This message was deleted.

If the network firewall is treated as separate properties on a single resource, than no - you can’t do this without also giving your pulumi stack management over the storage account. But if the network firewall is treated as a separate resource, then you could do this without also managing the storage account.

no, it's the same resource, that's the issue

yea then you may be SOL in this case, which kind of sucks. You could import the storage account and mark it as

protected

so that you're pulumi stack would be prevented from ever destroying it without manual intervention, but could update it freely

yeah, that's what I thought, too. I'm surprised I am the only one having this issue, some resources bulk together a lot of parts, part-multitenanted apps must need this a lot. thanks anyway. I guess I'll wait for the dynamic providers.

I don't think pulumi yet has the concept of partial-resource control, but it is interesting and i'm sure you're not the only one that could use it. You could open an issue if there isn't already one and see if you get support.