Comprehensive best practices for writing reliable, maintainable Pulumi infrastructure code.

• Avoid creating resources inside apply() callbacks; pass Output objects directly as inputs to preserve dependency tracking and preview visibility
• Use ComponentResource classes to group related resources into reusable logical units with proper parent-child hierarchy via parent: this
• Encrypt secrets from the start with --secret flag or config.requireSecret() to prevent credential leakage in state files and logs
• Add aliases during refactoring to preserve resource identity when renaming, moving into components, or changing parents, preventing unnecessary destroy-recreate cycles
• Always run pulumi preview before deployment to catch unexpected resource replacements, deletions, or ordering issues