BucketLifecycleConfigurationV2 is detected as requiring an update even though nothing changed

[spock-yh]

What happened?

I am creating a BucketLifecycleConfigurationV2 resource with a set of fixes rules, and attaching it to a bucket. For some reason whenever I run pulumi up it detects the resource as requiring an update due to the rules property being modified, even though it isn't.

Steps to reproduce

Here is the code snippet creating the resource. The logsBucket resource is an aws.s3.Bucket resource previously created, and it is not updated or recreated in these subsequent pulumi up runs. I do have additional resources in the project that are being created or update in these runs, but the lifecycle configuration isn't being changed.

new aws.s3.BucketLifecycleConfigurationV2('website-logs-lifecycle', {
    bucket: logsBucket.bucket,
    rules: [
      {
        id: 'IA-30d_GlacierIR-90d_expire-1y',
        status: 'Enabled',
        abortIncompleteMultipartUpload: {
          daysAfterInitiation: 30,
        },
        expiration: {
          days: 365,
          expiredObjectDeleteMarker: true,
        },
        noncurrentVersionExpiration: {
          noncurrentDays: 365,
        },
        transitions: [
          {
            days: 30,
            storageClass: 'STANDARD_IA',
          },
          {
            days: 90,
            storageClass: 'GLACIER_IR',
          },
        ],
        noncurrentVersionTransitions: [
          {
            noncurrentDays: 30,
            storageClass: 'STANDARD_IA',
          },
          {
            noncurrentDays: 90,
            storageClass: 'GLACIER_IR',
          },
        ],
      },
    ],
  });

Expected Behavior

The lifecycle configuration resource should not be updated if there is no change to the rules or attached bucket.

Actual Behavior

The lifecycle configuration is marked for update due to diff in the rules ([diff: ~rules])

Output of pulumi about

CLI Version 3.39.1 Go Version go1.19 Go Compiler gc

Plugins NAME VERSION aws 5.13.0 docker 3.4.1 nodejs unknown

Host OS Microsoft Windows 11 Home Version 10.0.22000 Build 22000 Arch x86_64

This project is written in nodejs: executable='C:\Program Files\nodejs\node.exe' version='v16.17.0'

Current Stack: dev

TYPE URN pulumi:pulumi:Stack urn:pulumi:dev::website::pulumi:pulumi:Stack::website-dev pulumi:providers:aws urn:pulumi:dev::website::pulumi:providers:aws::default_5_13_0 aws:s3/bucketV2:BucketV2 urn:pulumi:dev::website::aws:s3/bucketV2:BucketV2::website-logs aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2 urn:pulumi:dev::website::aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2::website-logs-lifecycle

Found no pending operations associated with dev

Backend Name pulumi.com URL https://app.pulumi.com/spock_abadai User spock_abadai Organizations spock_abadai

Pulumi locates its logs in C:\Users\yhspo\AppData\Local\Temp by default warning: Failed to get information about the Pulumi program's dependencies: Found C:\dev\abadai\website\pulumi\package-lock.json but not npm: unable to find program: npm.exe

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[iwahbe]

Hey @spock-yh, thanks for bringing this to our attention. ~Could you run this again and send us a detailed diff for the update. What command are using to run pulumi, and specifically does it have a --refresh flag?~

[iwahbe]

I'm able to reproduce the issue with only:

import * as aws from "@pulumi/aws";

const logsBucket = new aws.s3.Bucket("i-bucket", {}, {});

new aws.s3.BucketLifecycleConfigurationV2("website-logs-lifecycle", {
  bucket: logsBucket.bucket,
  rules: [
    {
      id: "IA-30d_GlacierIR-90d_expire-1y",
      status: "Enabled",
      expiration: {
        days: 365,
        expiredObjectDeleteMarker: true,
      },
    },
  ],
});

[iwahbe]

@spock-yh It looks like the bridged TF provider doesn't allow specifying both days and expiredObjectDeleteMarker. Doing so results in spurious diffs, as you experienced. The solution is to specify only days or expiredObjectDeleteMarker, but not both. Sorry for the confusion.

[viveklak]

The issue seems to be reported on the upstream Terraform provider as well: https://github.com/hashicorp/terraform-provider-aws/issues/11733. As Ian mentioned, the solution might be to drop one of the conflicting fields. We will track improvements to the new decomposed bucket resources in pulumi/pulumi#11740.