Not really, if you do not execute the Role declaration in the code, the role will be deleted instead when , if it managed by Pulumi from a previous update. Pulumi and many other tools generate a declarative model of the resources, even though the code may look imperative. If you have a resource that that already exists but is not managed by Pulumi, import it into the stack instead. This is a one-time operation. You code just includes the part that declare the role (aws.iam.Role(.....) ).