pulumi-best-practices

Pass Output values directly as resource inputs so Pulumi tracks the dependency in its graph. For string interpolation, use pulumi.interpolate or pulumi.concat instead of extracting values with apply(), which breaks the dependency chain.

Resources created inside apply() callbacks only exist after the Output resolves at deployment time, so Pulumi cannot include them in the preview graph. Move resource creation to the top level and pass Outputs directly as inputs instead.

Add an aliases option with the old resource name when renaming, for example aliases: [{ name: "old-name" }]. When moving a resource into a component, also include the old parent in the alias so Pulumi preserves the existing resource identity.

Set secrets with pulumi config set --secret so values are encrypted in state files and masked in CLI output. In code, retrieve them with config.requireSecret(), and use Pulumi ESC environments to manage secrets centrally across stacks.

Setting parent: this on child resources nests them under the component in the Pulumi console and state file. It ensures deleting the component deletes its children and that aliases on the component apply to all children.

A replace operation means an immutable property changed, forcing Pulumi to destroy and recreate the resource. Review the diff for changed immutable fields, and check for missing aliases if the replacement follows a rename or refactor.