pulumi-python_skill

Overview

This skill helps you create and maintain Pulumi Python projects that follow best practices for secrets, OIDC, and reusable components. It focuses on project initialization, ESC-based configuration and secrets, Python patterns for resources and components, and multi-language component support. Use it to set up secure, testable, and reusable Pulumi Python infrastructure code.

How this skill works

The skill inspects typical Pulumi Python workflows: project scaffolding, ESC environment linkage, resource patterns, Outputs handling, and multi-language component packaging. It provides concrete code patterns for S3 buckets, component resources, stack references, async conversions, and ESC environment YAML examples. It also maps common commands and recommended runtime/toolchain settings for virtual environments and type checking.

When to use it

• When you need to create a new Pulumi Python project or scaffold resources with pulumi new python
• When you want to move secrets and stack config into Pulumi ESC environments instead of local config files
• When building reusable ComponentResource classes or publishing multi-language components
• When you need OIDC-based authentication and dynamic short-lived credentials for cloud providers
• When you want clear patterns for Outputs, cross-stack references, and deployment workflows

Best practices

• Keep secrets in Pulumi ESC and never commit them to stack config files
• Prefer ComponentResource and Args classes for reusable, type-safe patterns; use dict literals for concise resources
• Use OIDC and least-privilege IAM policies; prefer dynamic short-lived credentials where possible
• Always run pulumi preview before pulumi up and use ESC environment versioning and tags for releases
• Use virtual environments (venv/poetry/uv) and enable a type checker (mypy or pyright) for better IDE support

Example use cases

• Create an AWS S3 bucket with encryption, versioning, tags, and exported outputs using Python
• Link an ESC environment that injects OIDC credentials and secrets from AWS Secrets Manager into pulumi env run commands
• Build a WebService ComponentResource that creates a load balancer and exposes a URL, then reuse it across stacks
• Publish a Python multi-language component so TypeScript/Go/C# projects can consume secure bucket logic
• Run tests and CI jobs with secrets injected via pulumi env run to avoid storing credentials in code