Is there any chance I could abuse

protected async initialize(args: Inputs): Promise<TData>

for lifecycles? I'd like to be able to delete iam.SecurityCredentials if user is supposed to be deleted.

Hmm it should get deleted for you automatically if security credentials takes the user ID as an input. Is that not happening? You could add an explicit dependency on the user resource using the

dependsOn

resource option too.