Unfortunately, that means you'd be conditionally creating resources based on unknown values. The contract for getOutput says that it should return undefined, but it's not; I don't know if that's a bug in the docs or in the code, though.

You might be better off using

requireOutput()

and aborting that way?

It might even throw a catchable exception, I'm not sure.

Until now, I've been keeping all of my IAM roles/instance profiles in one project and reference those in other projects. The issue I'm running into is with this project for a Vault stack. Originally, I defined the policy and attached the policy in the Vault project, but it's led to a situation where things get weird with a policy defined in the Vault stack being attached to a role defined in the IAM stack.

There's nothing stopping me from moving the Vault server role and whatnot to the Vault project besides my own desire for consistency

But to be clear, if the referenced stack doesn't exist, I want pulumi to ignore the code related to it

I found there is a

forceDetachPolicies

option for

aws.iam.Role

That solves the issue I was trying to work around