Pulumi provider
Manage typed infrastructure programs with explicit configuration, state ownership, and asynchronous results.
The official Pulumi provider creates and manages Infra resources through the same API permissions and lifecycle as console changes. A stack owns its recorded resource mappings independently of the source program's filenames.
Configure a stack
Read organization and project IDs at Organization → Projects → Project → Details.
Configure the Pulumi stack from the deployment repository's terminal; previews
and updates use pulumi preview and pulumi up in that stack.
Install the Infra package for the chosen Pulumi language and pin its version alongside the Pulumi SDK. Use the provider's release reference to confirm support for the installed control-plane API.
Set API origin, organization, and project through stack configuration. Store the token as a Pulumi secret or inject it through the runner's secret facility. Do not place it in ordinary stack output or source control.
Preview dependencies
Use preview to inspect create, update, replacement, and delete actions. Pass resource outputs into dependent resources rather than resolving IDs through mutable display names.
An output available to another resource represents the provider's completed resource step. Application readiness can still require initialization, a health probe, or a deployment check beyond guest execution.
Import and aliases
Import an existing immutable ID only after checking the stack's scope and resource configuration. Use the provider's documented aliases when a logical rename must preserve the same infrastructure.
A program rename without a supported alias can propose a replacement. A resource managed by an Infra blueprint must first release its ownership through the reviewed detach procedure.
Timeouts and failed updates
The provider polls server operations. A local timeout or interrupted runner can leave server work running. Refresh the stack and inspect the operation rather than assuming the resource was never created.
Successful children can remain after another resource fails. Plan the next update from current state. Deleting stack state does not revoke API credentials or remove retained backups and addresses.
Secrets and protection
Treat state exports and diagnostic logs as sensitive artifacts. Secret outputs are masked by the framework's secret mechanism, but a program can still expose them by writing raw values elsewhere. Keep protection enabled for production resources and review replacement plans explicitly.
See API conventions, resource ownership, and rolling replacement for service cutover.