In a Pulumi program, why does reading a property off a resource — say a bucket's arn — give you an Output<T> rather than a plain string, and how do you build other values from it?

## Why the value cannot be there yet A Pulumi program is ordinary code in TypeScript, Python, Go, C# or Java. Running it does not create infrastructure directly: it *registers* resources with the Pulumi engine, which then talks to the provider. So when the line `const bucket = new aws.s3.Bucket("assets")` executes, nothing exists in AWS. The ARN, the generated bucket name, the endpoint — none of them are knowable at that moment. Anything the cloud decides can only be filled in later. A language with real types has to represent "a value that will exist after deployment" somehow. Pulumi's representation is `Output<T>`. ## What an Output actually is An `Output<T>` carries two things: 1. **A value that arrives later** — conceptually a promise for a `T`. 2. **A dependency set** — which resources this value was derived from. The second part is the one people miss, and it is why Output cannot simply be replaced by `await`. When you pass `bucket.arn` into another resource's arguments, the engine records an edge: the new resource depends on the bucket. That edge is what orders the deployment graph and what makes deletes happen in the right order. An awaited raw string would lose it. Outputs are also the carrier for two other bits of metadata: whether the value is **secret** (secretness propagates through applies, so a value derived from a secret stays secret) and whether it is currently **unknown** (which is what happens during a preview of a resource that does not exist yet). ## The three ways to consume one **Pass it along untouched.** Resource argument types are `Input<T>`, which means "a `T`, a promise for one, or an `Output<T>`". So this is legal and is what you want most of the time: ```typescript const bucket = new aws.s3.Bucket("assets"); const obj = new aws.s3.BucketObject("index", { bucket: bucket.id, key: "index.html" }); ``` No `apply` needed — the SDK resolves it and the dependency is recorded. **Transform it with `apply`.** When you need to compute something from the value, `apply` maps `Output<T>` to `Output<U>`: ```typescript const policy = bucket.arn.apply(arn => JSON.stringify({ Version: "2012-10-17", Statement: [{ Resource: [arn, `${arn}/*`] }] })); ``` The result is still an Output. There is no operation that unwraps an Output into a bare value inside your program — that is deliberate, not a missing feature. **Combine several.** `pulumi.all` lifts a list or object of Outputs into one Output of a list or object: ```typescript const conn = pulumi.all([db.address, db.port]).apply(([host, port]) => `${host}:${port}`); ``` For the very common string case, `pulumi.interpolate` is the readable form and needs no callback: ```typescript const conn2 = pulumi.interpolate`${db.address}:${db.port}`; ``` The other languages have the same trio: Python's `apply`, `Output.all`, `Output.concat`; Go's `ApplyT`, `pulumi.All`, `pulumi.Sprintf`; C#'s `Apply`, `Output.Tuple`, `Output.Format`. ## The classic beginner mistakes **String concatenation.** `"arn is " + bucket.arn` compiles, because JavaScript will stringify anything. Pulumi deliberately makes `toString` on an Output throw a loud error explaining what to use instead, precisely because this bug would otherwise ship a literal placeholder into a policy document. **Branching on an Output.** `if (bucket.arn) { ... }` is always true, and `if (someOutput === "prod")` is never true. Control flow that must depend on a deployed value has to live *inside* an apply, or — much better — depend on configuration instead, which is a plain value your program knows immediately. **Trying to await it.** `Output` is not a `Promise` and awaiting your way around the model throws away the dependency edge even where a runtime hack makes it appear to work. **Doing side effects in the callback.** An apply callback is not a general-purpose hook; it can be skipped when the value is unknown, and it can run more than once across preview and update. Keep it a pure transformation of the value. ## Wiring it to stack outputs Exporting an Output is the normal way to publish a value from a stack: in TypeScript `export const url = ...`, in Python `pulumi.export("url", ...)`. The engine resolves it at the end of the deployment and stores the concrete value in the stack's outputs, which is why exports show real strings even though your program only ever handled placeholders.