are there any examples for alternatives to a huge main func? for creating a bunch of resources? vpc + eks type things?

Yes, component resources https://www.pulumi.com/docs/intro/concepts/resources/components/

thx much, i'll digest 🙂

Inside your components, never. Make the inputs for your component configurable and then do the stack reference in your main program

ie, i lean towards creating a "core" stack, with VPC + EKS + few supporting things... logging buckets, cloud trail etc... and applications reference that stack... but would compartmentalizing it further be better? Logging/sec/compliance things be best in their own stack, referencing a vpc stack?