Perhaps this is a bit esoteric, but I'm wondering if there is anyway in Pulumi to have the notion of "create resource A before creating resource C, but once C is created, delete A". My specific use-case is around configuration of a machine, where after bare-metal installation, can be default be written to by anyone (it's a publc IP). Thus my solution is to: 1. Have a Pulumi resource for my cloud provider that creates a firewall to limits it to traffic from our companies internal IP block (A) 2. Have a Pulumi resource that depends on A that does an installation of a fresh OS from an image (B) 3. Have a Pulumi resource that depends on B apply a configuration to the OS (C). This now locks down the resource. 4. Now that C is done, delete the firewall A (since we not have a locked down configuration) I could does this manually by doing

pulumi up

multiple times with different configurations, but it seems nice to be able to do all in one go. 🙂

Pulumi works on resource state management. Your use case is different from declarative state.

There are better ways of doing this that follow declarative principles better -- don't ever have resource A. You could use a bastion for the locking-down deployment; it's a bit "old hat" but it does work. That way, you never need the "open" firewall: you have secure access to your bastion always (narrow IP whitelisting, VPN, whatever works for you), and from there you have easy access to your newly-created machines. The bastion machine would be set up in a completely different project and would be "well known" to this project. A more "today" solution is to build a locked-down machine image in a completely separate project or pipeline and have that image always ready to go. Then this project only ever needs to refer this image, and all new machines start off secure.

Thanks for the replies. And yes, this "bastion" style is something I'm leaning towards - as it seems like there is a way to bake a small firewall into the config - so thanks for the idea.

I don't think it's that esoteric a question, nor do I think the goal is at odds with declarative principles. I mean you could certainly envision a feature that allowed you to declare how exactly to deploy a given resource. Related discussion: https://pulumi-community.slack.com/archives/C84L4E3N1/p1761902766954089