The Complete Production SOP: How to Deploy and Run Pulumi TypeScript Infrastructure as Code & ComponentResources in Autonomous AI Agents

---
name: "pulumi-typescript-iac"
description: "Define cloud infrastructure using real programming languages (TypeScript) and type safety."
metadata:
  author: "Pulumi"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "create pulumi typescript stack"
  - "build pulumi componentresource"
  - "test pulumi iac jest"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "commonjs",
    "moduleResolution": "node",
    "strict": true,
    "noImplicitAny": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true
  },
  "include": ["src/**/*.ts", "tests/**/*.ts", "index.ts"]
}

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

export interface SecureBucketArgs {
    bucketPrefix: pulumi.Input<string>;
    enableVersioning?: boolean;
}

export class SecureBucket extends pulumi.ComponentResource {
    public readonly bucketName: pulumi.Output<string>;
    public readonly arn: pulumi.Output<string>;

    constructor(name: string, args: SecureBucketArgs, opts?: pulumi.ComponentResourceOptions) {
        super("custom:storage:SecureBucket", name, {}, opts);

        const bucket = new aws.s3.BucketV2(`${name}-bucket`, {
            bucketPrefix: args.bucketPrefix,
        }, { parent: this });

        new aws.s3.BucketServerSideEncryptionConfigurationV2(`${name}-sse`, {
            bucket: bucket.id,
            rules: [{
                applyServerSideEncryptionByDefault: {
                    sseAlgorithm: "AES256",
                },
            }],
        }, { parent: this });

        this.bucketName = bucket.id;
        this.arn = bucket.arn;
        this.registerOutputs({
            bucketName: this.bucketName,
            arn: this.arn,
        });
    }
}

import * as pulumi from "@pulumi/pulumi";

pulumi.runtime.setMocks({
    newResource: (args: pulumi.runtime.MockResourceArgs): { id: string; state: any } => {
        return { id: `${args.name}-mock-id`, state: args.inputs };
    },
    call: (args: pulumi.runtime.MockCallArgs) => args.inputs,
});

describe("SecureBucket ComponentResource", () => {
    it("configures default server-side encryption", async () => {
        const { SecureBucket } = await import("../src/secureBucket");
        const instance = new SecureBucket("test-bucket", { bucketPrefix: "logs-" });

        instance.bucketName.apply(name => {
            expect(name).toBeDefined();
        });
    });
});