Hey, Pulumi engineer here. The engine doesn't compile to a declarative template. It's a common misconception, however because the user's program runs concurren

Hey, Pulumi engineer here. The engine doesn't compile to a declarative template. It's a common misconception, however because the user's program runs concurrently with the Pulumi engine, fully dynamic resource graphs are possible, including those inexpressible using templates. This is Pulumi pseudocode: const group = new ldap.DirectoryGroup("$saas-users); // or any other runtime query: for (const member of group.getMembers()) { new saas.User(member.id, { email: member.email, name: member.fullName, }); // could also do some other dynamic action, such as // calling a webhook to complete user setup And in ~10 lines of code you have a script or webhook you can use in situations where SCIM would normally be required. (n.b.: this is a simplified, illustrative example that the program drives the graph using its own using loops or other control flow.)