in pulumi, what's best practice to modify a GCP resource that wasn't created with pulumi? for example, i'd like to delete or disable the default ssh and rdp firewall rules in a gcp project.

Pulumi doesn't support deleting resources natively; however you could use the Command resource to run the gcp cli after the project is created (it only runs once): https://www.pulumi.com/registry/packages/command/ If you're creating the project, you can have pulumi delete all the default network resources gcp creates too, but you'll need to configure a network yourself afterwards: https://www.pulumi.com/registry/packages/gcp/api-docs/organizations/project/#auto_create_network_python