pulumi-best-practices_skill

This skill guides you in writing reliable Pulumi programs by enforcing proper Output handling, component structure, secrets management, and safe refactoring.

25

GitHub Stars

1

Bundled Files

2 months ago

Catalog Refreshed

4 months ago

First Indexed

Readme & install

Copy the install command, review bundled files from the catalogue, and read any extended description pulled from the listing source.

Installation

Preview and clipboard use veilstrat where the catalogue uses aiagentskills.

npx veilstrat add skill pulumi/agent-skills --skill pulumi-best-practices

SKILL.md14.8 KB

Overview

This skill codifies Pulumi best practices to write reliable, maintainable infrastructure-as-code. It focuses on correct Output handling, resource dependencies, component structure, secrets management, safe refactoring with aliases, and deployment workflows. Use it to avoid common pitfalls that lead to unexpected deletes, race conditions, or leaked secrets.

How this skill works

The skill inspects code and workflow patterns to flag risky constructs and recommend concrete fixes. It highlights resources created inside apply(), improper unwrapping of Outputs, missing parent relationships in components, plaintext config, missing aliases for refactors, and skipped previews. For each issue it explains detection signals, safe alternatives, and simple code or CLI examples.

When to use it

When authoring new Pulumi programs or ComponentResources
During code reviews to catch dependency and secrets mistakes
While refactoring resources or moving resources into components
When debugging surprising create/delete/replace actions in previews
When designing CI/CD workflows for Pulumi deployments

Best practices

Never create resources inside apply(); pass Outputs directly as resource inputs
Use pulumi.interpolate or pulumi.concat for templating instead of extracting values
Encapsulate related resources in ComponentResource classes and expose Outputs
Always pass { parent: this } to child resources inside components
Mark sensitive values with --secret or pulumi.secret from day one
Add aliases during refactors to preserve resource identity and avoid recreation

Example use cases

Converting a flat set of resources into a reusable ComponentResource with proper parent links
Refactoring resource names or moving resources into components while preserving state via aliases
Fixing a race condition caused by await/apply unwrapping Outputs used as inputs
Switching stack configuration values to secrets and updating code to requireSecret
Adding pulumi preview to PR workflows and gating merges on manual preview review

FAQ

Resources created inside apply() are not visible to pulumi preview and break the dependency graph, causing unpredictable deploys and race conditions.

When should I use aliases during refactoring?

Add aliases anytime you rename a resource, change its parent, or move it into/out of a component to preserve identity and avoid destructive replacements.