### Install Dependencies and Build Provider

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/README.md

Run these commands to install Go modules, generate all SDKs, and build the provider locally.

```bash
make ensure
make build
```

--------------------------------

### User Starts Managing Existing Default Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Illustrates the scenario where a user begins managing an optional-computed property that was previously a default. No cloud operation is expected if the user's desired state matches the actual state.

```text
After refresh:

old inputs: no backupTarget
output:     backupTarget = "region"

Program changes to:

new inputs: backupTarget = "region"

Expected behavior:

cloud operation: none, because actual already matches desired
ownership:       user now manages backupTarget, recorded on the next state write
```

--------------------------------

### Link and Run ECS Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/README.md

Navigate to the ECS example directory, link the local package, configure AWS regions, and deploy using Pulumi up.

```bash
cd ./examples/ecs
yarn link @pulumi/aws-native
pulumi config set aws:region us-west-2
pulumi config set aws-native:region us-west-2
pulumi up
```

--------------------------------

### Install Development Tools

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Installs the necessary development tools. Ensure your tool versions are pinned in `.config/mise.toml`.

```bash
mise install
```

--------------------------------

### Install and Configure create-role Project

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/examples/aws-ts-assume-role/README.md

Installs dependencies, initializes a Pulumi stack, and sets configuration variables for the unprivileged username and AWS region.

```bash
cd create-role
npm install
pulumi stack init assume-role-create
pulumi config set create-role:unprivilegedUsername somebody@pulumi.com
pulumi config set aws:region us-east-1
pulumi up
```

--------------------------------

### User Starts Managing Different Value Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Describes the outcome when a user explicitly manages an optional-computed property with a different value after a refresh. This will result in a diff and potentially an update or replacement.

```text
After refresh:

old inputs: no backupTarget
output:     backupTarget = "region"

Program changes to:

new inputs: backupTarget = "local"

Expected behavior:

engine diff: absent -> local
operation:   update or replacement depending on property semantics
```

--------------------------------

### Launch Devbox Shell

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/README.md

Use devbox to quickly launch a shell environment with all required dependencies installed.

```bash
which devbox || curl -fsSL https://get.jetpack.io/devbox | bash
devbox shell
```

--------------------------------

### Create IPAM Pool and VPC

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

This example demonstrates creating an IPAM pool and then a VPC that utilizes the IPAM pool for IP address management. Ensure an IPAM is pre-created in the region.

```python
ipam = ec2.get_ipam(ipam_id="ipam-0a1b2c3d4e5f")

ipam_pool = ec2.IpamPool(
    "ipamPool",
    address_family="ipv4",
    ipam_scope_id=ipam.private_default_scope_id,
    locale=aws_native_config.require("region"),
)

ipam_pool_cidr = ec2.IpamPoolCidr(
    "ipamPoolCidr",
    ipam_pool_id=ipam_pool.id,
    cidr="10.0.0.0/16",
)

vpc = ec2.Vpc(
    "vpc",
    ipv4_ipam_pool_id=ipam_pool.id,
    ipv4_netmask_length=20,
    opts=pulumi.ResourceOptions(depends_on=[ipam_pool_cidr]),
)

pulumi.export("vpcId", vpc.vpc_id)
```

--------------------------------

### External Drift Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Demonstrates how a resource's input is updated to match external drift detected during a refresh. This prevents phantom updates in subsequent previews.

```text
old inputs: myField = "abc"
output:     myField = "abc"

Cloud changes to:

live output: myField = "xyz"

After refresh:

old inputs: myField = "xyz"
output:     myField = "xyz"

Next preview with program still setting "abc":

engine diff: xyz -> abc
operation:   update or replacement depending on property semantics
```

--------------------------------

### Provision VPC with IPAM-backed CIDR using Python

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Provision a VPC where the CIDR is allocated from an existing IPAM pool. This example demonstrates the use of `get_*` data source functions.

```python
import pulumi
from pulumi_aws_native import ec2

aws_native_config = pulumi.Config("aws-native")


```

--------------------------------

### Pulumi CLI Commands for AWS Step Functions

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/examples/aws-native-ts-stepfunctions/README.md

Follow these commands to initialize a Pulumi stack, set the AWS region, install dependencies, deploy the infrastructure, and manage the application lifecycle.

```bash
# Create and configure a new stack
$ pulumi stack init stepfunctions-dev
$ export AWS_REGION=us-east-2

# Install dependencies
$ npm install

# Preview and run the deployment
$ pulumi up

# Start execution using the AWS CLI (or from the console at https://console.aws.amazon.com/states)
$ aws stepfunctions start-sync-execution --state-machine-arn $(pulumi stack output stateMachineArn)

# Remove the app
$ pulumi destroy
```

--------------------------------

### Newly Visible Optional-Computed Default Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Shows how a refresh after a provider upgrade can reveal a new optional-computed default value. Subsequent previews will not plan an update if the program omits this property.

```text
State before provider upgrade:

old inputs: no backupTarget
output:     no backupTarget in old schema/checkpoint

After provider upgrade and refresh:

old inputs: no backupTarget
output:     backupTarget = "region"

Next preview with program still omitting `backupTarget`:

engine diff: none
```

--------------------------------

### Retrieve AWS Account and Region Information

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

This example shows how to retrieve AWS account ID, region, partition, and availability zones at runtime using Pulumi AWS Native provider's data source functions. These are equivalent to CloudFormation pseudo-parameters.

```typescript
import * as aws from "@pulumi/aws-native";

// Equivalent to CloudFormation { "Ref": "AWS::AccountId" }
const accountId = aws.getAccountIdOutput({});
// Equivalent to { "Ref": "AWS::Region" }
const region = aws.getRegionOutput({});
// Equivalent to { "Ref": "AWS::Partition" } and { "Ref": "AWS::URLSuffix" }
const partition = aws.getPartitionOutput({});

// Construct a service endpoint dynamically from partition info
const endpoint = partition.apply(p =>
    `https://s3.${p.dnsSuffix}`
);

// Resolve availability zones in the current region
const azs = aws.getAvailabilityZonesOutput({});

export const accountIdValue = accountId.accountId;
export const regionValue = region.region;
export const partitionValue = partition.partition;
export const availabilityZones = azs.azs;
```

--------------------------------

### IAM Policy Document Normalization Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Illustrates the normalized representation of an IAM trust policy. This normalization is handled by Pulumi to ensure consistent diffing, especially when dealing with scalar vs. singleton-array actions.

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Action": ["sts:AssumeRole"],
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" }
  }]
}
```

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" }
  }]
}
```

--------------------------------

### Reading Existing Resources — `get` Functions

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Fetch the current state of an existing AWS resource by its identifier, allowing you to reference it in your Pulumi program without managing its lifecycle.

```APIDOC
## Reading Existing Resources — `get` Functions

Fetch current state of an existing AWS resource by identifier, without managing its lifecycle.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws-native";

// Create a log group, then immediately fetch it back by name to verify
const logGroup = new aws.logs.LogGroup("app-logs", {
    retentionInDays: 90,
});

// getLogGroupOutput waits for the id to be available (eventual consistency safe)
const fetchedLogGroup = aws.logs.getLogGroupOutput({
    logGroupName: logGroup.id.apply(() =>
        logGroup.logGroupName.apply(n => n ?? "")
    ),
});

export const arns =
    pulumi
        .all([logGroup.arn, fetchedLogGroup.arn])
        .apply(([created, fetched]) => {
            if (created !== fetched) throw new Error("ARN mismatch");
            return { created, fetched };
        });
```
```

--------------------------------

### Configure Assume Role Project

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/examples/aws-ts-assume-role/README.md

Initializes a new Pulumi stack and sets configuration variables for the ARN of the role to assume and the AWS region.

```bash
pulumi stack init assume-role-assume
pulumi config set roleToAssumeARN "$(pulumi stack output --stack {YOUR_STACK_PATH/assume-role-create} roleArn)"
pulumi config set aws:region us-east-1
```

--------------------------------

### User Removes Previously Managed Optional-Computed Input Example

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Explains how the removal of a previously managed optional-computed input is treated as an intentional user action. The resulting operation depends on the property's mutability.

```text
After refresh:

old inputs: backupTarget = "region"
output:     backupTarget = "region"

Program changes to:

new inputs: no backupTarget

Treat removal as intentional user removal. The resulting operation depends on property kind:

- mutable properties should emit the appropriate remove/unset patch when CloudControl supports it;
- create-only properties should be replacement-significant;
- write-only properties should use old input values as the best available baseline because the actual value cannot be read.
```

--------------------------------

### Run Full Provider Tests

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Executes comprehensive tests for broader provider changes. This may take longer than fast tests.

```bash
make test_provider
```

--------------------------------

### Regenerate Local SDK/API Surface

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Regenerates the SDK and API surface locally. Execute this command after making changes to the SDK or API surface.

```bash
make local_generate
```

--------------------------------

### Run Local Verification Tests

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/README.md

Execute fast local verification tests for the provider.

```bash
make verify
```

--------------------------------

### Run Integration Tests

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Performs slow integration validation, requiring AWS credentials. Use this for thorough testing.

```bash
make test
```

--------------------------------

### Run Fast Provider Tests

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Executes fast tests for provider code changes. This is a quick verification step.

```bash
make lint
make test_provider_fast
```

--------------------------------

### Create CloudWatch Logs Log Group - Go

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Creates a CloudWatch Logs log group with a specified retention period using the Go SDK. Ensure the Pulumi Go SDK and AWS provider are correctly set up.

```go
package main

import (
    awslogs "github.com/pulumi/pulumi-aws-native/sdk/go/aws/logs"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        logGroup, err := awslogs.NewLogGroup(ctx, "app-logs", &awslogs.LogGroupArgs{
            RetentionInDays: pulumi.Int(90),
        })
        if err != nil {
            return err
        }
        ctx.Export("arn", logGroup.Arn)
        return nil
    })
}
```

--------------------------------

### Run Targeted Provider Tests (Resources)

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Execute specific tests for path classification, patch calculation, and AWS managed diffs within the resources package. Use this for targeted validation of changed provider/runtime logic.

```bash
mise exec -- go test -count=1 ./pkg/resources -run 'TestPathClassifier|TestCalcPatch|TestSuppressAWSManagedDiffs'
```

--------------------------------

### Run Targeted Provider Tests (Provider)

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/docs/gh-2390-refresh-input-output-semantics.md

Execute specific tests for standard resource lifecycle operations (Read, Diff, Update) within the provider package. Use this for targeted validation of changed provider/runtime logic.

```bash
mise exec -- go test -count=1 ./pkg/provider -run 'TestStandardResource(Read|Diff|Update)'
```

--------------------------------

### Generate Resource Name Automatically (Go)

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Employ `ApplyAutoNaming` to generate a unique resource name from its Pulumi URN when no explicit name is provided. This function respects minimum and maximum length constraints defined in the CloudFormation schema and can append a random suffix.

```go
import (
    "github.com/pulumi/pulumi-aws-native/provider/pkg/autonaming"
    "github.com/pulumi/pulumi-aws-native/provider/pkg/metadata"
    "github.com/pulumi/pulumi/sdk/v3/go/common/resource"
)

spec := &metadata.AutoNamingSpec{
    SdkName:   "bucketName",
    MinLength: 3,
    MaxLength: 63,
}
engineConfig := autonaming.EngineAutoNamingConfig{
    RandomSeed:   []byte{0x1, 0x2, 0x3},
    ProposedName: "my-bucket",
}
providerConfig := &autonaming.ProviderAutoNamingConfig{
    AutoTrim:              true,
    RandomSuffixMinLength: 7,
}

olds := resource.PropertyMap{}
news := resource.PropertyMap{} // no explicit name

err := autonaming.ApplyAutoNaming(spec, urn, engineConfig, providerConfig, olds, news)
// news["bucketName"] is now populated, e.g. "my-bucket-a3f9c12"
```

--------------------------------

### Regenerate CI Configuration

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/CONTRIBUTING.md

Regenerates CI configuration files. Run this if changes are made to `.ci-mgmt.yaml`.

```bash
make ci-mgmt
```

--------------------------------

### Configure AWS Native Provider with Default Tags and Assume Role in Go

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Configure the AWS Native provider with a specific region and default tags that will be applied to all taggable resources. Assumed role credentials can also be configured via the Pulumi configuration file.

```go
package main

import (
    awsNative "github.com/pulumi/pulumi-aws-native/sdk/go/aws"
    ssm "github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        cfg := config.New(ctx, "aws-native")

        // Configure provider with default tags applied to all resources
        provider, err := awsNative.NewProvider(ctx, "aws-native", &awsNative.ProviderArgs{
            Region: pulumi.String(cfg.Require("region")),
            DefaultTags: awsNative.ProviderDefaultTagsArgs{
                Tags: pulumi.StringMap{
                    "team":        pulumi.String("platform"),
                    "environment": pulumi.String("production"),
                },
            },
        })
        if err != nil {
            return err
        }

        // Resource inherits defaultTags; local tags are merged on top
        param, err := ssm.NewParameter(ctx, "config-param", &ssm.ParameterArgs{
            Type:  ssm.ParameterTypeString,
            Value: pulumi.String("my-value"),
            Tags: pulumi.StringMap{
                "component": pulumi.String("backend"),
            },
        }, pulumi.Provider(provider))
        if err != nil {
            return err
        }

        ctx.Export("paramName", param.Name)
        return nil
    })
}
```

```yaml
config:
  aws-native:region: us-east-1
  aws-native:assumeRole:
    roleArn: arn:aws:iam::123456789012:role/DeployRole
    sessionName: pulumi-deploy
  aws-native:maxRetries: "25"
  aws-native:defaultTags:
    tags:
      team: platform
```

--------------------------------

### Output Stack Information (JSON)

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/examples/aws-ts-assume-role/README.md

Retrieves stack outputs in JSON format, including access key ID, secret access key, and role ARN.

```bash
pulumi stack output --json
```

--------------------------------

### Create CloudWatch Logs Log Group and S3 Bucket - Python

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Creates a CloudWatch Logs log group with a 90-day retention policy and an S3 bucket, both tagged for production. Ensure the Pulumi AWS provider is configured.

```python
import pulumi
from pulumi_aws_native import logs, s3, TagArgs

# Create a CloudWatch Logs log group
log_group = logs.LogGroup(
    "app-logs",
    retention_in_days=90,
    tags=[
        TagArgs(key="env", value="production"),
    ],
)

# Create an S3 bucket
bucket = s3.Bucket("my-bucket", tags=[TagArgs(key="env", value="production")])

pulumi.export("logGroupArn", log_group.arn)
pulumi.export("bucketName", bucket.bucket_name)
```

--------------------------------

### Output Stack Information with Secrets (JSON)

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/examples/aws-ts-assume-role/README.md

Retrieves stack outputs in JSON format, including the secret access key in plain text.

```bash
pulumi stack output --json --show-secrets
```

--------------------------------

### Enable Verbose Logging for Provider Requests

Source: https://github.com/pulumi/pulumi-aws-native/blob/master/README.md

Use the -v 9 flag with --logflow to view a trace of all HTTP requests and responses between the provider and AWS APIs. This is useful for debugging.

```bash
pulumi -v 9 --logflow [command]
```

--------------------------------

### CloudControlClient Interface for Core CRUD Operations

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

This Go code demonstrates the internal `client.CloudControlClient` interface, which wraps the AWS Cloud Control API for resource management. It includes retry logic and polling for operation completion. This is primarily for contributors writing custom resources.

```go
// client.CloudControlClient interface (provider/pkg/client/client.go)
// Used internally; exposed here for contributors writing custom resources.

import (
    "context"
    "github.com/mattbaird/jsonpatch"
    "github.com/pulumi/pulumi/sdk/v3/go/common/resource"
)

// Create provisions a new resource and returns its identifier and final state.
// Blocks until the Cloud Control operation completes or times out.
identifier, resourceState, err := ccClient.Create(ctx, urn, "AWS::S3::Bucket", map[string]any{
    "BucketName": "my-unique-bucket-name",
    "Tags": []map[string]string{{"Key": "env", "Value": "prod"}},
})

// Read returns the current live state or (nil, false, nil) if not found.
state, exists, err := ccClient.Read(ctx, "AWS::S3::Bucket", *identifier)
if !exists {
    // Resource was deleted out-of-band
}

// Update applies a JSON Patch to the resource.
patches := []jsonpatch.JsonPatchOperation{
    {"Operation": "replace", "Path": "/Tags/0/Value", "Value": "staging"},
}
updatedState, err := ccClient.Update(ctx, urn, "AWS::S3::Bucket", *identifier, patches)

// Delete removes the resource; NotFound is treated as success.
er := ccClient.Delete(ctx, urn, "AWS::S3::Bucket", *identifier)
```

--------------------------------

### Provider Configuration with Default Tags and Assume Role

Source: https://context7.com/pulumi/pulumi-aws-native/llms.txt

Configure the AWS Native provider with a specific region, default tags that apply to all taggable resources, and assume-role credentials for enhanced security and resource management.

```APIDOC
## Provider Configuration with Default Tags and Assume Role

Configure the provider with a region, default tags applied to all taggable resources, and assume-role credentials.

```go
package main

import (
    awsNative "github.com/pulumi/pulumi-aws-native/sdk/go/aws"
    ssm "github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        cfg := config.New(ctx, "aws-native")

        // Configure provider with default tags applied to all resources
        provider, err := awsNative.NewProvider(ctx, "aws-native", &awsNative.ProviderArgs{
            Region: pulumi.String(cfg.Require("region")),
            DefaultTags: awsNative.ProviderDefaultTagsArgs{
                Tags: pulumi.StringMap{
                    "team":        pulumi.String("platform"),
                    "environment": pulumi.String("production"),
                },
            },
        })
        if err != nil {
            return err
        }

        // Resource inherits defaultTags; local tags are merged on top
        param, err := ssm.NewParameter(ctx, "config-param", &ssm.ParameterArgs{
            Type:  ssm.ParameterTypeString,
            Value: pulumi.String("my-value"),
            Tags: pulumi.StringMap{
                "component": pulumi.String("backend"),
            },
        }, pulumi.Provider(provider))
        if err != nil {
            return err
        }

        ctx.Export("paramName", param.Name)
        return nil
    })
}
```

Provider configuration via `Pulumi.<stack>.yaml`:

```yaml
config:
  aws-native:region: us-east-1
  aws-native:assumeRole:
    roleArn: arn:aws:iam::123456789012:role/DeployRole
    sessionName: pulumi-deploy
  aws-native:maxRetries: "25"
  aws-native:defaultTags:
    tags:
      team: platform
```
```