Hi, is there a canonical way to emit a warning log message whenever a particular resource has been created?

you can

pulumi.log

an applied output

@millions-furniture-75402 thanks, but this:

// Used by this Pulumi program for updates
const pulumiUp = new opsgenie.ApiIntegration("infrastructure/opsgenie pulumi up", {
    allowWriteAccess: true,
    type: "API",
}, {
    aliases: [{
        name: "infrastructure/opsgenie Pulumi provider",
    }],
})

pulumi.log.warn(
    pulumi.interpolate `${pulumiUp.name} key has been exposed, please rotate it at <https://taxamo.app.opsgenie.com/settings/integration/edit/API/${pulumiUp.id}>`, // this is line 30
    pulumiUp
)

causes this:

You'll need to do it inside of the apply

@millions-furniture-75402 aaah, very nice 🙂. Any idea how to check if the resource has just been created?

The resource should be created if you're inside the apply.

nope, I am trying to set up Opsgenie API keys to be used with Pulumi in CICD

gotcha, okay

https://pulumi-community.slack.com/archives/C84L4E3N1/p1627916176046500?thread_ts=1627915428.043900&cid=C84L4E3N1 - yeah, but I need this warning not to appear in subsequent runs when the resource already exists

${pulumiUp.name} key has been exposed,

are you trying to work around the fact that this output exposes a secret?

@millions-furniture-75402 I am using separate API keys for pulumi preview (because it can be ran from any branch) and for pulumi apply (because it can be ran only from the master) and I need to make it impossible to retrieve the pulumi update API key when running a pulumi preview

You might just want 

additionalSecretOutputs

in opts

otherwise anybody pushing to a non-master branch can push a CI job that will print the pulumi up API key

when using

additionalSecretOutputs

it should mask secrets when printed. However, if the user has access to retrieve secrets, then they can definitely retrieve the value 🙂

yep

You might be bleeding into Dynamic Resource Providers if you need to tap into the lifecycle hooks of a resource https://www.pulumi.com/blog/dynamic-providers/

alternatively I could just override the value of the

apiKey

attribute of the resource with 'undefined' if there was a way to do it