No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Am I correct in saying it doesn't work on the first pass?

Yes. The protect opt works when it is "on" a resource at the time Pulumi's engine starts its work. So you have to `up` the ` `protect: true` in a separate run of Pulumi.

The same applies on removing protect. You can't remove protect and delete the resource in the same `up`.