This message was deleted.

What do you mean by "staged"?

I need to be able to have two states in the deployment: one with the web instance having an egress to the internet to install packages, and a final state where it has no egress.

Think best course of action would be to analyze a variable, if this is set then add the NAT Gateway and route to the routing tables. I would do it within the CICD pipeline on the release. So you would set an environment variable say

enableInternetTraffic=0

then within the pulumi program

import os

then retrieve the variable

enableInternetTraffic

then just do

if enableInternetTraffic=1

then create the NAT Gateway and routes in respective routing table. That way could trigger off a schedule of at 9PM we want to patch so we set the environment variable to 1 then create resources, then allow patching, then determinate by Maintenance Window run the same pipeline but the pipeline sets the environment variable 0 which removes those resources.

I haven't messed with the CICD aspect yet--so you can't do this trick just within the index.ts?

Could do it based off pulumi config, then evaluate if it should get a public ip or not