pulumi▌

Comprehensive best practices for writing reliable, maintainable Pulumi infrastructure code. \n \n Avoid creating resources inside apply() callbacks; pass Output objects directly as inputs to preserve dependency tracking and preview visibility \n Use ComponentResource classes to group related resources into reusable logical units with proper parent-child hierarchy via parent: this \n Encrypt secrets from the start with --secret flag or config.requireSecret() to prevent credential leakage in state

Centralized secrets, configuration, and dynamic credentials management for Pulumi infrastructure and applications. \n \n Supports environment composition through imports and layering, with reserved keys for environmentVariables , pulumiConfig , and files \n Generates short-term credentials via OIDC for AWS, Azure, and GCP; integrates with AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and 1Password \n Core CLI commands include pulumi env init , pulumi env edit , pulumi env open (reveals

Project structure:

If you have already generated a migration plan before loading this skill, you MUST:

The migration output MUST meet all of the following:

Programmatic orchestration of Pulumi infrastructure operations across multiple stacks and applications. \n \n Supports both local source (existing Pulumi projects) and inline source (embedded programs) architectures, enabling flexible deployment patterns from simple to complex multi-stack scenarios \n Handles multi-stack orchestration with dependency sequencing, parallel independent deployments, and cross-stack output passing for coordinated infrastructure provisioning \n Provides programmatic c

Critical constraints — read before acting:

$23

Convert ARM templates, Bicep, or existing Azure resources to Pulumi infrastructure code. \n \n Handles complete ARM template conversion to Pulumi (TypeScript, Python, Go, C#, Java, or YAML) with support for parameters, variables, loops, conditionals, and nested templates \n Supports both azure-native (full API coverage) and azure (classic, simplified) providers; automatically selects the right provider for each resource \n Imports existing deployed Azure resources into Pulumi with zero-diff vali