This message was deleted.

You can use policies, but in general, you should check your config before creating resources. Resources should be able to assume valid input. Pulumi / infra apps don't have to work the same way as user-centric apps. You don't have to check that the user typed the correct value.

Resources should be able to assume valid input.

I need to validate user supplied input somewhere. I can't limit everything down enough via the type system.

You can use pulumi.RunError or pulumi.ResouceError.

I won't have an end-user input, but I still have engineers supplying values which I need to validate. My current case is: We are wrapping the datadog monitor resource in order to set certain tags centrally. I still accept the original datadog monitor args (which include tags) and make sure that the centrally managed tags are not being set. So I need some code to validate

Will datadog not throw that exception for you?

I honestly don't know. I prefer to check that myself

That's inside the constructor. Do it in index.ts, before you pass it into the constructor. It's still a string at that point. As to your question:

pulumi.Input<string>

is

pulumi.Output<string> | string

, so you can do this (assuming you're in a constructor):

const toBeValidated = getValue();
  if (toBeValidated instanceof string) {
    if (!isValid(toBeValidated)) {
      throw new ResourceError(`${toBeValidated} is invalid.`, this);
  }
}

I find that a scary assumption to be honest

Infrastructure code has a different set of assumptions than application code. Changing assumptions is a bit scary 🙂

If I validate within an apply, pulumi.ResourceError is still the right thing to do?

ResourceErrors are good, they terminate the Pulumi engine loop and still allow Pulumi to tidy up and print nice messages.

I will do the string check to get as much early feedback as possible, but I will still validate Ouput ad Promise

Yep. But for those cases, your preview won't always catch the problem (I've found that some applys are resolved during preview; Pulumi must have clever dependency resolution and knows that some are safe to resolve even in preview.)