Hello, I need some help. Im getting this error with Github actions:

getting credentials: exec plugin is configured to use API version <http://client.authentication.k8s.io/v1beta1|client.authentication.k8s.io/v1beta1>, plugin returned version <http://client.authentication.k8s.io/v1alpha1|client.authentication.k8s.io/v1alpha1>

Any walkaround of how to solve this ?

hi all, i'm using pulumi to launch more aws EC2 instances with user data script... it will hanging at pulumi up state for more instances ... sometimes can work for more machine, sometime can only works for few machine ... and it didnt tell any error issue ... Is anyone know any issue about this?

I'm trying to integrate DataDog serverless with my lambda function to send custom metrics but I keep getting

{
  "status": "error",
  "message": "datadog:handler not initialized"
}

Hello, When creating an EKS managed nodegroup, its ami role must be first set at the cluster level. Why is it needed? I did not find it in the documentation, only that it is enforced in the EKS node library.

If I destroy a stack that uses getVpcFromId, will the destroy also include destroying the VPC?

This message was deleted.

Does anyone have an example of sharing a VPC across micro-stacks? The few examples I've found are not using the outputs to initialize any new resources. It doesn't seem to matter if I

get

,

apply

, or anything I try I can't get the outputs of one stack to do anything relevant on another. Side note, I'm having a hard time understanding why the Type of an output pulled from a StackRef is treated the same as the unresolved outputs in the working stack. The StackRef stack by definition has been applied, all of those output values are known, otherwise Pulumi rightly throws an error.

Hey Guys I was setting up EKS with managed node groups and I followed the blog https://www.pulumi.com/blog/aws-eks-managed-nodes-fargate/ to do this. The blog says the ec2 instances are automatically scaled up and down based on traffic(or is what I understand from reading the blog). However AWS managed node group doesn't do that on their own and require a cluster auto scaler. I am wondering if the latter is true for the managed node group created via pulumi or is crossrails doing some magic and setting up a cluster auto scaler.

I am using

awsx.ecs.FargateTaskDefinition

to setup the task definition. Now I want to use cpuArchitecture: ARM64 because its better. But it seems that I have to switch over to

aws.ecs.TaskDefinition

to be able to set it. By doing that I also have to change how I setup the service (

awsx.ecs.FargateService

) because it needs to be

awsx.ecs.FargateTaskDefinition

. Am i missing something or is it that once that I want to go outside of the AWSX(crosswalk) scope I need to change all related services to AWS? Is there a work-around or something I’am missing?

I have created an S3 bucket to use with a MWAA environment. When I run pulumi up, pulumi wants to delete and recreate the bucket:

+  aws:s3:Bucket aaa creating
+  aws:s3:Bucket aaa creating error: 1 error occurred:
+  aws:s3:Bucket aaa **creating failed** error: 1 error occurred:

Diagnostics:
  aws:s3:Bucket (aaa):
    error: 1 error occurred:
    	* Error creating S3 bucket: BucketAlreadyOwnedByYou: Your previous request to create the named bucket succeeded and you already own it.
    	status code: 409, request id: Q3A6YB3N22Y5T7WW, host id: huiDWKeYcWdOUbIIjq/h4RlUSNCXA1yQG0l85af5uXLaZpVFsnHXVD5lUkP0QRmGTiPFLajBiwo=

How can I tell pulumi to recognise the existing bucket so that it doesn’t try to delete and recreate it? I get the same error when I run pulumi locally (v3.32.1) and through a github action (v3.31.0)

trying to use the ALB controller for ingress, https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/ but im having a problem because it involves adding a CRD file aside from the helm chart.

currently i have two clusters running in pulumi stack and because the URN takes the name of the resource in the yaml file, i’m unable to create a second copy on the second kubenetes cluster it seems, can i just modify the resource name in the CRD? or is there a workaround to change the URN?

Hello. We have been fairly frequently (on a % of deployment basis) hit by an issue whereby layer versions, source code uploaded to s3 after a manual deployment step, associated with an aws lambda function. I've been very casually documenting occurrences of this issue and have noticed a correlation between in-pulumi-deployment failures (such as due to an aws service validation message, auth issue, or other deployment error unrelated to the specific resources we have issues with) and this issue happening in the a subsequent successful deployment. How do we perceive the issue? Lambda functions appear to be running out-of-date code from a previous version How do we spot it? Typically runtime code is out-of-sync with database schema and we see runtime sql errors Observation #1: The latest version of the source code IS uploaded as a new version of a s3.BucketObject Observation #2: A new lambda.LayerVersion replacement IS created successfully Observation #3: Our lambda is dependent upon the lambda.LayerVersion and a db migration task. If that migration task fails, we've updated the LayerVersion but the lambda.Function update will not happen because db is not ready and a dependency has been rejected. Observation #4: When we fix the other dependent issue and get a successful deployment we see the issues described above. It would seem that, although logs indicate our lambda.Function was updated, it did not get given the correct (newly, validated to be uploaded) lambda.LayerVersion - perhaps because some bad state exists from the failed deployment I have previously raised some issues with how the pulumi implementation of asset hashing, it's state persistance, and it's interplay with aws s3 (most notably where terraform provider

sourceHash

cannot be overridden) and I have a feeling that we're seeing the issue again here. Has anyone seen this? Has anyone resolved this?

Is anyone having issues related to the aws-lambda node package? I am getting several errors across multiple projects. Though some errors are different, the issue remains the same. This occurs when trying to run 'npm run build'. Not sure if it is a mismatch of typescript or a recently updated node package. node_modules/@types/aws-lambda/trigger/cloudfront-request.d.ts113 - error TS1005: '=' expected. 1 import type { CloudFrontEvent, CloudFrontRequest, CloudFrontResultResponse } from "../common/cloudfront"; node_modules/@types/aws-lambda/trigger/cloudfront-request.d.ts183 - error TS1005: ';' expected. 1 import type { CloudFrontEvent, CloudFrontRequest, CloudFrontResultResponse } from "../common/cloudfront"; node_modules/@types/aws-lambda/trigger/cloudfront-request.d.ts213 - error TS1005: '=' expected. 2 import type { Handler, Callback } from "../handler"; node_modules/@types/aws-lambda/trigger/cloudfront-request.d.ts240 - error TS1005: ';' expected. 2 import type { Handler, Callback } from "../handler";

I am getting what I think is an underlying TF error during preview when I

pulumi up

that is associated with the

aws.apigateway.VpcLink()

resource.

Diagnostics:
  aws:apigateway:VpcLink (testing-alb-vpc-link):
    error: Preview failed: error reading from server: EOF
 
  pulumi:pulumi:Stack (bioinfo-tools-app-infra-testing):
    panic: Error reading level config: '' expected type 'string', got unconvertible type '[]interface {}', value: '[74D93920-ED26-11E3-AC10-0800200C9A66]'
    goroutine 31 [running]:
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).get(0xc001ffa100|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).get(0xc001ffa100>, 0xc002185be0, 0x1, 0x1, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/resource_data.go:553 +0x429
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).getChange(0xc001ffa100|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).getChange(0xc001ffa100>, 0x79f2a96, 0xb, 0xc002df1201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/resource_data.go:524 +0x125
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).diffChange(0xc001ffa100|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*ResourceData).diffChange(0xc001ffa100>, 0x79f2a96, 0xb, 0xb, 0x0, 0x0, 0x1, 0xc00090e540)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/resource_data.go:501 +0x97
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.diffList(0xc000f73380|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.diffList(0xc000f73380>, 0x79f2a96, 0xb, 0xc000f9f040, 0xc001b71278, 0x853c770, 0xc001ffa100, 0x203000, 0x0, 0x0)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/schema.go:997 +0x66
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.diff(0xc000f73380|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.diff(0xc000f73380>, 0x79f2a96, 0xb, 0xc000f9f040, 0xc001f719a0, 0x853c770, 0xc001ffa100, 0xc002df7400, 0x0, 0x0)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/schema.go:958 +0x473
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.Diff(0xc000f73380|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.schemaMap.Diff(0xc000f73380>, 0x85220d8, 0xc0000500d0, 0x0, 0xc001fbbc50, 0x0, 0x6c87740, 0xc0020d8000, 0xc001936900, 0xc001fbbc20, ...)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/schema.go:521 +0x219
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).SimpleDiff(0xc000fa0000|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).SimpleDiff(0xc000fa0000>, 0x85220d8, 0xc0000500d0, 0x0, 0xc001fbbc50, 0x6c87740, 0xc0020d8000, 0x0, 0x0, 0xc000011040)
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20201218231525-9cca98608a5e/helper/schema/resource.go:446 +0x9f
    <http://github.com/pulumi/pulumi-terraform-bridge/v2/pkg/tfshim/sdk-v2.v2Provider.Diff(0xc001936960|github.com/pulumi/pulumi-terraform-bridge/v2/pkg/tfshim/sdk-v2.v2Provider.Diff(0xc001936960>, 0x7a475e2, 0x18, 0x0, 0x0, 0x8466f80, 0xc001fbbc50, 0x8466f80, 0xc001fbbc50, 0xc001fbbbc0, ...)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v2@v2.21.0/pkg/tfshim/sdk-v2/provider.go:99 +0x1cc
    <http://github.com/pulumi/pulumi-terraform-bridge/v2/pkg/tfbridge.(*Provider).Create(0xc00000ab40|github.com/pulumi/pulumi-terraform-bridge/v2/pkg/tfbridge.(*Provider).Create(0xc00000ab40>, 0x8522148, 0xc001fbbb00, 0xc001fbe820, 0xc00000ab40, 0x6beba01, 0xc001fc1fc0)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v2@v2.21.0/pkg/tfbridge/provider.go:772 +0x508
    <http://github.com/pulumi/pulumi/sdk/v2/proto/go._ResourceProvider_Create_Handler.func1(0x8522148|github.com/pulumi/pulumi/sdk/v2/proto/go._ResourceProvider_Create_Handler.func1(0x8522148>, 0xc001fbbb00, 0x776f4c0, 0xc001fbe820, 0x77cbf00, 0xc6decc0, 0x8522148, 0xc001fbbb00)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v2@v2.22.1-0.20210310211618-1f16423ede4c/proto/go/provider.pb.go:2269 +0x89
    <http://github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc.OpenTracingServerInterceptor.func1(0x8522148|github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc.OpenTracingServerInterceptor.func1(0x8522148>, 0xc001fbba70, 0x776f4c0, 0xc001fbe820, 0xc001f71860, 0xc001fabe90, 0x0, 0x0, 0x8452aa0, 0xc000444b20)
        /home/runner/go/pkg/mod/github.com/grpc-ecosystem/grpc-opentracing@v0.0.0-20180507213350-8e809c8a8645/go/otgrpc/server.go:57 +0x30a
    <http://github.com/pulumi/pulumi/sdk/v2/proto/go._ResourceProvider_Create_Handler(0x78cf740|github.com/pulumi/pulumi/sdk/v2/proto/go._ResourceProvider_Create_Handler(0x78cf740>, 0xc00000ab40, 0x8522148, 0xc001fbba70, 0xc001eefc80, 0xc001921900, 0x8522148, 0xc001fbba70, 0xc001f792c0, 0x12c)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v2@v2.22.1-0.20210310211618-1f16423ede4c/proto/go/provider.pb.go:2271 +0x150
    <http://google.golang.org/grpc.(*Server).processUnaryRPC(0xc0006ccc40|google.golang.org/grpc.(*Server).processUnaryRPC(0xc0006ccc40>, 0x8543bf8, 0xc000a5a300, 0xc001e34500, 0xc001a33ec0, 0xc69c8a8, 0x0, 0x0, 0x0)
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.34.0/server.go:1210 +0x52b
    <http://google.golang.org/grpc.(*Server).handleStream(0xc0006ccc40|google.golang.org/grpc.(*Server).handleStream(0xc0006ccc40>, 0x8543bf8, 0xc000a5a300, 0xc001e34500, 0x0)
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.34.0/server.go:1533 +0xd0c
    <http://google.golang.org/grpc.(*Server).serveStreams.func1.2(0xc000a34050|google.golang.org/grpc.(*Server).serveStreams.func1.2(0xc000a34050>, 0xc0006ccc40, 0x8543bf8, 0xc000a5a300, 0xc001e34500)
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.34.0/server.go:871 +0xab
    created by <http://google.golang.org/grpc.(*Server).serveStreams.func1|google.golang.org/grpc.(*Server).serveStreams.func1>
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.34.0/server.go:869 +0x1fd

code snippet that is generating the VpcLink:

load_balancer = aws.lb.LoadBalancer(f'{env}-bta-alb',
    load_balancer_type = "network",
    internal = True,
    security_groups = [load_balancer_security_group.id],
    subnets = [private_subnets[0].id, private_subnets[1].id])

load_balancer_vpc_link = aws.apigateway.VpcLink(f"{env}-alb-vpc-link",
    description="enable apigateway-to-alb connection in private subnets",
    target_arn=[load_balancer.arn])

When I comment out the

VpcLink

the preview runs through. Any guidance on how to debug?

When trying to add an authoriser to an api gateway route I get this Error:

updating API Gateway v2 route (ion6q9r): BadRequestException: Invalid authorizer ID specified. Setting the authorization type to CUSTOM or COGNITO_USER_POOLS requires a valid authorizer.

If I set it up manually it works, but doesn’t through pulumi. Any idea why?``

const authorizer = await aws.lambda.getFunction({
  functionName: 'testAuth',
 });

 const route = new aws.apigatewayv2.Route(`${STACK_NAME}-route`, {
  authorizerId: authorizer.id,
  authorizationType: 'CUSTOM',
  routeKey: 'ANY /{id}/recpies/{recipeId}',
  apiId: httpApi.id,
  target: pulumi.interpolate`integrations/${integration.id}`,
 });

``````

hey all, just learned about policy documents and how if we don't json.stringify the docs when inlining it in a RolePolicy args, pulumi will do this for you. This has an advantage of allowing you to use Pulumi Input/Output types in policy documents too. However, I don't see any documentation for this, and I was wondering if anyone had seen one or if it's something that was rolled out recently and is in some blog post?

I'd like to learn more about the inner working of this, and the details of how the pulumi engine takes in a typescript script defining resources, and updates the state, and the lifecycle of the resource definitions when you first do

pulumi up

Hey all, I’m trying to add tags to a subnet that being used by my EKS cluster (That also created by the same pulumi stack). When i’m using

const subnet = aws.ec2.Subnet.get()

, I can’t update its tags as

tags

attribute is readonly. Does anyone know how to overcome this and update its tags ?

When I try to create new EKS 1.22 cluster, I'm getting. Did an update for all my dependencies and also aws-cli. There is an issue https://github.com/pulumi/pulumi-eks/pull/701/files but it's merged, and I don't know how to check if this was released.

Diagnostics:
  eks:index:VpcCni (test-swa-vpc-cni):
    error: Command failed: kubectl apply -f /tmp/tmp-4006Qk4Ya2zxgl1O.tmp
    Kubeconfig user entry is using deprecated API version <http://client.authentication.k8s.io/v1alpha1|client.authentication.k8s.io/v1alpha1>. Run 'aws eks update-kubeconfig' to update.
    Warning: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key: <http://beta.kubernetes.io/os|beta.kubernetes.io/os> is deprecated since v1.14; use "<http://kubernetes.io/os|kubernetes.io/os>" instead
    Warning: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[1].key: <http://beta.kubernetes.io/arch|beta.kubernetes.io/arch> is deprecated since v1.14; use "<http://kubernetes.io/arch|kubernetes.io/arch>" instead
    error: unable to recognize "/tmp/tmp-4006Qk4Ya2zxgl1O.tmp": no matches for kind "CustomResourceDefinition" in version "<http://apiextensions.k8s.io/v1beta1|apiextensions.k8s.io/v1beta1>"

Is there a way to add a mapping template to an AWSX API gateway? I have a lambda that needs to work with direct invocations, and API gateway integrations.

I'm encountering an error that is almost certainly a bug with the aws-native provider. I have an IPSet with a single tag applied and it works but subsequent updates fail with the following error:

aws-native:wafv2:IPSet (dev-whitelist-global):
    error: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: a6668364-2888-479c-8e12-8c0179ccc795, api error ValidationException: Model validation failed (#/Tags: expected minimum item count: 1, found: 0)

In order to get around this, I need to comment out the tags and it works for one deploy. Then on the next deploy that updates the IPSet it fails with the same error and I need to uncomment the tags for it to succeed and the cycle repeats. The tags are just

[
  {
    key: 'env',
    value: 'development',
  },
]

o/ is there any timeline for the upgrade to v4.12.0 of terraform aws provider?

Hello all

Hey guys, I am having trouble importing a transit gateway route using

pulumi import aws:ec2transitgateway/route:Route example tgw-rtb-12345278_10.150.8.0/21

I keep getting "resource does not exist", is there something I am missing here?

Is there any documentation on how to inspect cookie contents with wafv2? Using the AWS UI I can create a rule group that matches the

Cookies

field but https://www.pulumi.com/registry/packages/aws/api-docs/wafv2/webacl/#webaclrulestatementbytematchstatementfieldtomatch defines no such field. Also that page in the documentation is so long that it causes problems for both Chrome and Firefox 😆. Here's the full JSON of an example rule in the AWS UI:

{
  "Name": "test-rule",
  "Priority": 0,
  "Action": {
    "Allow": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "test-rule"
  },
  "Statement": {
    "OrStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "FieldToMatch": {
              "Cookies": {
                "MatchScope": "ALL",
                "MatchPattern": {
                  "IncludedCookies": [
                    "test-cookie-123"
                  ]
                },
                "OversizeHandling": ""
              }
            },
            "PositionalConstraint": "EXACTLY",
            "SearchString": "testvalue123",
            "TextTransformations": [
              {
                "Type": "NONE",
                "Priority": 0
              }
            ]
          }
        },
        {}
      ]
    }
  }
}

Hi there! I have a strange problem I tryied to googled but could not found solution so far. Here my context: I imported IAM User and Group. As I'm at the import step the first time I run pulumi it raise error as I may don't have the correct policy to make the action, so first time it fail then I update my policy, run it again and my data are imported correctly. So first I go with User and on first call it fail as I did not have "iam:GetUser" so I add it and then run again and no problem my users are imported. 🎉 Next I import Group and same as user it fail so I add "iam:GetGroup" and run again but here it became weird I have error message asking to update the name of my group to append a random string, then always fail. My problem: Each time I run "pulumi up" pulumi tell me that I have update for the group (I have a total of 4 groups) 4 times something like: ~ awsiam/groupGroup: (update) 🔒 ..... ~ name: "app-e7195e2" => "app-2482515 If I say yes it fail as the app-e7195e2 group don't exist. The real name when I first import was "app" and did not change. And each time I have a different random string after name of the group... If somebody have an idea or suggestion to solve this case, It will be very helpful. Thank for any help.

so i have an

awsx

VPC that i have peered to another VPC and I now want to go and add a route into each of the route tables created by the awsx VPC. I’ve got it working with the below code but wanted to see if there was a cleaner way to do this so the routes don’t need to be created inside an

apply()

Does anyone have any example of creating a cloudwatch anomoly detection alarm with pulumi? Been using awsx exclusively for all metric/alarm needs but can't seem to figure this out.

I’m trying to create a

chatbot

entry, either via importing an existing resource or just creating one “by hand (typescript)” as a test. Both attempts are receiving

400

responses from AWS. Does anyone know if this is actually working right now?