Hello, how do you usually deal with service linked roles or other resources that can exists only once per account? I have a project that needs the service linked role but it has to exist once per account and pulumi doesn’t really have

fire & forget

options https://github.com/pulumi/pulumi-aws/issues/4821

At previous jobs I usually did this centrally in a stack where I also did the base-level setup for the account. fire & forget would be a bit of an anti pattern in IaC in my opinion because when you're reading the program you wouldn't know whether the resource is managed by the stack or not.

Yep a separate project for these sorts of things is the way to go. The rule of thumb that a project groups all the things with a similar deployment cycle works well. Because the deployment cycle is "just one, at initial setup", it won't impact any of your other resources.