[AaronFriel]

Hey, Pulumi engineer here.

The engine doesn't compile to a declarative template. It's a common misconception, however because the user's program runs concurrently with the Pulumi engine, fully dynamic resource graphs are possible, including those inexpressible using templates.

This is Pulumi pseudocode:

    const group = new ldap.DirectoryGroup("$saas-users);

    // or any other runtime query:
    for (const member of group.getMembers()) {
      new saas.User(member.id, {
          email: member.email,
          name: member.fullName,
      });

      // could also do some other dynamic action, such as 
      // calling a webhook to complete user setup

And in ~10 lines of code you have a script or webhook you can use in situations where SCIM would normally be required.

(n.b.: this is a simplified, illustrative example that the program drives the graph using its own using loops or other control flow.)

[OJFord]

Ok. I've never actually used Pulumi, I was responding to GP's description. Personally I want declarative for IaaC; some here are advocating for imperative generation of declarative IaaC (and claiming Pulumi as an example), which I think is barely an improvement (but nevertheless..) over imperative IaaC.