Interesting use case - I would like to prevent resources from being created with a certain property (it is very expensive), but once they are created, updating to use it is fine. I have full control over the function being called to register the resource, so I can detect when the setting is on - but I'm not sure how to detect if the resource is new (without trying to parse the pulumi output at the end)