Your last apply should produce

Output<X>

where X is what ProtectedSettings needs

OK that seems to be working 🙂 . The only code I have left inside the Apply is the code that creates the command string (which I add to the dictionary). The only reason this has to remain in the Apply is because I can't find another way to ensure that the Integration Runtime is created before I try to get the access key. I create the Integration Runtime with code like..

var myIR = new Pulumi.AzureNative.DataFactory.IntegrationRuntime(<some settings>);

I then need to get the authKey which requires code like

var authKey = Pulumi.AzureNative.DataFactory.ListIntegrationRuntimeAuthKeys.InvokeAsync(new Pulumi.AzureNative.DataFactory.ListIntegrationRuntimeAuthKeysArgs
{
    FactoryName = "dfname"
    ResourceGroupName = "rgname",
    IntegrationRuntimeName = myIR.Name
}).Result.AuthKey1;

The problem here is that IntegrationRuntimeName only accepts a string (not an Input<string>) so I am just wrapping all of that in an Apply for the myIR object just to ensure that myIR exists (as there isn't a dependsOn option for ListIntegrationRuntimeAuthKeys)

var commandToExecute = myIR.Name.Apply<string>(name =>
{
    var authKey = Pulumi.AzureNative.DataFactory.ListIntegrationRuntimeAuthKeys.InvokeAsync(new Pulumi.AzureNative.DataFactory.ListIntegrationRuntimeAuthKeysArgs
    {
        FactoryName = "dfname",
        ResourceGroupName = "rgname",
        IntegrationRuntimeName = name 
    }).Result.AuthKey1;

    var commandToExecute = $"powershell.exe -ExecutionPolicy Unrestricted -File gatewayInstall.ps1 {authKey}";

    return commandToExecute;
});

I am no longer creating anything inside of the Apply. Does that look like the best way to proceed given I can't apply an Input<string> to IntegrationRuntimeName?