Is there a way at the Pulumi layer to mark resources as protected against deletion? For example, we want to prevent Pulumi from automatically deleting our Cosmos DB account in production if some key properties have changed by mistake. I can think of a few ways to do this at the Azure layer (RBAC, locking, etc.) but I’m wondering if there’s also any mechanism for this in Pulumi.

All components accept a

ResourceOptions

class, in which is a

Protect

property:

public abstract class ResourceOptions
    {
        protected ResourceOptions();

        //
        // Summary:
        //     An optional existing ID to load, rather than create.
        [NullableAttribute(new[] { 2, 1 })]
        public Input<string>? Id { get; set; }
        //
        // Summary:
        //     An optional parent resource to which this resource belongs.
        public Resource? Parent { get; set; }
        //
        // Summary:
        //     Optional additional explicit dependencies on other resources.
        [NullableAttribute(1)]
        public InputList<Resource> DependsOn { get; set; }
        //
        // Summary:
        //     When set to true, protect ensures this resource cannot be deleted.
        public bool? Protect { get; set; }

You can read more about it here: https://www.pulumi.com/docs/intro/concepts/resources/#protect