is there any way to run a one-off command when a certain resource changes?

There's no easy way currently, through dynamic providers can be used for this. This is part of https://github.com/pulumi/pulumi/issues/1691. cc @microscopic-florist-22719 who is working on the design proposal for that and may have ideas on other workarounds in the meantime.