Fix import resources with provider default tags #4169

corymhall · 2024-07-03T12:53:15Z

We have special logic around applying default provider tags to
resources. This logic only applied to the Check call which means it
was not applied when you were importing resources. This PR extends that
logic to also run during the Read call by utilizing TransformOutputs.

While it is true that TransformOutputs also runs during Create & Update
this is a side effect that I think is ok. From my understanding tags and tagsAll
should always be equal. If we have an additional place where we make sure they are equal
it shouldn't harm anything.

I've added tests (see testTagsPulumiLifecycle) which test the complete lifecycle of a pulumi program

Up with both provider defaultTags/ignoreTags and resource level tags
1a. Run validations on result
Refresh with no changes
Import using the resource option. Ensures resource can be successfully imported
3a. Allows for a hook to be run prior to import being run. e.g. Add tags remotely
Import using the CLI. Ensures resources can be successfully imported
4a. Allows for a hook to be run prior to import being run. e.g. Add tags remotely
Refresh with no changes

fix #4030, fix #4080, fix #3311

We have special logic around applying default provider tags to resources. This logic only applied to the `Check` call which means it was not applied when you were importing resources. This PR extends that logic to also run during the `Read` call. fix #4030, fix 4080

provider/tags.go

github-actions · 2024-07-03T14:10:52Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

Maintainer note: consult the runbook for dealing with any breaking changes.

t0yv0 · 2024-07-03T17:17:16Z

provider/tags.go

+		})
+	}
+
+	allTags, err := mergeTags(ctx, configTags, meta)


I'd appreciate a little bit of elaboration here on what we're trying to do, and how does it work, I see this:

As written, allTags = mergeTags(ctx, config.tags, {defaultTags: config.tagsAll}).

I think if I recall what TransformOutputs is doing this will be assigning config to the tags and tagsAll coming out of the TF provider. This seems to then ignore the current defaultTags on the provider itself as it were.

Why does this work? I thought perhaps we're not trusting the tags_all output from the provider internals, is it useful here?

flostadler · 2024-07-03T17:28:58Z

provider/tags.go

+		delete(ret, "tagsAll")
+		return ret, nil
+	}
+	ret["tags"] = allTags


Why do we set allTags to tags? Shouldn't tags only include the tags specified on the resource?

Yeah I was also confused here, I was expecting something like this:

(1) we receive data from the Read call that has "tags" and "tags_all"

(2) I think here we need to understand what this data is and do we trust it; e.g. the TF provider would be grabbing all tags from the AWS hopefully, but then it would also possibly applying the defaultTags to that result to either union or exclude them? We had to disable this behavior for Create/Update lifecycle since we couldn't get the implementation to behave correctly and trust it; perhaps something similar needs to be tweaked here for reads

(3) suppose we figured out (2) correctly and we obtained what we believe is the set of in-AWS resource tags. Now what do we decide to surface as "tags". Perhaps here we want to exclude surfacing a k:v pair in "tags" if the defaultTags already has it set at provider level. So perhaps take the set difference here?

Unfortunately it's more complicated than this as TransformOutputs hook is hiding some differences around the context this code is executing in. Let me add below.

t0yv0 · 2024-07-03T18:13:12Z

ResourceProvider.Read we're trying to modify here is very overloaded in Pulumi unfortunately, so there's a matrix of case here to consider.

Case 1: pulumi import on the CLI

pulumi import 'aws:iam/user:User' name id

Relatively simple version where there are no program inputs to consider and the objective is to generate a minimal program. The program would be minimal if all cloud tags that are already in defaultTags are omitted.

Case 2: import with resource option

I think this is somehow meaningfully different from vanilla import because it has some resource inputs to consider from the program. If the program specifies an input tag k:v in the inputs and the cloud doesn't have it or has a contradicting value, Pulumi should probably be failing saying that the inputs do not match so that the user fixes up the program before proceeding. If the program does not specify the tag k:v that cloud has, but defaultTags do, then we should proceed without warning.

opts=pulumi.ResourceOptions(import_=bucket_name)

Case 3: pulumi refresh

This one is interesting because it starts engaging bridge heuristics ExtractInputsFromOutputs to try to guess which cloud value is an input and which one is an output. I think it's pretty crude right now and might not do what we'd like for tags, worth thinking through.

Case 4: Bucket.get()

This one I have a bit of a knowledge gap and need to brush up on, but I think it will also call Read.

t0yv0 · 2024-07-03T18:13:42Z

The additional matrix dimension is that resources can be PF based or SDKv2 based and the underlying TF behavior can be different .

t0yv0 · 2024-07-03T18:19:22Z

TransformOutputs is a blunt tool since it will not only modify Read results, but also modify Create and Update results, and it can't yet understand which kind of Read context it's operating in. There's some additional burden on verifying these changes don't affect Create/Update but looks like the test suite passed so that might be working just fine. I'm wondering if we need something more granular here..

corymhall · 2024-07-08T13:54:30Z

@t0yv0 @flostadler here is what my current understanding is.

There are two fields that track tags on a resource;

tags - These are the tags that are applied to the resource itself.

new aws.s3.BucketV2('bucket', {
  tags: {
    SomeKey: 'SomeValue',
  },
});

tagsAll/defaultTags - These are the tags that are specified on the provider and apply to all resources under that provider.

new aws.Provider('aws', {
  defaultTags: {
    tags: {
      GlobalTag: 'Value',
    },
  },
});

When it comes time to apply these tags to a resource we merge the tags into a single list of tags. The way that we do this is a hack on the pulumi side as part of the PreCheckCallback. All the tags specified in defaultTags are merged into the resource tags so that it contains all the tags that need to be created on the resource. This runs during the Check request which runs prior to Create & Update so that the output of Check contains the merged tags and is passed into Create/Update.

From what I can tell, the intention is for tags and tagsAll to always be equal.

Example

If I were to create a resource with this configuration (both defaultTags & tags)

const provider = new aws.Provider('aws', {
  defaultTags: {
    tags: {
      GlobalTag: 'Value',
    },
  },
});

new aws.s3.BucketV2('bucket', {
  tags: {
    LocalTag: 'Value',
  },
}, { provider });

The state of the bucket resource will have the tags like this (merged together):

{
  "resources": [
    {
        "type": "aws:s3/bucketV2:BucketV2",
        "inputs": {
            "tags": {
                "GlobalTag": "Value",
                "LocalTag": "Value"
            },
            "tagsAll": {
                "GlobalTag": "Value",
                "LocalTag": "Value"
            }
        },
        "outputs": {
            "tags": {
                "GlobalTag": "Value",
                "LocalTag": "Value"
            },
            "tagsAll": {
                "GlobalTag": "Value",
                "LocalTag": "Value"
            }
        }
    }
  ]
}

If I were to then go an add a new tag in the console ConsoleTag and change the values of GlobalTag & LocalTag and then run a refresh it will show a diff for both tags and tags all. Everything works correctly because the inputs to read & diff is the current state which contains all the tags.

{
  "method": "/pulumirpc.ResourceProvider/Read",
  "request": {...},
  "response": {
      "tags": {
          "GlobalTag": "ValueOther",
          "LocalTag": "ValueOther",
          "ConsoleTag": "Value"
      },
      "tagsAll": {
          "GlobalTag": "ValueOther",
          "LocalTag": "ValueOther",
          "ConsoleTag": "Value"
      },
    "inputs": {
      "tags": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      },
      "tagsAll": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      }
    }
  }
}
{
  "method": "/pulumirpc.ResourceProvider/Diff",
  "request": {
    "olds": {
      "tags": {
          "GlobalTag": "ValueOther",
          "LocalTag": "ValueOther",
          "ConsoleTag": "Value"
      },
      "tagsAll": {
          "GlobalTag": "ValueOther",
          "LocalTag": "ValueOther",
          "ConsoleTag": "Value"
      }
    },
    "news": {
      "tags": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      },
      "tagsAll": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      }
    },
    "oldInputs": {
      "tags": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      },
      "tagsAll": {
          "GlobalTag": "Value",
          "LocalTag": "Value"
      }
    }
  },
  "response": {
    "changes": "DIFF_SOME",
    "diffs": ["tags","tags","tags","tagsAll","tagsAll","tagsAll"],
    "detailedDiff": {...},
    "hasDetailedDiff": true
  }
}

If instead I try and import a resource with the same configuration of tags there would be no existing state to rely on. The state would be produced by the output of the read call. When I run an import it will call Read -> Check -> Diff. The inputs to Diff will be:

olds: produced by Read. There is a difference between tags & tagsAll because it is not merging them together.
news: produced by Check. Check runs PreCheckCallBack and produces a merged tags & tagsAll.

This always leads to a diff because we are comparing an unmerged tags & tagsAll produced by Read with a merged tags & tagsAll produced by Check.

{
  "method": "/pulumirpc.ResourceProvider/Read",
  "request": {"properties": {}},
  "response": {
    "properties": {
      "tags": {
        "LocalTag": "Value"
      },
      "tagsAll": {
        "GlobalTag": "Value"
      },
    },
    "inputs": {
      "tags": {
        "LocalTag": "Value"
      },
      "tagsAll": {
        "GlobalTag": "Value"
      }
    }
  }
}
{
  "method": "/pulumirpc.ResourceProvider/Check",
  "request": {
    "olds": {
      "tags": {
       "LocalTag": "Value"
      },
      "tagsAll": {
        "GlobalTag": "Value"
      }
    },
    "news": {
      "tags": {
         "LocalTag": "Value" 
      }
    }
  },
  "response": {
    "inputs": {
      "tags": {
         "LocalTag": "Value" ,
        "GlobalTag": "Value"
      },
      "tagsAll": {
         "LocalTag": "Value" ,
        "GlobalTag": "Value"
      }
    }
  }
}
{
  "method": "/pulumirpc.ResourceProvider/Diff",
  "request": {
    "olds": {
      "tags": {
         "LocalTag": "Value" 
      },
      "tagsAll": {
        "GlobalTag": "Value"
      }
    },
    "news": {
      "tags": {
         "LocalTag": "Value" ,
        "GlobalTag": "Value"
      },
      "tagsAll": {
         "LocalTag": "Value" ,
        "GlobalTag": "Value"
      }
    },
    "oldInputs": {
      "tags": {
         "LocalTag": "Value" 
      },
      "tagsAll": {
         "LocalTag": "Value" ,
        "GlobalTag": "Value"
      }
    }
  },
  "response": {
    "changes": "DIFF_SOME",
    "diffs": [ "tags", "tags", "tags" ],
    "detailedDiff": {...},
    "hasDetailedDiff": true
  }
}

What this PR attempts to do is to apply the same type of hack that we do in PreCheckCallback to the TransformOutputs that is run during Read, Create, & Update. Looking at the above example, we need the Read call to produce a merged tags & tagsAll, which we can do as part of TransformOutputs.

TransformOutputs is a blunt tool since it will not only modify Read results, but also modify Create and Update results, and it can't yet understand which kind of Read context it's operating in.

I think this only matters in a case where we want tags & tagsAll (on a resource) to be different. Unless I am misunderstanding something I don't think there is ever a scenario where this is true. In that case it shouldn't matter that we merge tags & tagsAll in an additional callback.

VenelinMartinov · 2024-07-08T14:35:54Z

@corymhall Do you have some background on

From what I can tell, the intention is for tags and tagsAll to always be equal.

This is not what TF does:

provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      GlobalTag = "GlobalVal"
    }
  }
}

# s3 bucket
resource "aws_s3_bucket" "bucket" {
  bucket_prefix = "mybucket"
  tags = {
    "localTag" = "localValue"
  }
}

produces

"tags": {
  "localTag": "localValue"
},
"tags_all": {
  "GlobalTag": "GlobalVal",
  "localTag": "localValue"
},

which makes sense to me. Why are we doing something different here?

corymhall · 2024-07-08T14:46:59Z

which makes sense to me. Why are we doing something different here?

Apparently there are a lot of upstream issues around tagging and we decided to do something about it on our side. I think @t0yv0 and @iwahbe are most familiar with this and they are both out this week.

pulumi-aws/provider/tags.go

Lines 25 to 45 in 0063967

    
           // Apply provider tags to an individual resource. 
        
           // 
        
           // Historically, Pulumi has struggles to handle the "tags" and "tags_all" fields correctly: 
        
           // - https://github.com/pulumi/pulumi-aws/issues/2633 
        
           // - https://github.com/pulumi/pulumi-aws/issues/1655 
        
           // 
        
           // terraform-provider-aws has also struggled with implementing their desired behavior: 
        
           // - https://github.com/hashicorp/terraform-provider-aws/issues/29747 
        
           // - https://github.com/hashicorp/terraform-provider-aws/issues/29842 
        
           // - https://github.com/hashicorp/terraform-provider-aws/issues/24449 
        
           // 
        
           // The Terraform lifecycle simply does not have a good way to map provider configuration 
        
           // onto resource values, so terraform-provider-aws is forced to work around limitations in 
        
           // unreliable ways. For example, terraform-provider-aws does not apply tags correctly with 
        
           // -refresh=false. 
        
           // 
        
           // This gives pulumi the same limitations by default. However, unlike Terraform, Pulumi 
        
           // does have a clear way to insert provider configuration into resource properties: 
        
           // Check. By writing a custom check function that applies "default_tags" to "tags" before 
        
           // the Terraform provider sees any resource configuration, we can give a consistent, 
        
           // reliable and good experience for Pulumi users.

flostadler · 2024-07-08T16:02:29Z

What if we just create a test for each of the scenarios Anton mentioned? I think that should ensure nothing unexpected breaks.
The cli import might be tricky to test, but we can also test that manually if necessary.

VenelinMartinov · 2024-07-08T16:14:14Z

Thanks for the background @corymhall

The cli import might be tricky to test, but we can also test that manually if necessary.

#3859 has an example of importing in a test.

VenelinMartinov · 2024-07-08T18:25:19Z

provider/resources.go

+				return applyTagsOutputs(ctx, config)
+			}
+		} else {
+			prov.Resources[key].TransformOutputs = applyTagsOutputs


Note that TransformOutputs affects Create and Update, not just read - is this intended here?

It's a side effect, but as long as it is true that tags and defaultTags should always be equal then I think we are fine.

…ags-import

flostadler

Is my understanding correct that instead of following terraform's behavior of merging tags and default_tags into tags_all, we manually do the merge and set the result to both tags/tagsAll. Your change is adding that to the read code path as well.

What I'm still missing is why we need all of the special tag handling? In what areas does terraforms tagging fall short? Are we sure that it's still broken (the tests you've added might be good regression tests to check if we still need it)? Those are rather questions for @t0yv0 / @iwahbe I guess.

The change looks good to me, the tests are great! I think we should add some tests for the static get functions as well though.

patches/0038-Restore-legacy-bucket.patch

provider/provider_yaml_test.go

flostadler · 2024-07-11T11:07:56Z

provider/provider_yaml_test.go

+			preImportHook: func(t *testing.T, outputs auto.OutputMap) {
+				t.Helper()
+				resArn := outputs["resArn"].Value.(string)
+				addAppconfigEnvironmentTags(context.Background(), resArn, map[string]string{


Nit: we could generalize this using tag:TagResources which can tag all taggable resources.

provider/tags_test.go

flostadler · 2024-07-11T11:15:53Z

provider/provider_yaml_test.go

+func generateTagsTest(t *testing.T, step tagsTestStep, testPath string, importId string) {
+	template := `name: test-aws-%s
+runtime: yaml
+resources:


We should test the static get functions as well ideally because we're changing the behavior of read

t0yv0 · 2024-07-15T21:40:16Z

I gave this a quick read this is looking pretty good.

Lifecycle testing imports this can add significant peace of mind around the system behavior, excellent 👏
- The correct behavior is probably evident in the logs but asserts could be tightened a bit to make it more precise, namely not only verifying import succeeds but it produces the "desired" program - that is one that when run with pulumi up results in a state with the correct tag set
tags and tagsAll to always be equal that's exactly right; in current Pulumi interpretation tags output is the union of defaultTags and 'proper' tags; and tagsAll is the same thing that's marked deprecated but retained for compat
it is a bit weird that the fix merges tagsAll and tags, instead of merging defaultTags and tags, but it probably accomplishes the same thing because TF might be merging defaultTags and tags to compute tagsAll internally in Read; I did not know we could rely on this since some of our patches disable func (r *ResourceWithConfigure) SetTagsAll and try to remove some of this functionality, but sounds like it is still present? I suspect a more robust fix can be obtained by ignoring tagsAll returned in the outputs and just merging tags and defaultTags?
the question on why not just remove all tags-related patches is a good one, I see it's tracked in Tracking: remove tags related patches #4230 - this would be desirable but during last audit there still were open upstream issues; once we have a more comprehensive test suite that passes that'd be preferable to doing the work in the wrapped provider

corymhall · 2024-07-16T12:37:18Z

@t0yv0

The correct behavior is probably evident in the logs but asserts could be tightened a bit to make it more precise, namely not only verifying import succeeds but it produces the "desired" program

That's a good idea, i'll work on adding that.

once we have a more comprehensive test suite that passes that'd be preferable to doing the work in the wrapped provider

This is one of my big questions - what kind of tests do we need to add in order to be confident of the changes?

I suspect a more robust fix can be obtained by ignoring tagsAll returned in the outputs and just merging tags and defaultTags?

This might be more inline with the current PreCheckCallback hook, but we currently do not get the defaultTags from config in the TransformOutputs. Should we create a new PostReadCallback hook in the bridge to cover this scenario?

corymhall · 2024-07-16T17:49:26Z

@t0yv0

The correct behavior is probably evident in the logs but asserts could be tightened a bit to make it more precise, namely not only verifying import succeeds but it produces the "desired" program

I'm actually not sure that it is possible to generate the desire program. I think we can choose to have pulumi up (with import) work or have pulumi import generate a correct program, but not both.

In the current state (before this PR):

pulumi import generates the program based on Read (where tags != tagsAll)

{
  "method": "/pulumirpc.ResourceProvider/Read",
  "request": {},
  "response": {
    "inputs": {
      "tags": {
        "LocalTag": "foo"
      },
      "tagsAll": {
        "GlobalTag": "bar",
        "LocalTag": "foo"
      }
    }
  }
}

pulumi up performs the diff based on the response from Read vs the response from Check (which is setting tags=tagsAll)

{
  "method": "/pulumirpc.ResourceProvider/Check",
  "request": {...},
  "response": {
    "inputs": {
      "tags": {
        "GlobalTag": "bar",
        "LocalTag": "foo"
      },
      "tagsAll": {
        "GlobalTag": "bar",
        "LocalTag": "foo"
      }
    }
  }
}

So we have two options:

Have tags != tagsAll in order for pulumi import to generate the correct program
Have tags == tagsAll in order for pulumi up to import successfully

iwahbe · 2024-07-16T18:11:53Z

We need the special tags handling because terraform-provider-aws's native tags handling relies on refresh for correctness, and so doesn't work for most Pulumi users.

corymhall · 2024-07-16T18:37:54Z

We need the special tags handling because terraform-provider-aws's native tags handling relies on refresh for correctness, and so doesn't work for most Pulumi users.

@iwahbe can you expand on what this means?

…ags-import

Upgrade pu/pu to 3.124.0

iwahbe · 2024-07-18T19:46:44Z

We need the special tags handling because terraform-provider-aws's native tags handling relies on refresh for correctness, and so doesn't work for most Pulumi users.

@iwahbe can you expand on what this means?

I expanded a bit here: #4230 (comment).

Basically, if you run terraform apply -refresh=false then default tags do not work as expected (they don't delete, or they don't add...). This has improved since we last looked at it, but a cursory test shows that major functionality still doesn't work as expected.

t0yv0 · 2024-07-23T13:07:13Z

provider/provider_yaml_test.go

+				})
+				bucketName := outputs["id"].Value.(string)
+				tags := getBucketTagging(context.Background(), bucketName)
+				assert.Subset(t, tags, []types.Tag{


Subset and not Equal? Why? Interesting.

t0yv0 · 2024-07-23T13:12:01Z

examples/examples_go_test.go

 				bucketName := stack.Outputs["bucket-name"].(string)
 				st.assertTagsEqualWithRetry(t,
 					fetchBucketTags(bucketName),
 					"bad bucket tags")
 			}
 			if k == "legacy-bucket" {
+				// getTags := stack.Outputs["get-legacy-bucket"].(string)


Are these comments still useful?

Added another comment with link to the issue. When the issue is fixed the code can be uncommented.

t0yv0 · 2024-07-23T13:12:47Z

examples/tags-combinations-go/main.go

+			return err
+		}
+
+		// refresh doesn't work for `forceDelete` & `acl` uncomment when fixed


This is interesting, is this something worth linking a ticket to? Thank you.

Added another comment with link to the issue.

pulumi-bot · 2024-07-23T20:12:45Z

This PR has been shipped in release v6.45.2.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@pulumi/aws](https://pulumi.io) ([source](https://togithub.com/pulumi/pulumi-aws)) | dependencies | minor | [`6.45.0` -> `6.46.0`](https://renovatebot.com/diffs/npm/@pulumi%2faws/6.45.0/6.46.0) | --- ### Release Notes <details> <summary>pulumi/pulumi-aws (@pulumi/aws)</summary> ### [`v6.46.0`](https://togithub.com/pulumi/pulumi-aws/releases/tag/v6.46.0) [Compare Source](https://togithub.com/pulumi/pulumi-aws/compare/v6.45.2...v6.46.0) ##### Does the PR have any schema changes? Found 8 breaking changes: ##### Resources - `🟢` "aws:elasticache/replicationGroup:ReplicationGroup": required inputs: "description" input has changed to Required ##### Types - `🟢` "aws:bedrock/AgentAgentAliasRoutingConfiguration:AgentAgentAliasRoutingConfiguration": required: "provisionedThroughput" property has changed to Required - `🟡` "aws:ecs/ServiceVolumeConfigurationManagedEbsVolume:ServiceVolumeConfigurationManagedEbsVolume": properties: "throughput" type changed from "string" to "integer" - "aws:kinesis/FirehoseDeliveryStreamRedshiftConfiguration:FirehoseDeliveryStreamRedshiftConfiguration": required: - `🟢` "password" property is no longer Required - `🟢` "username" property is no longer Required - "aws:kinesis/FirehoseDeliveryStreamSnowflakeConfiguration:FirehoseDeliveryStreamSnowflakeConfiguration": required: - `🟢` "privateKey" property is no longer Required - `🟢` "user" property is no longer Required - `🟢` "aws:kinesis/FirehoseDeliveryStreamSplunkConfiguration:FirehoseDeliveryStreamSplunkConfiguration": required: "hecToken" property is no longer Required ##### New resources: - `datazone/project.Project` - `grafana/workspaceServiceAccount.WorkspaceServiceAccount` - `grafana/workspaceServiceAccountToken.WorkspaceServiceAccountToken` - `rds/certificate.Certificate` - `rekognition/streamProcessor.StreamProcessor` ##### New functions: - `cloudfront/getOriginAccessControl.getOriginAccessControl` - `timestreamwrite/getDatabase.getDatabase` - `timestreamwrite/getTable.getTable` ##### What's Changed - Upstream v5.59.0 by [@t0yv0](https://togithub.com/t0yv0) in [pulumi/pulumi-aws#4295 **Full Changelog**: pulumi/pulumi-aws@v6.45.2...v6.46.0 ### [`v6.45.2`](https://togithub.com/pulumi/pulumi-aws/releases/tag/v6.45.2) [Compare Source](https://togithub.com/pulumi/pulumi-aws/compare/v6.45.0...v6.45.2) ##### Does the PR have any schema changes? Looking good! No breaking changes found. No new resources/functions. ##### What's Changed ##### Fixes - Fix import resources with provider default tags by [@corymhall](https://togithub.com/corymhall) in [pulumi/pulumi-aws#4169 ##### Dependencies - Upgrade pulumi-terraform-bridge to v3.87.0 by [@pulumi-bot](https://togithub.com/pulumi-bot) in [pulumi/pulumi-aws#4240 ##### Internal - Rewrite GameLift regression test into TypeScript by [@t0yv0](https://togithub.com/t0yv0) in [pulumi/pulumi-aws#4285 - Update GitHub Actions workflows. by [@pulumi-bot](https://togithub.com/pulumi-bot) in [pulumi/pulumi-aws#4290 **Full Changelog**: pulumi/pulumi-aws@v6.45.1...v6.45.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: lumiere-bot[bot] <98047013+lumiere-bot[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@pulumi/aws](https://pulumi.io) ([source](https://togithub.com/pulumi/pulumi-aws)) | dependencies | minor | [`6.45.0` -> `6.46.0`](https://renovatebot.com/diffs/npm/@pulumi%2faws/6.45.0/6.46.0) | --- ### Release Notes <details> <summary>pulumi/pulumi-aws (@pulumi/aws)</summary> ### [`v6.46.0`](https://togithub.com/pulumi/pulumi-aws/releases/tag/v6.46.0) [Compare Source](https://togithub.com/pulumi/pulumi-aws/compare/v6.45.2...v6.46.0) ##### Does the PR have any schema changes? Found 8 breaking changes: ##### Resources - `🟢` "aws:elasticache/replicationGroup:ReplicationGroup": required inputs: "description" input has changed to Required ##### Types - `🟢` "aws:bedrock/AgentAgentAliasRoutingConfiguration:AgentAgentAliasRoutingConfiguration": required: "provisionedThroughput" property has changed to Required - `🟡` "aws:ecs/ServiceVolumeConfigurationManagedEbsVolume:ServiceVolumeConfigurationManagedEbsVolume": properties: "throughput" type changed from "string" to "integer" - "aws:kinesis/FirehoseDeliveryStreamRedshiftConfiguration:FirehoseDeliveryStreamRedshiftConfiguration": required: - `🟢` "password" property is no longer Required - `🟢` "username" property is no longer Required - "aws:kinesis/FirehoseDeliveryStreamSnowflakeConfiguration:FirehoseDeliveryStreamSnowflakeConfiguration": required: - `🟢` "privateKey" property is no longer Required - `🟢` "user" property is no longer Required - `🟢` "aws:kinesis/FirehoseDeliveryStreamSplunkConfiguration:FirehoseDeliveryStreamSplunkConfiguration": required: "hecToken" property is no longer Required ##### New resources: - `datazone/project.Project` - `grafana/workspaceServiceAccount.WorkspaceServiceAccount` - `grafana/workspaceServiceAccountToken.WorkspaceServiceAccountToken` - `rds/certificate.Certificate` - `rekognition/streamProcessor.StreamProcessor` ##### New functions: - `cloudfront/getOriginAccessControl.getOriginAccessControl` - `timestreamwrite/getDatabase.getDatabase` - `timestreamwrite/getTable.getTable` ##### What's Changed - Upstream v5.59.0 by [@t0yv0](https://togithub.com/t0yv0) in [pulumi/pulumi-aws#4295 **Full Changelog**: pulumi/pulumi-aws@v6.45.2...v6.46.0 ### [`v6.45.2`](https://togithub.com/pulumi/pulumi-aws/releases/tag/v6.45.2) [Compare Source](https://togithub.com/pulumi/pulumi-aws/compare/v6.45.0...v6.45.2) ##### Does the PR have any schema changes? Looking good! No breaking changes found. No new resources/functions. ##### What's Changed ##### Fixes - Fix import resources with provider default tags by [@corymhall](https://togithub.com/corymhall) in [pulumi/pulumi-aws#4169 ##### Dependencies - Upgrade pulumi-terraform-bridge to v3.87.0 by [@pulumi-bot](https://togithub.com/pulumi-bot) in [pulumi/pulumi-aws#4240 ##### Internal - Rewrite GameLift regression test into TypeScript by [@t0yv0](https://togithub.com/t0yv0) in [pulumi/pulumi-aws#4285 - Update GitHub Actions workflows. by [@pulumi-bot](https://togithub.com/pulumi-bot) in [pulumi/pulumi-aws#4290 **Full Changelog**: pulumi/pulumi-aws@v6.45.1...v6.45.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: lumiere-bot[bot] <98047013+lumiere-bot[bot]@users.noreply.github.com>

corymhall added 2 commits July 3, 2024 08:38

skip test

e573c99

corymhall commented Jul 3, 2024

View reviewed changes

provider/tags.go Show resolved Hide resolved

fixing test

0063967

corymhall self-assigned this Jul 3, 2024

corymhall requested review from t0yv0 and flostadler July 3, 2024 15:24

t0yv0 reviewed Jul 3, 2024

View reviewed changes

flostadler reviewed Jul 3, 2024

View reviewed changes

corymhall marked this pull request as draft July 3, 2024 18:28

VenelinMartinov reviewed Jul 8, 2024

View reviewed changes

corymhall added 3 commits July 10, 2024 13:23

Adding more tests

18cc1c4

Merge remote-tracking branch 'origin/master' into corymhall/default-t…

892e985

…ags-import

Add a note

e24dbfa

corymhall marked this pull request as ready for review July 10, 2024 17:36

corymhall requested a review from flostadler July 10, 2024 17:44

corymhall added 2 commits July 10, 2024 15:29

trying to fix upstream

7852b77

run go mod tidy

28ff3a5

flostadler reviewed Jul 11, 2024

View reviewed changes

adding parallel to tests

9095918

corymhall marked this pull request as draft July 12, 2024 12:59

t0yv0 mentioned this pull request Jul 15, 2024

Tracking: remove tags related patches #4230

Open

corymhall added 4 commits July 18, 2024 10:25

adding pf tests to some additional tags tests

25b4b15

Merge remote-tracking branch 'origin/master' into corymhall/default-t…

d4c01b7

…ags-import

adding test for .get methods

185f434

Upgrade pu/pu to 3.124.0

run go mod tidy

e84e096

corymhall marked this pull request as ready for review July 19, 2024 14:13

corymhall requested review from t0yv0 and flostadler July 19, 2024 14:15

corymhall mentioned this pull request Jul 22, 2024

Revisit import issues #3875

Open

Merge branch 'master' into corymhall/default-tags-import

5fe2ef0

t0yv0 reviewed Jul 23, 2024

View reviewed changes

t0yv0 approved these changes Jul 23, 2024

View reviewed changes

updating based on comments

8c72e64

corymhall merged commit 21194dc into master Jul 23, 2024
30 checks passed

corymhall deleted the corymhall/default-tags-import branch July 23, 2024 17:13

This was referenced Jul 23, 2024

Cannot import resources when provider has default tags #4030

Closed

Refresh shows permanent diff for tagsAll in pulumi@3.120.0 #4080

Closed

Tags not read when importing with defaultTags #3311

Closed

mjeffryes added this to the 0.107 milestone Jul 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix import resources with provider default tags #4169

Fix import resources with provider default tags #4169

corymhall commented Jul 3, 2024 •

edited

Loading

github-actions bot commented Jul 3, 2024 •

edited

Loading

t0yv0 Jul 3, 2024

flostadler Jul 3, 2024

t0yv0 Jul 3, 2024

t0yv0 commented Jul 3, 2024 •

edited

Loading

t0yv0 commented Jul 3, 2024

t0yv0 commented Jul 3, 2024

corymhall commented Jul 8, 2024

VenelinMartinov commented Jul 8, 2024

corymhall commented Jul 8, 2024

flostadler commented Jul 8, 2024

VenelinMartinov commented Jul 8, 2024

VenelinMartinov Jul 8, 2024

corymhall Jul 10, 2024

flostadler left a comment

flostadler Jul 11, 2024

corymhall Jul 15, 2024

flostadler Jul 11, 2024

corymhall Jul 19, 2024

t0yv0 commented Jul 15, 2024

corymhall commented Jul 16, 2024

corymhall commented Jul 16, 2024

iwahbe commented Jul 16, 2024

corymhall commented Jul 16, 2024

iwahbe commented Jul 18, 2024

t0yv0 Jul 23, 2024

corymhall Jul 23, 2024

t0yv0 Jul 23, 2024

corymhall Jul 23, 2024

t0yv0 Jul 23, 2024

corymhall Jul 23, 2024

pulumi-bot commented Jul 23, 2024

Fix import resources with provider default tags #4169

Fix import resources with provider default tags #4169

Conversation

corymhall commented Jul 3, 2024 • edited Loading

github-actions bot commented Jul 3, 2024 • edited Loading

Does the PR have any schema changes?

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

t0yv0 commented Jul 3, 2024 • edited Loading

Case 1: pulumi import on the CLI

Case 2: import with resource option

Case 3: pulumi refresh

Case 4: Bucket.get()

t0yv0 commented Jul 3, 2024

t0yv0 commented Jul 3, 2024

corymhall commented Jul 8, 2024

Example

VenelinMartinov commented Jul 8, 2024

corymhall commented Jul 8, 2024

flostadler commented Jul 8, 2024

VenelinMartinov commented Jul 8, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

flostadler left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

t0yv0 commented Jul 15, 2024

corymhall commented Jul 16, 2024

corymhall commented Jul 16, 2024

iwahbe commented Jul 16, 2024

corymhall commented Jul 16, 2024

iwahbe commented Jul 18, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pulumi-bot commented Jul 23, 2024

corymhall commented Jul 3, 2024 •

edited

Loading

github-actions bot commented Jul 3, 2024 •

edited

Loading

t0yv0 commented Jul 3, 2024 •

edited

Loading