Hi, Is it possible to query the last state of a resource in my stack? Basically my goal is to set a property only on create and then ignore any external changes to it. I already have the ignore changes part but I am not sure how to keep the last value while only providing an updated one to new resources. My thought was I could query the state of that resource if it exists and use the value it was set too but I am unsure if the Python SDK have a way to accomplish this.

That sounds like what Pulumi does. Changes are applied by Pulumi only when the code (new value) and the state (previous value) differ. Do you have additional requirements beyond this?

Here is my use case. 1. do a lookup to see what the property value should be set to for all new resources 2. create resource if it needs to be created with that properties value Next run: 1. do a lookup to see what the property value should be set to for all new resources 2. do not change that property value on existing resources 3. create new resources with the new property value that is not the same as when older ones were created

There's likely dozens of ways to achieve this, but the essence is: take advantage of the fact that you're using a normal programming language.

We are already using external lookups and a bunch of logic in the app that is outside of core Pulumi. The issue is our component contains the resource to create which looks up the current default from an outside source. This value is always changing and we need new resources using the component to use the current default. If I run it again after this default changes it looks up a new value and shows all existing ones should change too.

I suggest moving the look-up-and-set logic to a little earlier in the workflow. Move it to stack creation time, instead of resource creation time.

I have a similar challenge actually. In my case is probably simpler to get around: I'm checking if a certificate exists and if not then I create the resource, so the declaration of the resource is within a condition. The problem: on the second+ pulumi run the condition isn't met (because the certificate has been created) so the code to declare the certificate isn't run and pulumi treats it as a delete of the certificate (and rightfully so).

For that case, importing the certificate to Pulumi is probably the most idiomatic solution, I think?

Not entirely sure what you mean by importing the certificate to Pulumi (still a newbie in Pulumi). I'm currently creating it on the fly as part of the pulumi run (and then I use the pfx to create the certificate resource in azure)

If you're not creating the certificate outside of Pulumi, and it is only ever created by Pulumi code, why do you need to check if it exists?

Indeed, I wrongly assumed I wouldn't be able to retrieve the pfxblob of an existing certificate resource but looking at the "GetCertificateResult" I see it includes all properties I need. I have needlessly over-complicated this lol thanks for the hint, it's very clear now what I need to do 👍