I am having trouble figuring out best approach here. A Redis cache resource does only populate its access keys in create/update events. This is a bit of a problem in the scenarios where redis cache is only read returning a null value as keys. It would appear we need to conditionally create the connectionstring secret pulumi does not seem support this. Only thing I can think if creating the secret inside the Apply function which is not recommended by pulumi. Does anyone know the recommended way here ?

var redis = RedisSetup.SetUp(resourceGroup, Name.CacheName);
var redisConnectionString = Output.Tuple(redis.HostName, redis.SslPort, redis.AccessKeys.Apply(key => key?.PrimaryKey ?? key?.SecondaryKey)).Apply(t => {
    var (hostname, sslport, accesskey) = t;
    if (accesskey == null) return null;
    return Output.CreateSecret($"{hostname}:{sslport},password={accesskey},ssl=True,abortConnect=False");
});
KeyVault.AddSecret(Name.Vault, SecretName.RedisConnectionString, redisConnectionString, Option.WithParent(redis));

Hmm good question. So you need to recompute the key on all stack updates that dont update the redis instance itself so that the redis resource doesnt unset its conn string val?