Any chance to skip resources (programatically) during refresh/preview/update if for example I don’t have an API key access as a pulumi runner. User story: The CI has access to a secret I do not have. This secret is used for some complementary resources in my stack. However other parts of the Pulumi stack (the main resources) - I do have access to, from my own machine I would like: • If I run pulumi up from CI - everything works • If I run pulumi up from my machine - I detect that I do not have access to the API key, and I skip the creation/deletion of such resources ◦ If resources exist in the stack - they are still in the stack after the operation, just unchanged ◦ If I try to delete the stack, I only succeed to delete the resources that I can delete. Skipped resources and dependent resources will not be deleted, destroying the stack will fail - since I can not access those resources. Obviously I can create those resources in a different sibling/sub-stack, but I was wondering if this is possible to do in a single stack

You can use

--target

to select which resources you want

pulumi up

to effect, but that would require a list of resources you want to effect. I think the best experience would be separate stacks.