ignoreMap":493},[498,545],{"type":36,"tag":499,"props":500,"children":503},"span",{"class":501,"line":502},"line",1,[504,509,515,520,525,530,535,540],{"type":36,"tag":499,"props":505,"children":507},{"style":506},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[508],{"type":41,"value":305},{"type":36,"tag":499,"props":510,"children":512},{"style":511},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[513],{"type":41,"value":514}," pulumi",{"type":36,"tag":499,"props":516,"children":517},{"style":511},[518],{"type":41,"value":519}," do",{"type":36,"tag":499,"props":521,"children":522},{"style":511},[523],{"type":41,"value":524}," aws:s3:Bucket",{"type":36,"tag":499,"props":526,"children":527},{"style":511},[528],{"type":41,"value":529}," create",{"type":36,"tag":499,"props":531,"children":532},{"style":511},[533],{"type":41,"value":534}," --yes",{"type":36,"tag":499,"props":536,"children":537},{"style":511},[538],{"type":41,"value":539}," --bucket",{"type":36,"tag":499,"props":541,"children":542},{"style":511},[543],{"type":41,"value":544}," my-data\n",{"type":36,"tag":499,"props":546,"children":548},{"class":501,"line":547},2,[549,553,557,561,565,570],{"type":36,"tag":499,"props":550,"children":551},{"style":506},[552],{"type":41,"value":305},{"type":36,"tag":499,"props":554,"children":555},{"style":511},[556],{"type":41,"value":514},{"type":36,"tag":499,"props":558,"children":559},{"style":511},[560],{"type":41,"value":519},{"type":36,"tag":499,"props":562,"children":563},{"style":511},[564],{"type":41,"value":524},{"type":36,"tag":499,"props":566,"children":567},{"style":511},[568],{"type":41,"value":569}," read",{"type":36,"tag":499,"props":571,"children":572},{"style":511},[573],{"type":41,"value":544},{"type":36,"tag":43,"props":575,"children":576},{},[577],{"type":41,"value":578},"The shape is:",{"type":36,"tag":488,"props":580,"children":584},{"className":581,"code":583,"language":41,"meta":493},[582],"language-text","pulumi do \u003Cpkg:mod:type> create [flags]\npulumi do \u003Cpkg:mod:type> read|patch|delete \u003Cid> [flags]\npulumi do \u003Cpkg:mod:type> list [flags]\n",[585],{"type":36,"tag":61,"props":586,"children":587},{"__ignoreMap":493},[588],{"type":41,"value":583},{"type":36,"tag":590,"props":591,"children":592},"ul",{},[593,641,698,731,796],{"type":36,"tag":594,"props":595,"children":596},"li",{},[597,603,605,611,612,618,619,625,626,632,633,639],{"type":36,"tag":61,"props":598,"children":600},{"className":599},[],[601],{"type":41,"value":602},"\u003Cpkg>",{"type":41,"value":604}," is the provider package (",{"type":36,"tag":61,"props":606,"children":608},{"className":607},[],[609],{"type":41,"value":610},"aws",{"type":41,"value":228},{"type":36,"tag":61,"props":613,"children":615},{"className":614},[],[616],{"type":41,"value":617},"azure-native",{"type":41,"value":228},{"type":36,"tag":61,"props":620,"children":622},{"className":621},[],[623],{"type":41,"value":624},"gcp",{"type":41,"value":228},{"type":36,"tag":61,"props":627,"children":629},{"className":628},[],[630],{"type":41,"value":631},"cloudflare",{"type":41,"value":228},{"type":36,"tag":61,"props":634,"children":636},{"className":635},[],[637],{"type":41,"value":638},"kubernetes",{"type":41,"value":640},", etc.).",{"type":36,"tag":594,"props":642,"children":643},{},[644,650,652,658,659,665,666,672,674,680,682,688,690,696],{"type":36,"tag":61,"props":645,"children":647},{"className":646},[],[648],{"type":41,"value":649},"\u003Cmod>",{"type":41,"value":651}," is the module within the package (",{"type":36,"tag":61,"props":653,"children":655},{"className":654},[],[656],{"type":41,"value":657},"compute",{"type":41,"value":228},{"type":36,"tag":61,"props":660,"children":662},{"className":661},[],[663],{"type":41,"value":664},"storage",{"type":41,"value":228},{"type":36,"tag":61,"props":667,"children":669},{"className":668},[],[670],{"type":41,"value":671},"dns",{"type":41,"value":673},"); optional when the module is ",{"type":36,"tag":61,"props":675,"children":677},{"className":676},[],[678],{"type":41,"value":679},"index",{"type":41,"value":681},". For example, ",{"type":36,"tag":61,"props":683,"children":685},{"className":684},[],[686],{"type":41,"value":687},"cloudflare:index\u002Frecord:Record",{"type":41,"value":689}," invokes as ",{"type":36,"tag":61,"props":691,"children":693},{"className":692},[],[694],{"type":41,"value":695},"cloudflare:Record",{"type":41,"value":697},".",{"type":36,"tag":594,"props":699,"children":700},{},[701,707,709,715,716,722,723,729],{"type":36,"tag":61,"props":702,"children":704},{"className":703},[],[705],{"type":41,"value":706},"\u003Ctype>",{"type":41,"value":708}," is the resource type (",{"type":36,"tag":61,"props":710,"children":712},{"className":711},[],[713],{"type":41,"value":714},"VirtualMachine",{"type":41,"value":228},{"type":36,"tag":61,"props":717,"children":719},{"className":718},[],[720],{"type":41,"value":721},"Bucket",{"type":41,"value":228},{"type":36,"tag":61,"props":724,"children":726},{"className":725},[],[727],{"type":41,"value":728},"Record",{"type":41,"value":730},").",{"type":36,"tag":594,"props":732,"children":733},{},[734,740,742,747,749,755,757,762,764,769,771,776,777,782,783,788,790,795],{"type":36,"tag":61,"props":735,"children":737},{"className":736},[],[738],{"type":41,"value":739},"\u003Cid>",{"type":41,"value":741}," is the cloud provider's identifier for an existing resource, the value ",{"type":36,"tag":61,"props":743,"children":745},{"className":744},[],[746],{"type":41,"value":218},{"type":41,"value":748}," prints as ",{"type":36,"tag":61,"props":750,"children":752},{"className":751},[],[753],{"type":41,"value":754},"id",{"type":41,"value":756},". ",{"type":36,"tag":61,"props":758,"children":760},{"className":759},[],[761],{"type":41,"value":218},{"type":41,"value":763}," and ",{"type":36,"tag":61,"props":765,"children":767},{"className":766},[],[768],{"type":41,"value":345},{"type":41,"value":770}," take no positional argument; ",{"type":36,"tag":61,"props":772,"children":774},{"className":773},[],[775],{"type":41,"value":226},{"type":41,"value":228},{"type":36,"tag":61,"props":778,"children":780},{"className":779},[],[781],{"type":41,"value":234},{"type":41,"value":236},{"type":36,"tag":61,"props":784,"children":786},{"className":785},[],[787],{"type":41,"value":242},{"type":41,"value":789}," each take exactly one ",{"type":36,"tag":61,"props":791,"children":793},{"className":792},[],[794],{"type":41,"value":739},{"type":41,"value":697},{"type":36,"tag":594,"props":797,"children":798},{},[799,805,807,813],{"type":36,"tag":61,"props":800,"children":802},{"className":801},[],[803],{"type":41,"value":804},"[flags]",{"type":41,"value":806}," set resource properties, or you pass a body file via ",{"type":36,"tag":61,"props":808,"children":810},{"className":809},[],[811],{"type":41,"value":812},"--input-file \u003Cfile>",{"type":41,"value":814},". See Property input below for how flags and files combine, and which values must come from a file.",{"type":36,"tag":43,"props":816,"children":817},{},[818],{"type":41,"value":819},"There is no Pulumi logical name to choose. The CLI derives an internal name from the resource type, and you address existing resources by their cloud id.",{"type":36,"tag":274,"props":821,"children":823},{"id":822},"verbs",[824],{"type":41,"value":825},"Verbs",{"type":36,"tag":590,"props":827,"children":828},{},[829,874,885,918],{"type":36,"tag":594,"props":830,"children":831},{},[832,837,839,844,846,851,853,859,861,866,867,872],{"type":36,"tag":61,"props":833,"children":835},{"className":834},[],[836],{"type":41,"value":218},{"type":41,"value":838}," provisions the resource and prints its properties, including the cloud ",{"type":36,"tag":61,"props":840,"children":842},{"className":841},[],[843],{"type":41,"value":754},{"type":41,"value":845},", as JSON. Capture that ",{"type":36,"tag":61,"props":847,"children":849},{"className":848},[],[850],{"type":41,"value":754},{"type":41,"value":852}," to read, patch, or delete the resource later. Pass ",{"type":36,"tag":61,"props":854,"children":856},{"className":855},[],[857],{"type":41,"value":858},"--yes",{"type":41,"value":860}," in non-interactive contexts; ",{"type":36,"tag":61,"props":862,"children":864},{"className":863},[],[865],{"type":41,"value":226},{"type":41,"value":763},{"type":36,"tag":61,"props":868,"children":870},{"className":869},[],[871],{"type":41,"value":345},{"type":41,"value":873}," never need it.",{"type":36,"tag":594,"props":875,"children":876},{},[877,883],{"type":36,"tag":61,"props":878,"children":880},{"className":879},[],[881],{"type":41,"value":882},"read \u003Cid>",{"type":41,"value":884}," fetches the resource's current state from the provider and prints it as JSON. It writes nothing.",{"type":36,"tag":594,"props":886,"children":887},{},[888,894,896,902,904,909,911,916],{"type":36,"tag":61,"props":889,"children":891},{"className":890},[],[892],{"type":41,"value":893},"patch \u003Cid>",{"type":41,"value":895}," reads the resource's current inputs, overlays the top-level properties you pass as flags or in ",{"type":36,"tag":61,"props":897,"children":899},{"className":898},[],[900],{"type":41,"value":901},"--input-file",{"type":41,"value":903},", and updates the resource in place. The overlay is shallow: properties you do not mention are left as they are. ",{"type":36,"tag":61,"props":905,"children":907},{"className":906},[],[908],{"type":41,"value":234},{"type":41,"value":910}," only updates; it cannot replace a resource, so a change that would require replacement fails rather than recreating it. The command makes you confirm by typing the resource id; pass ",{"type":36,"tag":61,"props":912,"children":914},{"className":913},[],[915],{"type":41,"value":858},{"type":41,"value":917}," to skip that prompt in non-interactive contexts.",{"type":36,"tag":594,"props":919,"children":920},{},[921,927,929,934],{"type":36,"tag":61,"props":922,"children":924},{"className":923},[],[925],{"type":41,"value":926},"delete \u003Cid>",{"type":41,"value":928}," removes the resource from the cloud. This is irreversible. Get explicit user confirmation for the specific resource before invoking; use ",{"type":36,"tag":61,"props":930,"children":932},{"className":931},[],[933],{"type":41,"value":858},{"type":41,"value":935}," only after that confirmation, not as a default for non-interactive runs.",{"type":36,"tag":43,"props":937,"children":938},{},[939,944,946,952,954,959,960,966,967,972,974,980],{"type":36,"tag":61,"props":940,"children":942},{"className":941},[],[943],{"type":41,"value":66},{"type":41,"value":945}," also supports two non-CRUD operations. ",{"type":36,"tag":61,"props":947,"children":949},{"className":948},[],[950],{"type":41,"value":951},"pulumi do \u003Cpkg:mod:type> list [flags]",{"type":41,"value":953}," enumerates existing instances of a resource type, but only for types that implement listing. Native providers support it broadly. The Terraform-bridged providers (",{"type":36,"tag":61,"props":955,"children":957},{"className":956},[],[958],{"type":41,"value":610},{"type":41,"value":228},{"type":36,"tag":61,"props":961,"children":963},{"className":962},[],[964],{"type":41,"value":965},"azure",{"type":41,"value":228},{"type":36,"tag":61,"props":968,"children":970},{"className":969},[],[971],{"type":41,"value":624},{"type":41,"value":973},") support it too, but coverage varies by resource type, so a type that lacks it rejects the verb. ",{"type":36,"tag":61,"props":975,"children":977},{"className":976},[],[978],{"type":41,"value":979},"pulumi do \u003Cpkg:mod:function> [flags]",{"type":41,"value":981}," invokes a stateless function the provider exposes alongside its resources.",{"type":36,"tag":274,"props":983,"children":985},{"id":984},"property-input",[986],{"type":41,"value":987},"Property input",{"type":36,"tag":43,"props":989,"children":990},{},[991,993,999,1001,1007,1009,1015],{"type":41,"value":992},"Properties come from per-property flags, a body file, or both; flags overlay the body. Flags set top-level scalar properties only, so nested or structured values (",{"type":36,"tag":61,"props":994,"children":996},{"className":995},[],[997],{"type":41,"value":998},"tags",{"type":41,"value":1000},", nested blocks) must come from the body file. The body defaults to PCL, written as flat ",{"type":36,"tag":61,"props":1002,"children":1004},{"className":1003},[],[1005],{"type":41,"value":1006},"name = value",{"type":41,"value":1008}," attributes; pass ",{"type":36,"tag":61,"props":1010,"children":1012},{"className":1011},[],[1013],{"type":41,"value":1014},"--input yaml",{"type":41,"value":1016}," (which needs the YAML converter plugin) to use YAML instead.",{"type":36,"tag":488,"props":1018,"children":1020},{"className":490,"code":1019,"language":492,"meta":493,"style":493},"cat > bucket.pcl \u003C\u003C'EOF'\nbucket = \"my-data\"\ntags = {\n  Environment = \"dev\"\n}\nEOF\nnpx pulumi do aws:s3:Bucket create --yes --input-file bucket.pcl\n",[1021],{"type":36,"tag":61,"props":1022,"children":1023},{"__ignoreMap":493},[1024,1053,1061,1070,1078,1087,1096],{"type":36,"tag":499,"props":1025,"children":1026},{"class":501,"line":502},[1027,1032,1038,1043,1048],{"type":36,"tag":499,"props":1028,"children":1029},{"style":506},[1030],{"type":41,"value":1031},"cat",{"type":36,"tag":499,"props":1033,"children":1035},{"style":1034},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1036],{"type":41,"value":1037}," >",{"type":36,"tag":499,"props":1039,"children":1040},{"style":511},[1041],{"type":41,"value":1042}," bucket.pcl",{"type":36,"tag":499,"props":1044,"children":1045},{"style":1034},[1046],{"type":41,"value":1047}," \u003C\u003C",{"type":36,"tag":499,"props":1049,"children":1050},{"style":1034},[1051],{"type":41,"value":1052},"'EOF'\n",{"type":36,"tag":499,"props":1054,"children":1055},{"class":501,"line":547},[1056],{"type":36,"tag":499,"props":1057,"children":1058},{"style":511},[1059],{"type":41,"value":1060},"bucket = \"my-data\"\n",{"type":36,"tag":499,"props":1062,"children":1064},{"class":501,"line":1063},3,[1065],{"type":36,"tag":499,"props":1066,"children":1067},{"style":511},[1068],{"type":41,"value":1069},"tags = {\n",{"type":36,"tag":499,"props":1071,"children":1072},{"class":501,"line":24},[1073],{"type":36,"tag":499,"props":1074,"children":1075},{"style":511},[1076],{"type":41,"value":1077},"  Environment = \"dev\"\n",{"type":36,"tag":499,"props":1079,"children":1081},{"class":501,"line":1080},5,[1082],{"type":36,"tag":499,"props":1083,"children":1084},{"style":511},[1085],{"type":41,"value":1086},"}\n",{"type":36,"tag":499,"props":1088,"children":1090},{"class":501,"line":1089},6,[1091],{"type":36,"tag":499,"props":1092,"children":1093},{"style":1034},[1094],{"type":41,"value":1095},"EOF\n",{"type":36,"tag":499,"props":1097,"children":1099},{"class":501,"line":1098},7,[1100,1104,1108,1112,1116,1120,1124,1129],{"type":36,"tag":499,"props":1101,"children":1102},{"style":506},[1103],{"type":41,"value":305},{"type":36,"tag":499,"props":1105,"children":1106},{"style":511},[1107],{"type":41,"value":514},{"type":36,"tag":499,"props":1109,"children":1110},{"style":511},[1111],{"type":41,"value":519},{"type":36,"tag":499,"props":1113,"children":1114},{"style":511},[1115],{"type":41,"value":524},{"type":36,"tag":499,"props":1117,"children":1118},{"style":511},[1119],{"type":41,"value":529},{"type":36,"tag":499,"props":1121,"children":1122},{"style":511},[1123],{"type":41,"value":534},{"type":36,"tag":499,"props":1125,"children":1126},{"style":511},[1127],{"type":41,"value":1128}," --input-file",{"type":36,"tag":499,"props":1130,"children":1131},{"style":511},[1132],{"type":41,"value":1133}," bucket.pcl\n",{"type":36,"tag":43,"props":1135,"children":1136},{},[1137,1139,1145,1147,1153,1155,1161,1163,1169,1171,1179],{"type":41,"value":1138},"Before authoring properties for a resource new to this session, run ",{"type":36,"tag":61,"props":1140,"children":1142},{"className":1141},[],[1143],{"type":41,"value":1144},"npx pulumi package info \u003Cpkg> --module \u003Cmod> --resource \u003CType>",{"type":41,"value":1146}," to list its inputs and outputs with descriptions, scoped to that one resource. Reach for ",{"type":36,"tag":61,"props":1148,"children":1150},{"className":1149},[],[1151],{"type":41,"value":1152},"npx pulumi package get-schema \u003Cpkg>",{"type":41,"value":1154}," only when you need the full machine-readable schema with the nested type definitions ",{"type":36,"tag":61,"props":1156,"children":1158},{"className":1157},[],[1159],{"type":41,"value":1160},"info",{"type":41,"value":1162}," does not expand; for a large provider it runs to tens of MB, so do not read it whole. Property names are camelCase (flags are the kebab-case form). To discover names, run ",{"type":36,"tag":61,"props":1164,"children":1166},{"className":1165},[],[1167],{"type":41,"value":1168},"npx pulumi package info \u003Cpkg>",{"type":41,"value":1170}," with no module to list its modules and resources, or browse the catalog at ",{"type":36,"tag":1172,"props":1173,"children":1177},"a",{"href":1174,"rel":1175},"https:\u002F\u002Fwww.pulumi.com\u002Fregistry\u002F",[1176],"nofollow",[1178],{"type":41,"value":1174},{"type":41,"value":697},{"type":36,"tag":274,"props":1181,"children":1183},{"id":1182},"connecting-resources",[1184],{"type":41,"value":1185},"Connecting resources",{"type":36,"tag":43,"props":1187,"children":1188},{},[1189,1194,1196,1201],{"type":36,"tag":61,"props":1190,"children":1192},{"className":1191},[],[1193],{"type":41,"value":66},{"type":41,"value":1195}," keeps no state and has no resource graph, so there is no ",{"type":36,"tag":61,"props":1197,"children":1199},{"className":1198},[],[1200],{"type":41,"value":250},{"type":41,"value":1202}," reference syntax between commands. To feed one resource's output into another, read a field from the first command's JSON output and pass it as a literal flag to the next.",{"type":36,"tag":488,"props":1204,"children":1206},{"className":490,"code":1205,"language":492,"meta":493,"style":493},"# create prints JSON containing \"id\": \"vpc-0abc123\"\nnpx pulumi do aws:ec2:Vpc create --yes --cidr-block 10.0.0.0\u002F16\n\n# pass that id to the subnet\nnpx pulumi do aws:ec2:Subnet create --yes --vpc-id vpc-0abc123 --cidr-block 10.0.1.0\u002F24\n",[1207],{"type":36,"tag":61,"props":1208,"children":1209},{"__ignoreMap":493},[1210,1219,1257,1266,1274],{"type":36,"tag":499,"props":1211,"children":1212},{"class":501,"line":502},[1213],{"type":36,"tag":499,"props":1214,"children":1216},{"style":1215},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1217],{"type":41,"value":1218},"# create prints JSON containing \"id\": \"vpc-0abc123\"\n",{"type":36,"tag":499,"props":1220,"children":1221},{"class":501,"line":547},[1222,1226,1230,1234,1239,1243,1247,1252],{"type":36,"tag":499,"props":1223,"children":1224},{"style":506},[1225],{"type":41,"value":305},{"type":36,"tag":499,"props":1227,"children":1228},{"style":511},[1229],{"type":41,"value":514},{"type":36,"tag":499,"props":1231,"children":1232},{"style":511},[1233],{"type":41,"value":519},{"type":36,"tag":499,"props":1235,"children":1236},{"style":511},[1237],{"type":41,"value":1238}," aws:ec2:Vpc",{"type":36,"tag":499,"props":1240,"children":1241},{"style":511},[1242],{"type":41,"value":529},{"type":36,"tag":499,"props":1244,"children":1245},{"style":511},[1246],{"type":41,"value":534},{"type":36,"tag":499,"props":1248,"children":1249},{"style":511},[1250],{"type":41,"value":1251}," --cidr-block",{"type":36,"tag":499,"props":1253,"children":1254},{"style":511},[1255],{"type":41,"value":1256}," 10.0.0.0\u002F16\n",{"type":36,"tag":499,"props":1258,"children":1259},{"class":501,"line":1063},[1260],{"type":36,"tag":499,"props":1261,"children":1263},{"emptyLinePlaceholder":1262},true,[1264],{"type":41,"value":1265},"\n",{"type":36,"tag":499,"props":1267,"children":1268},{"class":501,"line":24},[1269],{"type":36,"tag":499,"props":1270,"children":1271},{"style":1215},[1272],{"type":41,"value":1273},"# pass that id to the subnet\n",{"type":36,"tag":499,"props":1275,"children":1276},{"class":501,"line":1080},[1277,1281,1285,1289,1294,1298,1302,1307,1312,1316],{"type":36,"tag":499,"props":1278,"children":1279},{"style":506},[1280],{"type":41,"value":305},{"type":36,"tag":499,"props":1282,"children":1283},{"style":511},[1284],{"type":41,"value":514},{"type":36,"tag":499,"props":1286,"children":1287},{"style":511},[1288],{"type":41,"value":519},{"type":36,"tag":499,"props":1290,"children":1291},{"style":511},[1292],{"type":41,"value":1293}," aws:ec2:Subnet",{"type":36,"tag":499,"props":1295,"children":1296},{"style":511},[1297],{"type":41,"value":529},{"type":36,"tag":499,"props":1299,"children":1300},{"style":511},[1301],{"type":41,"value":534},{"type":36,"tag":499,"props":1303,"children":1304},{"style":511},[1305],{"type":41,"value":1306}," --vpc-id",{"type":36,"tag":499,"props":1308,"children":1309},{"style":511},[1310],{"type":41,"value":1311}," vpc-0abc123",{"type":36,"tag":499,"props":1313,"children":1314},{"style":511},[1315],{"type":41,"value":1251},{"type":36,"tag":499,"props":1317,"children":1318},{"style":511},[1319],{"type":41,"value":1320}," 10.0.1.0\u002F24\n",{"type":36,"tag":43,"props":1322,"children":1323},{},[1324,1326,1332],{"type":41,"value":1325},"The same pattern connects resources across providers. Here a value from the ",{"type":36,"tag":61,"props":1327,"children":1329},{"className":1328},[],[1330],{"type":41,"value":1331},"random",{"type":41,"value":1333}," provider feeds an AWS resource name, a common way to get globally-unique names.",{"type":36,"tag":488,"props":1335,"children":1337},{"className":490,"code":1336,"language":492,"meta":493,"style":493},"# RandomPet prints JSON containing \"id\": \"artistic-bull\"\nnpx pulumi do random:RandomPet create --yes\n\n# use it in the bucket name\nnpx pulumi do aws:s3:Bucket create --yes --bucket assets-artistic-bull\n",[1338],{"type":36,"tag":61,"props":1339,"children":1340},{"__ignoreMap":493},[1341,1349,1378,1385,1393],{"type":36,"tag":499,"props":1342,"children":1343},{"class":501,"line":502},[1344],{"type":36,"tag":499,"props":1345,"children":1346},{"style":1215},[1347],{"type":41,"value":1348},"# RandomPet prints JSON containing \"id\": \"artistic-bull\"\n",{"type":36,"tag":499,"props":1350,"children":1351},{"class":501,"line":547},[1352,1356,1360,1364,1369,1373],{"type":36,"tag":499,"props":1353,"children":1354},{"style":506},[1355],{"type":41,"value":305},{"type":36,"tag":499,"props":1357,"children":1358},{"style":511},[1359],{"type":41,"value":514},{"type":36,"tag":499,"props":1361,"children":1362},{"style":511},[1363],{"type":41,"value":519},{"type":36,"tag":499,"props":1365,"children":1366},{"style":511},[1367],{"type":41,"value":1368}," random:RandomPet",{"type":36,"tag":499,"props":1370,"children":1371},{"style":511},[1372],{"type":41,"value":529},{"type":36,"tag":499,"props":1374,"children":1375},{"style":511},[1376],{"type":41,"value":1377}," --yes\n",{"type":36,"tag":499,"props":1379,"children":1380},{"class":501,"line":1063},[1381],{"type":36,"tag":499,"props":1382,"children":1383},{"emptyLinePlaceholder":1262},[1384],{"type":41,"value":1265},{"type":36,"tag":499,"props":1386,"children":1387},{"class":501,"line":24},[1388],{"type":36,"tag":499,"props":1389,"children":1390},{"style":1215},[1391],{"type":41,"value":1392},"# use it in the bucket name\n",{"type":36,"tag":499,"props":1394,"children":1395},{"class":501,"line":1080},[1396,1400,1404,1408,1412,1416,1420,1424],{"type":36,"tag":499,"props":1397,"children":1398},{"style":506},[1399],{"type":41,"value":305},{"type":36,"tag":499,"props":1401,"children":1402},{"style":511},[1403],{"type":41,"value":514},{"type":36,"tag":499,"props":1405,"children":1406},{"style":511},[1407],{"type":41,"value":519},{"type":36,"tag":499,"props":1409,"children":1410},{"style":511},[1411],{"type":41,"value":524},{"type":36,"tag":499,"props":1413,"children":1414},{"style":511},[1415],{"type":41,"value":529},{"type":36,"tag":499,"props":1417,"children":1418},{"style":511},[1419],{"type":41,"value":534},{"type":36,"tag":499,"props":1421,"children":1422},{"style":511},[1423],{"type":41,"value":539},{"type":36,"tag":499,"props":1425,"children":1426},{"style":511},[1427],{"type":41,"value":1428}," assets-artistic-bull\n",{"type":36,"tag":43,"props":1430,"children":1431},{},[1432,1434,1439],{"type":41,"value":1433},"When a command needs a value the chain does not produce, like an existing resource id or an API zone id, get it from a provider function, a ",{"type":36,"tag":61,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":41,"value":345},{"type":41,"value":1440}," where the provider supports it, or the user. Do not invent it.",{"type":36,"tag":274,"props":1442,"children":1444},{"id":1443},"output",[1445],{"type":41,"value":1446},"Output",{"type":36,"tag":43,"props":1448,"children":1449},{},[1450,1452,1457,1458,1463,1464,1469],{"type":41,"value":1451},"By default, ",{"type":36,"tag":61,"props":1453,"children":1455},{"className":1454},[],[1456],{"type":41,"value":218},{"type":41,"value":228},{"type":36,"tag":61,"props":1459,"children":1461},{"className":1460},[],[1462],{"type":41,"value":226},{"type":41,"value":236},{"type":36,"tag":61,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":41,"value":234},{"type":41,"value":1470}," each write one JSON object to stdout for the affected resource. Check the exit code on every invocation.",{"type":36,"tag":488,"props":1472,"children":1476},{"className":1473,"code":1474,"language":1475,"meta":493,"style":493},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"id\":     \"my-data\",\n  \"bucket\": \"my-data\",\n  \"arn\":    \"arn:aws:s3:::my-data\"\n}\n","json",[1477],{"type":36,"tag":61,"props":1478,"children":1479},{"__ignoreMap":493},[1480,1488,1530,1567,1602],{"type":36,"tag":499,"props":1481,"children":1482},{"class":501,"line":502},[1483],{"type":36,"tag":499,"props":1484,"children":1485},{"style":1034},[1486],{"type":41,"value":1487},"{\n",{"type":36,"tag":499,"props":1489,"children":1490},{"class":501,"line":547},[1491,1496,1501,1506,1511,1516,1521,1525],{"type":36,"tag":499,"props":1492,"children":1493},{"style":1034},[1494],{"type":41,"value":1495},"  \"",{"type":36,"tag":499,"props":1497,"children":1499},{"style":1498},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1500],{"type":41,"value":754},{"type":36,"tag":499,"props":1502,"children":1503},{"style":1034},[1504],{"type":41,"value":1505},"\"",{"type":36,"tag":499,"props":1507,"children":1508},{"style":1034},[1509],{"type":41,"value":1510},":",{"type":36,"tag":499,"props":1512,"children":1513},{"style":1034},[1514],{"type":41,"value":1515},"     \"",{"type":36,"tag":499,"props":1517,"children":1518},{"style":511},[1519],{"type":41,"value":1520},"my-data",{"type":36,"tag":499,"props":1522,"children":1523},{"style":1034},[1524],{"type":41,"value":1505},{"type":36,"tag":499,"props":1526,"children":1527},{"style":1034},[1528],{"type":41,"value":1529},",\n",{"type":36,"tag":499,"props":1531,"children":1532},{"class":501,"line":1063},[1533,1537,1542,1546,1550,1555,1559,1563],{"type":36,"tag":499,"props":1534,"children":1535},{"style":1034},[1536],{"type":41,"value":1495},{"type":36,"tag":499,"props":1538,"children":1539},{"style":1498},[1540],{"type":41,"value":1541},"bucket",{"type":36,"tag":499,"props":1543,"children":1544},{"style":1034},[1545],{"type":41,"value":1505},{"type":36,"tag":499,"props":1547,"children":1548},{"style":1034},[1549],{"type":41,"value":1510},{"type":36,"tag":499,"props":1551,"children":1552},{"style":1034},[1553],{"type":41,"value":1554}," \"",{"type":36,"tag":499,"props":1556,"children":1557},{"style":511},[1558],{"type":41,"value":1520},{"type":36,"tag":499,"props":1560,"children":1561},{"style":1034},[1562],{"type":41,"value":1505},{"type":36,"tag":499,"props":1564,"children":1565},{"style":1034},[1566],{"type":41,"value":1529},{"type":36,"tag":499,"props":1568,"children":1569},{"class":501,"line":24},[1570,1574,1579,1583,1587,1592,1597],{"type":36,"tag":499,"props":1571,"children":1572},{"style":1034},[1573],{"type":41,"value":1495},{"type":36,"tag":499,"props":1575,"children":1576},{"style":1498},[1577],{"type":41,"value":1578},"arn",{"type":36,"tag":499,"props":1580,"children":1581},{"style":1034},[1582],{"type":41,"value":1505},{"type":36,"tag":499,"props":1584,"children":1585},{"style":1034},[1586],{"type":41,"value":1510},{"type":36,"tag":499,"props":1588,"children":1589},{"style":1034},[1590],{"type":41,"value":1591},"    \"",{"type":36,"tag":499,"props":1593,"children":1594},{"style":511},[1595],{"type":41,"value":1596},"arn:aws:s3:::my-data",{"type":36,"tag":499,"props":1598,"children":1599},{"style":1034},[1600],{"type":41,"value":1601},"\"\n",{"type":36,"tag":499,"props":1603,"children":1604},{"class":501,"line":1080},[1605],{"type":36,"tag":499,"props":1606,"children":1607},{"style":1034},[1608],{"type":41,"value":1086},{"type":36,"tag":43,"props":1610,"children":1611},{},[1612,1614,1619,1621,1627,1629,1635,1637,1642,1644,1650],{"type":41,"value":1613},"The resource's properties are top-level, alongside an ",{"type":36,"tag":61,"props":1615,"children":1617},{"className":1616},[],[1618],{"type":41,"value":754},{"type":41,"value":1620}," field holding the cloud identifier. There is no nested ",{"type":36,"tag":61,"props":1622,"children":1624},{"className":1623},[],[1625],{"type":41,"value":1626},"outputs",{"type":41,"value":1628}," object, no ",{"type":36,"tag":61,"props":1630,"children":1632},{"className":1631},[],[1633],{"type":41,"value":1634},"urn",{"type":41,"value":1636},", and the type token you passed in is not echoed back. ",{"type":36,"tag":61,"props":1638,"children":1640},{"className":1639},[],[1641],{"type":41,"value":345},{"type":41,"value":1643}," instead writes a JSON array of ",{"type":36,"tag":61,"props":1645,"children":1647},{"className":1646},[],[1648],{"type":41,"value":1649},"{id, name}",{"type":41,"value":1651}," entries, and a function writes its declared result shape.",{"type":36,"tag":274,"props":1653,"children":1655},{"id":1654},"graduating-to-level-2",[1656],{"type":41,"value":1657},"Graduating to Level 2",{"type":36,"tag":43,"props":1659,"children":1660},{},[1661,1663,1668,1670,1676,1678,1683,1685,1690,1692,1697],{"type":41,"value":1662},"Eject to Level 2 when one-shot commands stop fitting. Because ",{"type":36,"tag":61,"props":1664,"children":1666},{"className":1665},[],[1667],{"type":41,"value":66},{"type":41,"value":1669}," leaves no Pulumi state behind, the resources it created are ordinary cloud resources, so you adopt them into a project with ",{"type":36,"tag":61,"props":1671,"children":1673},{"className":1672},[],[1674],{"type":41,"value":1675},"pulumi import",{"type":41,"value":1677},". From inside a Pulumi project, run ",{"type":36,"tag":61,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":41,"value":1675},{"type":41,"value":1684}," with each resource's full type token, a logical name, and the cloud ",{"type":36,"tag":61,"props":1686,"children":1688},{"className":1687},[],[1689],{"type":41,"value":754},{"type":41,"value":1691}," that ",{"type":36,"tag":61,"props":1693,"children":1695},{"className":1694},[],[1696],{"type":41,"value":218},{"type":41,"value":1698}," returned. Import records the resource in the stack's state and, by default, generates its program code.",{"type":36,"tag":488,"props":1700,"children":1702},{"className":490,"code":1701,"language":492,"meta":493,"style":493},"# the import type token is the full pkg:mod\u002Ftype:Type form, not pulumi do's short aws:s3:Bucket\nnpx pulumi import aws:s3\u002Fbucket:Bucket assets my-data\n",[1703],{"type":36,"tag":61,"props":1704,"children":1705},{"__ignoreMap":493},[1706,1714],{"type":36,"tag":499,"props":1707,"children":1708},{"class":501,"line":502},[1709],{"type":36,"tag":499,"props":1710,"children":1711},{"style":1215},[1712],{"type":41,"value":1713},"# the import type token is the full pkg:mod\u002Ftype:Type form, not pulumi do's short aws:s3:Bucket\n",{"type":36,"tag":499,"props":1715,"children":1716},{"class":501,"line":547},[1717,1721,1725,1730,1735,1740],{"type":36,"tag":499,"props":1718,"children":1719},{"style":506},[1720],{"type":41,"value":305},{"type":36,"tag":499,"props":1722,"children":1723},{"style":511},[1724],{"type":41,"value":514},{"type":36,"tag":499,"props":1726,"children":1727},{"style":511},[1728],{"type":41,"value":1729}," import",{"type":36,"tag":499,"props":1731,"children":1732},{"style":511},[1733],{"type":41,"value":1734}," aws:s3\u002Fbucket:Bucket",{"type":36,"tag":499,"props":1736,"children":1737},{"style":511},[1738],{"type":41,"value":1739}," assets",{"type":36,"tag":499,"props":1741,"children":1742},{"style":511},[1743],{"type":41,"value":544},{"type":36,"tag":43,"props":1745,"children":1746},{},[1747,1749,1754,1756,1762],{"type":41,"value":1748},"Move the generated code into your program, then manage the resource there instead of with ",{"type":36,"tag":61,"props":1750,"children":1752},{"className":1751},[],[1753],{"type":41,"value":66},{"type":41,"value":1755},". To adopt several at once, pass them in a bulk ",{"type":36,"tag":61,"props":1757,"children":1759},{"className":1758},[],[1760],{"type":41,"value":1761},"--file",{"type":41,"value":697},{"type":36,"tag":175,"props":1764,"children":1765},{},[],{"type":36,"tag":49,"props":1767,"children":1769},{"id":1768},"level-2-full-infrastructure-as-code",[1770],{"type":41,"value":1771},"Level 2: full infrastructure as code",{"type":36,"tag":43,"props":1773,"children":1774},{},[1775],{"type":41,"value":1776},"Level 2 is a Pulumi project: code in Python, TypeScript, Go, C#, or Java that describes a set of related resources and their dependencies. Start here when the task involves multiple related resources, loops or conditionals, reusable abstractions, or environment-specific variants. It is also the right level when ad-hoc work at Level 1 has grown past what a few CLI invocations should carry. Match the user's existing codebase language when one is present; default to TypeScript otherwise.",{"type":36,"tag":43,"props":1778,"children":1779},{},[1780,1782,1788,1790,1796,1797,1803,1805,1811],{"type":41,"value":1781},"Before writing any non-trivial program, use skill ",{"type":36,"tag":61,"props":1783,"children":1785},{"className":1784},[],[1786],{"type":41,"value":1787},"pulumi-best-practices",{"type":41,"value":1789},", which covers ",{"type":36,"tag":61,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":41,"value":1795},"Output\u003CT>",{"type":41,"value":763},{"type":36,"tag":61,"props":1798,"children":1800},{"className":1799},[],[1801],{"type":41,"value":1802},"apply()",{"type":41,"value":1804}," usage, passing outputs directly as inputs, component structure and parenting, secrets hygiene, and safe refactoring with ",{"type":36,"tag":61,"props":1806,"children":1808},{"className":1807},[],[1809],{"type":41,"value":1810},"aliases",{"type":41,"value":697},{"type":36,"tag":274,"props":1813,"children":1815},{"id":1814},"bootstrapping",[1816],{"type":41,"value":1817},"Bootstrapping",{"type":36,"tag":43,"props":1819,"children":1820},{},[1821],{"type":41,"value":1822},"The quickest way to start a project is with a template, though you can scaffold one by hand if you prefer:",{"type":36,"tag":488,"props":1824,"children":1826},{"className":490,"code":1825,"language":492,"meta":493,"style":493},"npx pulumi new aws-typescript\nnpx pulumi new gcp-go\n",[1827],{"type":36,"tag":61,"props":1828,"children":1829},{"__ignoreMap":493},[1830,1851],{"type":36,"tag":499,"props":1831,"children":1832},{"class":501,"line":502},[1833,1837,1841,1846],{"type":36,"tag":499,"props":1834,"children":1835},{"style":506},[1836],{"type":41,"value":305},{"type":36,"tag":499,"props":1838,"children":1839},{"style":511},[1840],{"type":41,"value":514},{"type":36,"tag":499,"props":1842,"children":1843},{"style":511},[1844],{"type":41,"value":1845}," new",{"type":36,"tag":499,"props":1847,"children":1848},{"style":511},[1849],{"type":41,"value":1850}," aws-typescript\n",{"type":36,"tag":499,"props":1852,"children":1853},{"class":501,"line":547},[1854,1858,1862,1866],{"type":36,"tag":499,"props":1855,"children":1856},{"style":506},[1857],{"type":41,"value":305},{"type":36,"tag":499,"props":1859,"children":1860},{"style":511},[1861],{"type":41,"value":514},{"type":36,"tag":499,"props":1863,"children":1864},{"style":511},[1865],{"type":41,"value":1845},{"type":36,"tag":499,"props":1867,"children":1868},{"style":511},[1869],{"type":41,"value":1870}," gcp-go\n",{"type":36,"tag":43,"props":1872,"children":1873},{},[1874,1876,1881,1883,1889,1891,1897],{"type":41,"value":1875},"Templates set up the working directory, ",{"type":36,"tag":61,"props":1877,"children":1879},{"className":1878},[],[1880],{"type":41,"value":263},{"type":41,"value":1882},", an initial stack, the language's package manifest, and a starter program. Browse the full catalog with ",{"type":36,"tag":61,"props":1884,"children":1886},{"className":1885},[],[1887],{"type":41,"value":1888},"npx pulumi template list",{"type":41,"value":1890},", or filter by name with ",{"type":36,"tag":61,"props":1892,"children":1894},{"className":1893},[],[1895],{"type":41,"value":1896},"npx pulumi template list --name \u003Cfilter>",{"type":41,"value":697},{"type":36,"tag":274,"props":1899,"children":1901},{"id":1900},"core-lifecycle",[1902],{"type":41,"value":1903},"Core lifecycle",{"type":36,"tag":43,"props":1905,"children":1906},{},[1907],{"type":41,"value":1908},"The lifecycle commands work the same across languages:",{"type":36,"tag":488,"props":1910,"children":1912},{"className":490,"code":1911,"language":492,"meta":493,"style":493},"npx pulumi preview      # show what would change\nnpx pulumi up           # apply\nnpx pulumi refresh      # reconcile state with cloud reality\n",[1913],{"type":36,"tag":61,"props":1914,"children":1915},{"__ignoreMap":493},[1916,1937,1958],{"type":36,"tag":499,"props":1917,"children":1918},{"class":501,"line":502},[1919,1923,1927,1932],{"type":36,"tag":499,"props":1920,"children":1921},{"style":506},[1922],{"type":41,"value":305},{"type":36,"tag":499,"props":1924,"children":1925},{"style":511},[1926],{"type":41,"value":514},{"type":36,"tag":499,"props":1928,"children":1929},{"style":511},[1930],{"type":41,"value":1931}," preview",{"type":36,"tag":499,"props":1933,"children":1934},{"style":1215},[1935],{"type":41,"value":1936},"      # show what would change\n",{"type":36,"tag":499,"props":1938,"children":1939},{"class":501,"line":547},[1940,1944,1948,1953],{"type":36,"tag":499,"props":1941,"children":1942},{"style":506},[1943],{"type":41,"value":305},{"type":36,"tag":499,"props":1945,"children":1946},{"style":511},[1947],{"type":41,"value":514},{"type":36,"tag":499,"props":1949,"children":1950},{"style":511},[1951],{"type":41,"value":1952}," up",{"type":36,"tag":499,"props":1954,"children":1955},{"style":1215},[1956],{"type":41,"value":1957},"           # apply\n",{"type":36,"tag":499,"props":1959,"children":1960},{"class":501,"line":1063},[1961,1965,1969,1974],{"type":36,"tag":499,"props":1962,"children":1963},{"style":506},[1964],{"type":41,"value":305},{"type":36,"tag":499,"props":1966,"children":1967},{"style":511},[1968],{"type":41,"value":514},{"type":36,"tag":499,"props":1970,"children":1971},{"style":511},[1972],{"type":41,"value":1973}," refresh",{"type":36,"tag":499,"props":1975,"children":1976},{"style":1215},[1977],{"type":41,"value":1978},"      # reconcile state with cloud reality\n",{"type":36,"tag":43,"props":1980,"children":1981},{},[1982,1984,1990,1992,1998],{"type":41,"value":1983},"Always run ",{"type":36,"tag":61,"props":1985,"children":1987},{"className":1986},[],[1988],{"type":41,"value":1989},"preview",{"type":41,"value":1991}," before ",{"type":36,"tag":61,"props":1993,"children":1995},{"className":1994},[],[1996],{"type":41,"value":1997},"up",{"type":41,"value":1999},"; it shows what will change and costs nothing.",{"type":36,"tag":43,"props":2001,"children":2002},{},[2003,2009],{"type":36,"tag":61,"props":2004,"children":2006},{"className":2005},[],[2007],{"type":41,"value":2008},"pulumi destroy",{"type":41,"value":2010}," tears down every resource in the stack. The Pulumi docs call it \"generally irreversible\"; never invoke without explicit user confirmation of the stack name.",{"type":36,"tag":274,"props":2012,"children":2014},{"id":2013},"stacks-and-config",[2015],{"type":41,"value":2016},"Stacks and config",{"type":36,"tag":43,"props":2018,"children":2019},{},[2020,2022,2028,2029,2035,2036,2042],{"type":41,"value":2021},"A stack is an isolated instance of a project. A common pattern is one stack per environment, named ",{"type":36,"tag":61,"props":2023,"children":2025},{"className":2024},[],[2026],{"type":41,"value":2027},"dev",{"type":41,"value":228},{"type":36,"tag":61,"props":2030,"children":2032},{"className":2031},[],[2033],{"type":41,"value":2034},"staging",{"type":41,"value":236},{"type":36,"tag":61,"props":2037,"children":2039},{"className":2038},[],[2040],{"type":41,"value":2041},"prod",{"type":41,"value":697},{"type":36,"tag":488,"props":2044,"children":2046},{"className":490,"code":2045,"language":492,"meta":493,"style":493},"npx pulumi stack init dev\nnpx pulumi stack select prod\n\nnpx pulumi config set aws:region us-west-2\nnpx pulumi config set --secret dbPassword \"...\"\n",[2047],{"type":36,"tag":61,"props":2048,"children":2049},{"__ignoreMap":493},[2050,2076,2101,2108,2139],{"type":36,"tag":499,"props":2051,"children":2052},{"class":501,"line":502},[2053,2057,2061,2066,2071],{"type":36,"tag":499,"props":2054,"children":2055},{"style":506},[2056],{"type":41,"value":305},{"type":36,"tag":499,"props":2058,"children":2059},{"style":511},[2060],{"type":41,"value":514},{"type":36,"tag":499,"props":2062,"children":2063},{"style":511},[2064],{"type":41,"value":2065}," stack",{"type":36,"tag":499,"props":2067,"children":2068},{"style":511},[2069],{"type":41,"value":2070}," init",{"type":36,"tag":499,"props":2072,"children":2073},{"style":511},[2074],{"type":41,"value":2075}," dev\n",{"type":36,"tag":499,"props":2077,"children":2078},{"class":501,"line":547},[2079,2083,2087,2091,2096],{"type":36,"tag":499,"props":2080,"children":2081},{"style":506},[2082],{"type":41,"value":305},{"type":36,"tag":499,"props":2084,"children":2085},{"style":511},[2086],{"type":41,"value":514},{"type":36,"tag":499,"props":2088,"children":2089},{"style":511},[2090],{"type":41,"value":2065},{"type":36,"tag":499,"props":2092,"children":2093},{"style":511},[2094],{"type":41,"value":2095}," select",{"type":36,"tag":499,"props":2097,"children":2098},{"style":511},[2099],{"type":41,"value":2100}," prod\n",{"type":36,"tag":499,"props":2102,"children":2103},{"class":501,"line":1063},[2104],{"type":36,"tag":499,"props":2105,"children":2106},{"emptyLinePlaceholder":1262},[2107],{"type":41,"value":1265},{"type":36,"tag":499,"props":2109,"children":2110},{"class":501,"line":24},[2111,2115,2119,2124,2129,2134],{"type":36,"tag":499,"props":2112,"children":2113},{"style":506},[2114],{"type":41,"value":305},{"type":36,"tag":499,"props":2116,"children":2117},{"style":511},[2118],{"type":41,"value":514},{"type":36,"tag":499,"props":2120,"children":2121},{"style":511},[2122],{"type":41,"value":2123}," config",{"type":36,"tag":499,"props":2125,"children":2126},{"style":511},[2127],{"type":41,"value":2128}," set",{"type":36,"tag":499,"props":2130,"children":2131},{"style":511},[2132],{"type":41,"value":2133}," aws:region",{"type":36,"tag":499,"props":2135,"children":2136},{"style":511},[2137],{"type":41,"value":2138}," us-west-2\n",{"type":36,"tag":499,"props":2140,"children":2141},{"class":501,"line":1080},[2142,2146,2150,2154,2158,2163,2168,2172,2177],{"type":36,"tag":499,"props":2143,"children":2144},{"style":506},[2145],{"type":41,"value":305},{"type":36,"tag":499,"props":2147,"children":2148},{"style":511},[2149],{"type":41,"value":514},{"type":36,"tag":499,"props":2151,"children":2152},{"style":511},[2153],{"type":41,"value":2123},{"type":36,"tag":499,"props":2155,"children":2156},{"style":511},[2157],{"type":41,"value":2128},{"type":36,"tag":499,"props":2159,"children":2160},{"style":511},[2161],{"type":41,"value":2162}," --secret",{"type":36,"tag":499,"props":2164,"children":2165},{"style":511},[2166],{"type":41,"value":2167}," dbPassword",{"type":36,"tag":499,"props":2169,"children":2170},{"style":1034},[2171],{"type":41,"value":1554},{"type":36,"tag":499,"props":2173,"children":2174},{"style":511},[2175],{"type":41,"value":2176},"...",{"type":36,"tag":499,"props":2178,"children":2179},{"style":1034},[2180],{"type":41,"value":1601},{"type":36,"tag":43,"props":2182,"children":2183},{},[2184,2186,2192,2194,2200,2202,2207,2209,2214,2216,2221],{"type":41,"value":2185},"Read configuration values from inside the program with the SDK's ",{"type":36,"tag":61,"props":2187,"children":2189},{"className":2188},[],[2190],{"type":41,"value":2191},"Config",{"type":41,"value":2193}," object; the exact operation names vary by language, so refer to the per-language examples at ",{"type":36,"tag":1172,"props":2195,"children":2198},{"href":2196,"rel":2197},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fiac\u002Fconcepts\u002Fconfig\u002F#code",[1176],[2199],{"type":41,"value":2196},{"type":41,"value":2201},". Use skill ",{"type":36,"tag":61,"props":2203,"children":2205},{"className":2204},[],[2206],{"type":41,"value":1787},{"type":41,"value":2208}," for ",{"type":36,"tag":61,"props":2210,"children":2212},{"className":2211},[],[2213],{"type":41,"value":1795},{"type":41,"value":2215}," \u002F ",{"type":36,"tag":61,"props":2217,"children":2219},{"className":2218},[],[2220],{"type":41,"value":1802},{"type":41,"value":2222}," usage and broader secrets hygiene.",{"type":36,"tag":43,"props":2224,"children":2225},{},[2226,2228,2234,2236,2242],{"type":41,"value":2227},"A stack only touches resources tracked in its state, so removing a resource from your program causes ",{"type":36,"tag":61,"props":2229,"children":2231},{"className":2230},[],[2232],{"type":41,"value":2233},"pulumi up",{"type":41,"value":2235}," to delete it from the cloud. Set ",{"type":36,"tag":61,"props":2237,"children":2239},{"className":2238},[],[2240],{"type":41,"value":2241},"protect: true",{"type":41,"value":2243}," on anything you cannot afford to lose.",{"type":36,"tag":43,"props":2245,"children":2246},{},[2247,2249,2255],{"type":41,"value":2248},"For the full IaC reference, see ",{"type":36,"tag":1172,"props":2250,"children":2253},{"href":2251,"rel":2252},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fiac\u002F",[1176],[2254],{"type":41,"value":2251},{"type":41,"value":697},{"type":36,"tag":175,"props":2257,"children":2258},{},[],{"type":36,"tag":49,"props":2260,"children":2262},{"id":2261},"level-3-governance-and-operations",[2263],{"type":41,"value":2264},"Level 3: governance and operations",{"type":36,"tag":43,"props":2266,"children":2267},{},[2268],{"type":41,"value":2269},"Level 3 uses Pulumi Cloud for more than state. ESC holds the credentials for every provider a project touches and brokers them into runs and shells. Policy enforcement, hosted execution, drift detection, scheduled operations, and audit round out the surface.",{"type":36,"tag":274,"props":2271,"children":2273},{"id":2272},"esc-environments-secrets-configuration",[2274],{"type":41,"value":2275},"ESC: environments, secrets, configuration",{"type":36,"tag":43,"props":2277,"children":2278},{},[2279],{"type":41,"value":2280},"An ESC environment composes secrets and configuration from cloud secret managers, OIDC-vended credentials, and other ESC environments into a single resolved bundle that programs and stacks consume.",{"type":36,"tag":488,"props":2282,"children":2284},{"className":490,"code":2283,"language":492,"meta":493,"style":493},"npx pulumi env init my_org\u002Faws\u002Fprod\nnpx pulumi env set my_org\u002Faws\u002Fprod aws.region us-west-2\nnpx pulumi env open my_org\u002Faws\u002Fprod\nnpx pulumi env run my_org\u002Faws\u002Fprod -- aws s3 ls\n",[2285],{"type":36,"tag":61,"props":2286,"children":2287},{"__ignoreMap":493},[2288,2313,2346,2370],{"type":36,"tag":499,"props":2289,"children":2290},{"class":501,"line":502},[2291,2295,2299,2304,2308],{"type":36,"tag":499,"props":2292,"children":2293},{"style":506},[2294],{"type":41,"value":305},{"type":36,"tag":499,"props":2296,"children":2297},{"style":511},[2298],{"type":41,"value":514},{"type":36,"tag":499,"props":2300,"children":2301},{"style":511},[2302],{"type":41,"value":2303}," env",{"type":36,"tag":499,"props":2305,"children":2306},{"style":511},[2307],{"type":41,"value":2070},{"type":36,"tag":499,"props":2309,"children":2310},{"style":511},[2311],{"type":41,"value":2312}," my_org\u002Faws\u002Fprod\n",{"type":36,"tag":499,"props":2314,"children":2315},{"class":501,"line":547},[2316,2320,2324,2328,2332,2337,2342],{"type":36,"tag":499,"props":2317,"children":2318},{"style":506},[2319],{"type":41,"value":305},{"type":36,"tag":499,"props":2321,"children":2322},{"style":511},[2323],{"type":41,"value":514},{"type":36,"tag":499,"props":2325,"children":2326},{"style":511},[2327],{"type":41,"value":2303},{"type":36,"tag":499,"props":2329,"children":2330},{"style":511},[2331],{"type":41,"value":2128},{"type":36,"tag":499,"props":2333,"children":2334},{"style":511},[2335],{"type":41,"value":2336}," my_org\u002Faws\u002Fprod",{"type":36,"tag":499,"props":2338,"children":2339},{"style":511},[2340],{"type":41,"value":2341}," aws.region",{"type":36,"tag":499,"props":2343,"children":2344},{"style":511},[2345],{"type":41,"value":2138},{"type":36,"tag":499,"props":2347,"children":2348},{"class":501,"line":1063},[2349,2353,2357,2361,2366],{"type":36,"tag":499,"props":2350,"children":2351},{"style":506},[2352],{"type":41,"value":305},{"type":36,"tag":499,"props":2354,"children":2355},{"style":511},[2356],{"type":41,"value":514},{"type":36,"tag":499,"props":2358,"children":2359},{"style":511},[2360],{"type":41,"value":2303},{"type":36,"tag":499,"props":2362,"children":2363},{"style":511},[2364],{"type":41,"value":2365}," open",{"type":36,"tag":499,"props":2367,"children":2368},{"style":511},[2369],{"type":41,"value":2312},{"type":36,"tag":499,"props":2371,"children":2372},{"class":501,"line":24},[2373,2377,2381,2385,2390,2394,2399,2404,2409],{"type":36,"tag":499,"props":2374,"children":2375},{"style":506},[2376],{"type":41,"value":305},{"type":36,"tag":499,"props":2378,"children":2379},{"style":511},[2380],{"type":41,"value":514},{"type":36,"tag":499,"props":2382,"children":2383},{"style":511},[2384],{"type":41,"value":2303},{"type":36,"tag":499,"props":2386,"children":2387},{"style":511},[2388],{"type":41,"value":2389}," run",{"type":36,"tag":499,"props":2391,"children":2392},{"style":511},[2393],{"type":41,"value":2336},{"type":36,"tag":499,"props":2395,"children":2396},{"style":511},[2397],{"type":41,"value":2398}," --",{"type":36,"tag":499,"props":2400,"children":2401},{"style":511},[2402],{"type":41,"value":2403}," aws",{"type":36,"tag":499,"props":2405,"children":2406},{"style":511},[2407],{"type":41,"value":2408}," s3",{"type":36,"tag":499,"props":2410,"children":2411},{"style":511},[2412],{"type":41,"value":2413}," ls\n",{"type":36,"tag":43,"props":2415,"children":2416},{},[2417,2423,2425,2431,2433,2438],{"type":36,"tag":2418,"props":2419,"children":2420},"strong",{},[2421],{"type":41,"value":2422},"Where the provider supports it, vend cloud credentials through OIDC rather than static keys in environment YAML.",{"type":41,"value":2424}," OIDC trust policies, IdP registration, and rotation patterns live in ",{"type":36,"tag":61,"props":2426,"children":2428},{"className":2427},[],[2429],{"type":41,"value":2430},"pulumi-esc",{"type":41,"value":2432},"; use skill ",{"type":36,"tag":61,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":41,"value":2430},{"type":41,"value":2439}," rather than invent ESC YAML by hand.",{"type":36,"tag":43,"props":2441,"children":2442},{},[2443,2449,2451,2457],{"type":36,"tag":61,"props":2444,"children":2446},{"className":2445},[],[2447],{"type":41,"value":2448},"env open",{"type":41,"value":2450}," resolves and prints live credentials, so avoid capturing its output into logs or transcripts. Prefer ",{"type":36,"tag":61,"props":2452,"children":2454},{"className":2453},[],[2455],{"type":41,"value":2456},"env run -- \u003Ccommand>",{"type":41,"value":2458},", which injects the credentials into the child process rather than printing them.",{"type":36,"tag":274,"props":2460,"children":2462},{"id":2461},"policy",[2463],{"type":41,"value":2464},"Policy",{"type":36,"tag":43,"props":2466,"children":2467},{},[2468],{"type":41,"value":2469},"Pulumi Policies runs policy packs against the resource graph at preview and update time. A policy can reject the deployment, require approval, or annotate resources with findings; enforcement happens before any cloud API call.",{"type":36,"tag":488,"props":2471,"children":2473},{"className":490,"code":2472,"language":492,"meta":493,"style":493},"npx pulumi policy new aws-typescript          # scaffold a pack from a policy template\nnpx pulumi policy publish my_org              # the pack name comes from PulumiPolicy.yaml\nnpx pulumi policy enable my_org\u002F\u003Cpack-name> latest --policy-group production\n",[2474],{"type":36,"tag":61,"props":2475,"children":2476},{"__ignoreMap":493},[2477,2507,2537],{"type":36,"tag":499,"props":2478,"children":2479},{"class":501,"line":502},[2480,2484,2488,2493,2497,2502],{"type":36,"tag":499,"props":2481,"children":2482},{"style":506},[2483],{"type":41,"value":305},{"type":36,"tag":499,"props":2485,"children":2486},{"style":511},[2487],{"type":41,"value":514},{"type":36,"tag":499,"props":2489,"children":2490},{"style":511},[2491],{"type":41,"value":2492}," policy",{"type":36,"tag":499,"props":2494,"children":2495},{"style":511},[2496],{"type":41,"value":1845},{"type":36,"tag":499,"props":2498,"children":2499},{"style":511},[2500],{"type":41,"value":2501}," aws-typescript",{"type":36,"tag":499,"props":2503,"children":2504},{"style":1215},[2505],{"type":41,"value":2506},"          # scaffold a pack from a policy template\n",{"type":36,"tag":499,"props":2508,"children":2509},{"class":501,"line":547},[2510,2514,2518,2522,2527,2532],{"type":36,"tag":499,"props":2511,"children":2512},{"style":506},[2513],{"type":41,"value":305},{"type":36,"tag":499,"props":2515,"children":2516},{"style":511},[2517],{"type":41,"value":514},{"type":36,"tag":499,"props":2519,"children":2520},{"style":511},[2521],{"type":41,"value":2492},{"type":36,"tag":499,"props":2523,"children":2524},{"style":511},[2525],{"type":41,"value":2526}," publish",{"type":36,"tag":499,"props":2528,"children":2529},{"style":511},[2530],{"type":41,"value":2531}," my_org",{"type":36,"tag":499,"props":2533,"children":2534},{"style":1215},[2535],{"type":41,"value":2536},"              # the pack name comes from PulumiPolicy.yaml\n",{"type":36,"tag":499,"props":2538,"children":2539},{"class":501,"line":1063},[2540,2544,2548,2552,2557,2562,2567,2572,2578,2583,2588,2593],{"type":36,"tag":499,"props":2541,"children":2542},{"style":506},[2543],{"type":41,"value":305},{"type":36,"tag":499,"props":2545,"children":2546},{"style":511},[2547],{"type":41,"value":514},{"type":36,"tag":499,"props":2549,"children":2550},{"style":511},[2551],{"type":41,"value":2492},{"type":36,"tag":499,"props":2553,"children":2554},{"style":511},[2555],{"type":41,"value":2556}," enable",{"type":36,"tag":499,"props":2558,"children":2559},{"style":511},[2560],{"type":41,"value":2561}," my_org\u002F",{"type":36,"tag":499,"props":2563,"children":2564},{"style":1034},[2565],{"type":41,"value":2566},"\u003C",{"type":36,"tag":499,"props":2568,"children":2569},{"style":511},[2570],{"type":41,"value":2571},"pack-nam",{"type":36,"tag":499,"props":2573,"children":2575},{"style":2574},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2576],{"type":41,"value":2577},"e",{"type":36,"tag":499,"props":2579,"children":2580},{"style":1034},[2581],{"type":41,"value":2582},">",{"type":36,"tag":499,"props":2584,"children":2585},{"style":511},[2586],{"type":41,"value":2587}," latest",{"type":36,"tag":499,"props":2589,"children":2590},{"style":511},[2591],{"type":41,"value":2592}," --policy-group",{"type":36,"tag":499,"props":2594,"children":2595},{"style":511},[2596],{"type":41,"value":2597}," production\n",{"type":36,"tag":43,"props":2599,"children":2600},{},[2601],{"type":41,"value":2602},"Policies are written in TypeScript or Python, the same languages you use for programs.",{"type":36,"tag":274,"props":2604,"children":2606},{"id":2605},"deployments",[2607],{"type":41,"value":2608},"Deployments",{"type":36,"tag":43,"props":2610,"children":2611},{},[2612,2614,2619,2620,2625,2626,2632],{"type":41,"value":2613},"Pulumi Deployments runs ",{"type":36,"tag":61,"props":2615,"children":2617},{"className":2616},[],[2618],{"type":41,"value":2233},{"type":41,"value":228},{"type":36,"tag":61,"props":2621,"children":2623},{"className":2622},[],[2624],{"type":41,"value":1989},{"type":41,"value":236},{"type":36,"tag":61,"props":2627,"children":2629},{"className":2628},[],[2630],{"type":41,"value":2631},"destroy",{"type":41,"value":2633}," in Pulumi-managed infrastructure rather than on the local machine. Use it for CI without maintaining your own runners and for any operation that needs to run server-side.",{"type":36,"tag":488,"props":2635,"children":2637},{"className":490,"code":2636,"language":492,"meta":493,"style":493},"npx pulumi deployment run update --stack my_org\u002Fproj\u002Fprod\n",[2638],{"type":36,"tag":61,"props":2639,"children":2640},{"__ignoreMap":493},[2641],{"type":36,"tag":499,"props":2642,"children":2643},{"class":501,"line":502},[2644,2648,2652,2657,2661,2666,2671],{"type":36,"tag":499,"props":2645,"children":2646},{"style":506},[2647],{"type":41,"value":305},{"type":36,"tag":499,"props":2649,"children":2650},{"style":511},[2651],{"type":41,"value":514},{"type":36,"tag":499,"props":2653,"children":2654},{"style":511},[2655],{"type":41,"value":2656}," deployment",{"type":36,"tag":499,"props":2658,"children":2659},{"style":511},[2660],{"type":41,"value":2389},{"type":36,"tag":499,"props":2662,"children":2663},{"style":511},[2664],{"type":41,"value":2665}," update",{"type":36,"tag":499,"props":2667,"children":2668},{"style":511},[2669],{"type":41,"value":2670}," --stack",{"type":36,"tag":499,"props":2672,"children":2673},{"style":511},[2674],{"type":41,"value":2675}," my_org\u002Fproj\u002Fprod\n",{"type":36,"tag":43,"props":2677,"children":2678},{},[2679,2681,2687],{"type":41,"value":2680},"The target stack must already exist; a wrong ",{"type":36,"tag":61,"props":2682,"children":2684},{"className":2683},[],[2685],{"type":41,"value":2686},"--stack",{"type":41,"value":2688}," value can prompt to create a new stack rather than fail.",{"type":36,"tag":274,"props":2690,"children":2692},{"id":2691},"drift-detection-and-scheduled-operations",[2693],{"type":41,"value":2694},"Drift detection and scheduled operations",{"type":36,"tag":43,"props":2696,"children":2697},{},[2698],{"type":41,"value":2699},"Drift detection compares stack state against the cloud and reports anything that has diverged. For an ad-hoc local check, run a refresh in preview-only mode. Pulumi Cloud schedules operations on a cron (times are UTC), including a purpose-built drift kind.",{"type":36,"tag":488,"props":2701,"children":2703},{"className":490,"code":2702,"language":492,"meta":493,"style":493},"# Ad-hoc local drift check\nnpx pulumi refresh --preview-only\n\n# Scheduled drift detection (detection only)\nnpx pulumi stack schedule new --kind drift --cron \"0 0 * * *\"\n\n# Scheduled secret rotation for an ESC environment\nnpx pulumi env schedule new my_org\u002Faws\u002Fprod --cron \"0 0 1 * *\"\n",[2704],{"type":36,"tag":61,"props":2705,"children":2706},{"__ignoreMap":493},[2707,2715,2735,2742,2750,2802,2809,2817],{"type":36,"tag":499,"props":2708,"children":2709},{"class":501,"line":502},[2710],{"type":36,"tag":499,"props":2711,"children":2712},{"style":1215},[2713],{"type":41,"value":2714},"# Ad-hoc local drift check\n",{"type":36,"tag":499,"props":2716,"children":2717},{"class":501,"line":547},[2718,2722,2726,2730],{"type":36,"tag":499,"props":2719,"children":2720},{"style":506},[2721],{"type":41,"value":305},{"type":36,"tag":499,"props":2723,"children":2724},{"style":511},[2725],{"type":41,"value":514},{"type":36,"tag":499,"props":2727,"children":2728},{"style":511},[2729],{"type":41,"value":1973},{"type":36,"tag":499,"props":2731,"children":2732},{"style":511},[2733],{"type":41,"value":2734}," --preview-only\n",{"type":36,"tag":499,"props":2736,"children":2737},{"class":501,"line":1063},[2738],{"type":36,"tag":499,"props":2739,"children":2740},{"emptyLinePlaceholder":1262},[2741],{"type":41,"value":1265},{"type":36,"tag":499,"props":2743,"children":2744},{"class":501,"line":24},[2745],{"type":36,"tag":499,"props":2746,"children":2747},{"style":1215},[2748],{"type":41,"value":2749},"# Scheduled drift detection (detection only)\n",{"type":36,"tag":499,"props":2751,"children":2752},{"class":501,"line":1080},[2753,2757,2761,2765,2770,2774,2779,2784,2789,2793,2798],{"type":36,"tag":499,"props":2754,"children":2755},{"style":506},[2756],{"type":41,"value":305},{"type":36,"tag":499,"props":2758,"children":2759},{"style":511},[2760],{"type":41,"value":514},{"type":36,"tag":499,"props":2762,"children":2763},{"style":511},[2764],{"type":41,"value":2065},{"type":36,"tag":499,"props":2766,"children":2767},{"style":511},[2768],{"type":41,"value":2769}," schedule",{"type":36,"tag":499,"props":2771,"children":2772},{"style":511},[2773],{"type":41,"value":1845},{"type":36,"tag":499,"props":2775,"children":2776},{"style":511},[2777],{"type":41,"value":2778}," --kind",{"type":36,"tag":499,"props":2780,"children":2781},{"style":511},[2782],{"type":41,"value":2783}," drift",{"type":36,"tag":499,"props":2785,"children":2786},{"style":511},[2787],{"type":41,"value":2788}," --cron",{"type":36,"tag":499,"props":2790,"children":2791},{"style":1034},[2792],{"type":41,"value":1554},{"type":36,"tag":499,"props":2794,"children":2795},{"style":511},[2796],{"type":41,"value":2797},"0 0 * * *",{"type":36,"tag":499,"props":2799,"children":2800},{"style":1034},[2801],{"type":41,"value":1601},{"type":36,"tag":499,"props":2803,"children":2804},{"class":501,"line":1089},[2805],{"type":36,"tag":499,"props":2806,"children":2807},{"emptyLinePlaceholder":1262},[2808],{"type":41,"value":1265},{"type":36,"tag":499,"props":2810,"children":2811},{"class":501,"line":1098},[2812],{"type":36,"tag":499,"props":2813,"children":2814},{"style":1215},[2815],{"type":41,"value":2816},"# Scheduled secret rotation for an ESC environment\n",{"type":36,"tag":499,"props":2818,"children":2820},{"class":501,"line":2819},8,[2821,2825,2829,2833,2837,2841,2845,2849,2853,2858],{"type":36,"tag":499,"props":2822,"children":2823},{"style":506},[2824],{"type":41,"value":305},{"type":36,"tag":499,"props":2826,"children":2827},{"style":511},[2828],{"type":41,"value":514},{"type":36,"tag":499,"props":2830,"children":2831},{"style":511},[2832],{"type":41,"value":2303},{"type":36,"tag":499,"props":2834,"children":2835},{"style":511},[2836],{"type":41,"value":2769},{"type":36,"tag":499,"props":2838,"children":2839},{"style":511},[2840],{"type":41,"value":1845},{"type":36,"tag":499,"props":2842,"children":2843},{"style":511},[2844],{"type":41,"value":2336},{"type":36,"tag":499,"props":2846,"children":2847},{"style":511},[2848],{"type":41,"value":2788},{"type":36,"tag":499,"props":2850,"children":2851},{"style":1034},[2852],{"type":41,"value":1554},{"type":36,"tag":499,"props":2854,"children":2855},{"style":511},[2856],{"type":41,"value":2857},"0 0 1 * *",{"type":36,"tag":499,"props":2859,"children":2860},{"style":1034},[2861],{"type":41,"value":1601},{"type":36,"tag":43,"props":2863,"children":2864},{},[2865,2867,2873,2875,2880,2882,2888],{"type":41,"value":2866},"A schedule is standing automation that keeps running after the session ends, so confirm the operation, cadence, and stack with the user before creating one. Two kinds act without a human in the loop: ",{"type":36,"tag":61,"props":2868,"children":2870},{"className":2869},[],[2871],{"type":41,"value":2872},"--kind drift --auto-remediate",{"type":41,"value":2874}," runs ",{"type":36,"tag":61,"props":2876,"children":2878},{"className":2877},[],[2879],{"type":41,"value":2233},{"type":41,"value":2881}," on detected drift, and ",{"type":36,"tag":61,"props":2883,"children":2885},{"className":2884},[],[2886],{"type":41,"value":2887},"--kind ttl",{"type":41,"value":2889}," destroys the stack at a set time. Default to detection-only unless the user asks for remediation.",{"type":36,"tag":274,"props":2891,"children":2893},{"id":2892},"further-reading",[2894],{"type":41,"value":2895},"Further reading",{"type":36,"tag":590,"props":2897,"children":2898},{},[2899,2910,2921,2932],{"type":36,"tag":594,"props":2900,"children":2901},{},[2902,2904],{"type":41,"value":2903},"ESC: ",{"type":36,"tag":1172,"props":2905,"children":2908},{"href":2906,"rel":2907},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fesc\u002F",[1176],[2909],{"type":41,"value":2906},{"type":36,"tag":594,"props":2911,"children":2912},{},[2913,2915],{"type":41,"value":2914},"Pulumi Policies: ",{"type":36,"tag":1172,"props":2916,"children":2919},{"href":2917,"rel":2918},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Finsights\u002Fpolicy\u002F",[1176],[2920],{"type":41,"value":2917},{"type":36,"tag":594,"props":2922,"children":2923},{},[2924,2926],{"type":41,"value":2925},"Deployments: ",{"type":36,"tag":1172,"props":2927,"children":2930},{"href":2928,"rel":2929},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fpulumi-cloud\u002Fdeployments\u002F",[1176],[2931],{"type":41,"value":2928},{"type":36,"tag":594,"props":2933,"children":2934},{},[2935,2937],{"type":41,"value":2936},"Drift detection: ",{"type":36,"tag":1172,"props":2938,"children":2941},{"href":2939,"rel":2940},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fpulumi-cloud\u002Fdeployments\u002Fdrift\u002F",[1176],[2942],{"type":41,"value":2939},{"type":36,"tag":175,"props":2944,"children":2945},{},[],{"type":36,"tag":49,"props":2947,"children":2949},{"id":2948},"reference",[2950],{"type":41,"value":2951},"Reference",{"type":36,"tag":43,"props":2953,"children":2954},{},[2955,2957,2963,2965,2971],{"type":41,"value":2956},"When you are uncertain about a CLI flag, command shape, or resource property, look it up rather than guess. ",{"type":36,"tag":61,"props":2958,"children":2960},{"className":2959},[],[2961],{"type":41,"value":2962},"npx pulumi \u003Ccommand> --help",{"type":41,"value":2964}," documents every flag and subcommand from the CLI itself. The full reference, provider catalog, and conceptual documentation live at ",{"type":36,"tag":1172,"props":2966,"children":2969},{"href":2967,"rel":2968},"https:\u002F\u002Fwww.pulumi.com\u002Fdocs",[1176],[2970],{"type":41,"value":2967},{"type":41,"value":697},{"type":36,"tag":175,"props":2973,"children":2974},{},[],{"type":36,"tag":49,"props":2976,"children":2978},{"id":2977},"routing-to-specialized-skills",[2979],{"type":41,"value":2980},"Routing to specialized skills",{"type":36,"tag":43,"props":2982,"children":2983},{},[2984],{"type":41,"value":2985},"When the work moves into territory another skill covers in depth, hand off to that skill rather than reinvent its content.",{"type":36,"tag":70,"props":2987,"children":2988},{},[2989,3005],{"type":36,"tag":74,"props":2990,"children":2991},{},[2992],{"type":36,"tag":78,"props":2993,"children":2994},{},[2995,3000],{"type":36,"tag":82,"props":2996,"children":2997},{},[2998],{"type":41,"value":2999},"Skill",{"type":36,"tag":82,"props":3001,"children":3002},{},[3003],{"type":41,"value":3004},"Load when",{"type":36,"tag":98,"props":3006,"children":3007},{},[3008,3024,3049,3065,3082,3099,3116],{"type":36,"tag":78,"props":3009,"children":3010},{},[3011,3019],{"type":36,"tag":105,"props":3012,"children":3013},{},[3014],{"type":36,"tag":61,"props":3015,"children":3017},{"className":3016},[],[3018],{"type":41,"value":1787},{"type":36,"tag":105,"props":3020,"children":3021},{},[3022],{"type":41,"value":3023},"Writing any non-trivial Level 2 program",{"type":36,"tag":78,"props":3025,"children":3026},{},[3027,3036],{"type":36,"tag":105,"props":3028,"children":3029},{},[3030],{"type":36,"tag":61,"props":3031,"children":3033},{"className":3032},[],[3034],{"type":41,"value":3035},"pulumi-component",{"type":36,"tag":105,"props":3037,"children":3038},{},[3039,3041,3047],{"type":41,"value":3040},"Packaging or consuming ",{"type":36,"tag":61,"props":3042,"children":3044},{"className":3043},[],[3045],{"type":41,"value":3046},"ComponentResource",{"type":41,"value":3048}," abstractions",{"type":36,"tag":78,"props":3050,"children":3051},{},[3052,3060],{"type":36,"tag":105,"props":3053,"children":3054},{},[3055],{"type":36,"tag":61,"props":3056,"children":3058},{"className":3057},[],[3059],{"type":41,"value":2430},{"type":36,"tag":105,"props":3061,"children":3062},{},[3063],{"type":41,"value":3064},"Defining ESC environments, OIDC trust policies, or rotation",{"type":36,"tag":78,"props":3066,"children":3067},{},[3068,3077],{"type":36,"tag":105,"props":3069,"children":3070},{},[3071],{"type":36,"tag":61,"props":3072,"children":3074},{"className":3073},[],[3075],{"type":41,"value":3076},"pulumi-automation-api",{"type":36,"tag":105,"props":3078,"children":3079},{},[3080],{"type":41,"value":3081},"Embedding Pulumi inside another program (IDP, custom CI)",{"type":36,"tag":78,"props":3083,"children":3084},{},[3085,3094],{"type":36,"tag":105,"props":3086,"children":3087},{},[3088],{"type":36,"tag":61,"props":3089,"children":3091},{"className":3090},[],[3092],{"type":41,"value":3093},"provider-upgrade",{"type":36,"tag":105,"props":3095,"children":3096},{},[3097],{"type":41,"value":3098},"Upgrading a provider package version in a stack without unintended changes",{"type":36,"tag":78,"props":3100,"children":3101},{},[3102,3111],{"type":36,"tag":105,"props":3103,"children":3104},{},[3105],{"type":36,"tag":61,"props":3106,"children":3108},{"className":3107},[],[3109],{"type":41,"value":3110},"package-usage",{"type":36,"tag":105,"props":3112,"children":3113},{},[3114],{"type":41,"value":3115},"Auditing which stacks across the org use a package and at what versions",{"type":36,"tag":78,"props":3117,"children":3118},{},[3119,3149],{"type":36,"tag":105,"props":3120,"children":3121},{},[3122,3128,3129,3135,3136,3142,3143],{"type":36,"tag":61,"props":3123,"children":3125},{"className":3124},[],[3126],{"type":41,"value":3127},"pulumi-terraform-to-pulumi",{"type":41,"value":228},{"type":36,"tag":61,"props":3130,"children":3132},{"className":3131},[],[3133],{"type":41,"value":3134},"pulumi-cdk-to-pulumi",{"type":41,"value":228},{"type":36,"tag":61,"props":3137,"children":3139},{"className":3138},[],[3140],{"type":41,"value":3141},"cloudformation-to-pulumi",{"type":41,"value":228},{"type":36,"tag":61,"props":3144,"children":3146},{"className":3145},[],[3147],{"type":41,"value":3148},"pulumi-arm-to-pulumi",{"type":36,"tag":105,"props":3150,"children":3151},{},[3152],{"type":41,"value":3153},"Migrating from those tools",{"type":36,"tag":43,"props":3155,"children":3156},{},[3157,3159,3164,3165,3170,3171,3176,3177,3182,3183,3188,3189,3194,3196,3201,3203,3209,3211,3216],{"type":41,"value":3158},"An agent only sees the skills the user installed, so a referenced skill may not be present. ",{"type":36,"tag":61,"props":3160,"children":3162},{"className":3161},[],[3163],{"type":41,"value":1787},{"type":41,"value":228},{"type":36,"tag":61,"props":3166,"children":3168},{"className":3167},[],[3169],{"type":41,"value":3035},{"type":41,"value":228},{"type":36,"tag":61,"props":3172,"children":3174},{"className":3173},[],[3175],{"type":41,"value":2430},{"type":41,"value":228},{"type":36,"tag":61,"props":3178,"children":3180},{"className":3179},[],[3181],{"type":41,"value":3076},{"type":41,"value":228},{"type":36,"tag":61,"props":3184,"children":3186},{"className":3185},[],[3187],{"type":41,"value":3093},{"type":41,"value":236},{"type":36,"tag":61,"props":3190,"children":3192},{"className":3191},[],[3193],{"type":41,"value":3110},{"type":41,"value":3195}," ship in the same ",{"type":36,"tag":61,"props":3197,"children":3199},{"className":3198},[],[3200],{"type":41,"value":8},{"type":41,"value":3202}," plugin as this skill, so they are available whenever this one is. The migration skills install separately through the ",{"type":36,"tag":61,"props":3204,"children":3206},{"className":3205},[],[3207],{"type":41,"value":3208},"pulumi-migration",{"type":41,"value":3210}," plugin and may be absent. When a referenced skill is available, load it. When it is not, do not stall or treat the gap as an error: continue with the guidance in this skill and the docs at ",{"type":36,"tag":1172,"props":3212,"children":3214},{"href":2967,"rel":3213},[1176],[3215],{"type":41,"value":2967},{"type":41,"value":3217},", and tell the user which skill or plugin covers the work in depth.",{"type":36,"tag":3219,"props":3220,"children":3221},"style",{},[3222],{"type":41,"value":3223},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3225,"total":3377},[3226,3240,3254,3266,3278,3292,3306,3317,3331,3344,3358,3364],{"slug":3141,"name":3141,"fn":3227,"description":3228,"org":3229,"tags":3230,"stars":20,"repoUrl":21,"updatedAt":3239},"migrate CloudFormation to Pulumi","Convert, migrate, or import AWS CloudFormation stacks or templates into Pulumi programs. Load this skill whenever a user wants to move from CloudFormation to Pulumi, convert a CFN template, import existing CloudFormation-managed resources into Pulumi, or asks about CloudFormation-to-Pulumi migration in any form. Also load when the user mentions cdk-importer in a migration context.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3231,3233,3234,3235,3238],{"name":3232,"slug":610,"type":13},"AWS",{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},"Migration","migration",{"name":9,"slug":8,"type":13},"2026-04-06T18:50:36.677615",{"slug":3110,"name":3110,"fn":3241,"description":3242,"org":3243,"tags":3244,"stars":20,"repoUrl":21,"updatedAt":3253},"audit Pulumi package usage across stacks","Track which stacks across a Pulumi organization use a specific package and at what versions. Use for cross-stack audits, identifying outdated or unmaintained package versions across many stacks, finding affected stacks before publishing breaking changes to a component package, or planning coordinated upgrade rollouts. Do NOT use for upgrading a cloud provider package (pulumi-aws, pulumi-azure-native, pulumi-gcp, pulumi-kubernetes, etc.) in a single project — use skill `provider-upgrade` instead. Do NOT use for general infrastructure creation, resource provisioning, or how-to questions about a package.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3245,3248,3249,3252],{"name":3246,"slug":3247,"type":13},"Audit","audit",{"name":18,"slug":19,"type":13},{"name":3250,"slug":3251,"type":13},"Operations","operations",{"name":9,"slug":8,"type":13},"2026-07-24T05:37:48.019964",{"slug":3093,"name":3093,"fn":3255,"description":3256,"org":3257,"tags":3258,"stars":20,"repoUrl":21,"updatedAt":3265},"upgrade and reconcile Pulumi providers","Upgrade any Pulumi provider to a newer version and reconcile the resulting diff. Use when users want to upgrade or update a provider (including editing package.json, requirements.txt, pyproject.toml, go.mod, or Pulumi.yaml to bump a provider SDK), check for breaking changes before or during an upgrade, fix resources that broke after a provider upgrade, or resolve unexpected replacements, creates, or deletes in a post-upgrade preview. Applies to all providers (aws, azure-native, gcp, kubernetes, aws-native, cloudflare, datadog, etc.) — not just Tier 1. Do NOT use for querying which stacks use what package versions; use skill `package-usage` for cross-stack audits. Do NOT use for general infrastructure tasks.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3259,3262,3263,3264],{"name":3260,"slug":3261,"type":13},"DevOps","devops",{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},"2026-06-04T07:58:58.874758",{"slug":3148,"name":3148,"fn":3267,"description":3268,"org":3269,"tags":3270,"stars":20,"repoUrl":21,"updatedAt":3277},"migrate Azure ARM to Pulumi","Convert or migrate Azure ARM (Azure Resource Manager) templates, Bicep templates, or code to Pulumi, including importing existing Azure resources. This skill MUST be loaded whenever a user requests migration, conversion, or import of ARM templates, Bicep templates, ARM code, Bicep code, or Azure resources to Pulumi.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3271,3273,3274,3275,3276],{"name":3272,"slug":965,"type":13},"Azure",{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},"2026-04-06T18:50:35.384851",{"slug":3076,"name":3076,"fn":3279,"description":3280,"org":3281,"tags":3282,"stars":20,"repoUrl":21,"updatedAt":3291},"run Pulumi programs via Automation API","Load this skill when a user asks how to run Pulumi programmatically, embed Pulumi in an application, orchestrate multiple stacks in code, build a self-service infrastructure portal, replace pulumi CLI shell scripts with code, or use the Pulumi Automation API (LocalWorkspace, createOrSelectStack, inline programs). Also load for questions about multi-stack sequencing, parallel deployments, or passing outputs between stacks via code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3283,3286,3289,3290],{"name":3284,"slug":3285,"type":13},"API Development","api-development",{"name":3287,"slug":3288,"type":13},"Automation","automation",{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},"2026-06-04T07:59:00.113998",{"slug":1787,"name":1787,"fn":3293,"description":3294,"org":3295,"tags":3296,"stars":20,"repoUrl":21,"updatedAt":3305},"apply Pulumi best practices for infrastructure","Load when the user is writing, reviewing, or debugging Pulumi TypeScript\u002FPython programs; asks about Output\u003CT> or apply() usage; wants to create ComponentResource classes; needs to refactor resources without destroying them (aliases); is setting up secrets or config; or is configuring a pulumi preview\u002Fup CI workflow. Also load for questions about resource dependency order, parent\u002Fchild resource relationships, or pulumi.interpolate.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3297,3298,3299,3302],{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},{"name":3300,"slug":3301,"type":13},"Python","python",{"name":3303,"slug":3304,"type":13},"TypeScript","typescript","2026-06-03T07:52:43.916562",{"slug":3134,"name":3134,"fn":3307,"description":3308,"org":3309,"tags":3310,"stars":20,"repoUrl":21,"updatedAt":3316},"migrate AWS CDK to Pulumi","Load this skill when a user wants to migrate, convert, port, translate, or move an AWS CDK application (including CDK stacks, constructs, or CloudFormation-synthesized templates) to Pulumi. Phrases such as \"convert CDK to Pulumi\", \"migrate CDK app\", \"port CDK stacks\", \"replace CDK with Pulumi\", \"stop using CDK\". Do NOT load for general CDK questions, CDK-only help, or CDK vs Pulumi comparisons where no migration is requested.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3311,3312,3313,3314,3315],{"name":3232,"slug":610,"type":13},{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},"2026-04-06T18:50:39.23999",{"slug":3035,"name":3035,"fn":3318,"description":3319,"org":3320,"tags":3321,"stars":20,"repoUrl":21,"updatedAt":3330},"author reusable Pulumi component resources","Guide for authoring Pulumi ComponentResource classes. Use when creating reusable infrastructure components, designing component interfaces, setting up multi-language support, or distributing component packages.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3322,3325,3328,3329],{"name":3323,"slug":3324,"type":13},"Architecture","architecture",{"name":3326,"slug":3327,"type":13},"Engineering","engineering",{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},"2026-06-04T07:58:57.625622",{"slug":3332,"name":3332,"fn":3333,"description":3334,"org":3335,"tags":3336,"stars":20,"repoUrl":21,"updatedAt":3343},"pulumi-debug-failed-operation","debug failed Pulumi operations","Debug a Pulumi update or preview that failed: read the failure Pulumi already\nrecorded, find what caused it, and fix it. Load this skill when the user asks\nto debug, diagnose, or fix a failed update or preview, or points at a failing\n`pulumi up` or `pulumi preview`. Don't load it for authoring new\ninfrastructure, migrations, or provider upgrades; those have their own skills.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3337,3340,3341,3342],{"name":3338,"slug":3339,"type":13},"Debugging","debugging",{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},"2026-07-08T05:47:02.688144",{"slug":2430,"name":2430,"fn":3345,"description":3346,"org":3347,"tags":3348,"stars":20,"repoUrl":21,"updatedAt":3357},"manage secrets and configuration with Pulumi ESC","Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3349,3352,3353,3354],{"name":3350,"slug":3351,"type":13},"Configuration","configuration",{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},{"name":3355,"slug":3356,"type":13},"Security","security","2026-07-24T05:37:47.044405",{"slug":4,"name":4,"fn":5,"description":6,"org":3359,"tags":3360,"stars":20,"repoUrl":21,"updatedAt":22},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3361,3362,3363],{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},{"slug":3127,"name":3127,"fn":3365,"description":3366,"org":3367,"tags":3368,"stars":20,"repoUrl":21,"updatedAt":3376},"migrate Terraform to Pulumi","Migrate Terraform\u002FOpenTofu projects to Pulumi, including translating HCL source code and\u002For importing Terraform state into a Pulumi stack. Use when a user wants to convert Terraform to Pulumi, migrate from HCL, or import tfstate into Pulumi. Do NOT trigger for general Terraform-vs-Pulumi comparisons or questions about using both tools side-by-side.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3369,3370,3371,3372,3373],{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},{"name":3374,"slug":3375,"type":13},"Terraform","terraform","2026-04-06T18:50:37.954346",12,{"items":3379,"total":3377},[3380,3388,3395,3402,3410,3417,3424],{"slug":3141,"name":3141,"fn":3227,"description":3228,"org":3381,"tags":3382,"stars":20,"repoUrl":21,"updatedAt":3239},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3383,3384,3385,3386,3387],{"name":3232,"slug":610,"type":13},{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},{"slug":3110,"name":3110,"fn":3241,"description":3242,"org":3389,"tags":3390,"stars":20,"repoUrl":21,"updatedAt":3253},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3391,3392,3393,3394],{"name":3246,"slug":3247,"type":13},{"name":18,"slug":19,"type":13},{"name":3250,"slug":3251,"type":13},{"name":9,"slug":8,"type":13},{"slug":3093,"name":3093,"fn":3255,"description":3256,"org":3396,"tags":3397,"stars":20,"repoUrl":21,"updatedAt":3265},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3398,3399,3400,3401],{"name":3260,"slug":3261,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},{"slug":3148,"name":3148,"fn":3267,"description":3268,"org":3403,"tags":3404,"stars":20,"repoUrl":21,"updatedAt":3277},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3405,3406,3407,3408,3409],{"name":3272,"slug":965,"type":13},{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13},{"slug":3076,"name":3076,"fn":3279,"description":3280,"org":3411,"tags":3412,"stars":20,"repoUrl":21,"updatedAt":3291},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3413,3414,3415,3416],{"name":3284,"slug":3285,"type":13},{"name":3287,"slug":3288,"type":13},{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},{"slug":1787,"name":1787,"fn":3293,"description":3294,"org":3418,"tags":3419,"stars":20,"repoUrl":21,"updatedAt":3305},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3420,3421,3422,3423],{"name":18,"slug":19,"type":13},{"name":9,"slug":8,"type":13},{"name":3300,"slug":3301,"type":13},{"name":3303,"slug":3304,"type":13},{"slug":3134,"name":3134,"fn":3307,"description":3308,"org":3425,"tags":3426,"stars":20,"repoUrl":21,"updatedAt":3316},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3427,3428,3429,3430,3431],{"name":3232,"slug":610,"type":13},{"name":15,"slug":16,"type":13},{"name":18,"slug":19,"type":13},{"name":3236,"slug":3237,"type":13},{"name":9,"slug":8,"type":13}]