Is there a way to destroy only a resource from a stack? cannot find any option in the docs: https://pulumi.io/reference/cli/pulumi_destroy.html

Does anybody know if there currently is a mechanism to refresh custom dynamic providers that were serialized as part of a stack? I have an error in a delete function and would like to fix it without having to delete everything manually...

How does pulumi treat component resources, is it just that they are displayed as a single item in the plan? Or are there other differences?

How do you use Pulumi to destroy resources like CloudFront distributions (which need to be disabled before they can be destroyed) that require other operations to be preformed before they can be removed. I cannot seem to find a way to add custom destroy logic to a Pulumi stack. Does anyone have experience doing this? (Stackoverflow question here: https://stackoverflow.com/questions/55730860/custom-pulumi-destroy-logic)

Hey, is there a way to implement a custom resource in Javascript/Typescript (assuming it’ll issue REST APIs for creating/updating/deleting resources)? Would be glad if you can refer to any documentation

Hey, I wonder if we can add custom tags (and also IAM) to the AWS node group when creating EKS cluster via pulumi?

Why is

restrictions

a required param in a

aws.cloudfront.DistributionArgs

? https://github.com/pulumi/pulumi-aws/blob/79115d7c86e82662a8e7afe749b81ed22e116b5c/sdk/nodejs/cloudfront/distribution.ts#L680. According to the AWS docs,

restrictions

is not required https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html#API_CreateDistribution_RequestParameters.

Just updated to

"@pulumi/pulumi": "0.17.7",
        "@pulumi/aws": "0.18.1",
        "@pulumi/awsx": "0.18.1"

and I am still getting this error message:

error: Plan apply failed: [WARN] A duplicate Security Group rule was found on (sg-002c2846717345a56). This may be
    a side effect of a now-fixed Terraform issue causing two security groups with
    identical attributes but different source_security_group_ids to overwrite each
    other in the state. See <https://github.com/hashicorp/terraform/pull/2376> for more
    information and instructions for recovery. Error message: the specified rule "peer: 0.0.0.0/0, TCP, from port: 8880, to port: 8880, ALLOW" already exists

The only fix is to go into the AWS console and remove that rule.

After updating awsx to

0.18.1

, Pulumi updates my Fargate task definitions which forces all my

awsx.ecs.FargateService

to redeploy. Is this a known regression?

Does the name that we pass in to resources have to be unique globally, or just unique to the namespace it lives in (eg aws:ec2...)

I revisit the idea of a component registry similar to what terraform is doing with the module registry: https://www.hashicorp.com/blog/hashicorp-terraform-module-registry After all, abstraction using real programing languages is nice but writing the same things all over again without code reuse and sharing is not 😛

I feel that with terraform there was a need for a module registry because modules were in HCL so there was no obvious place for them to live, whereas with pulumi, python/js already have their own native registries

I will try to put it in another way, it's not only the native registry support, is more about the components that you put in there. e.g. maven central is the registry and you put spring boot components in it so people can reuse them and not build the same things again from scratch. I have the feeling now we all build the same components with pulumi and there is no reuse and sharing over a component registry. does it make more sense now?

I think sharing & reuse of components make sense for more complex infrastructures, where you can leverage the contributions and tests that others already did e.g. https://registry.terraform.io/modules/hashicorp/vault/aws/0.12.1

I think the need for a "pulumi" registry depends on if pulumi ends up support lots of languages or if they just fallback to doing just javascript. If it's all just javascript than everyone can just use npm. Maybe just have some common naming scheme like pulumi_my_cool_thing. If we get full multi language support than having a common way to pull in pulumi packages for all languages would be useful.

The whole point of pulumi is to use standard software languages and packaging. So the standard way to package JS/TS is via NPM, the standard for Python is PyPi, and Go is git. If Pulumi want to run their own npm/python/git repos for community modules that’s up to them, but really, it’s not necessary. Terraform use consul and vault as a deployment registry and store, not a development store.

@fresh-pilot-59899 To put things in perspective, you mentioned maven and spring boot as an example of components being shared. Maven is to spring boot what NPM is to Pulumi. There may be few components available at the moment but I think that is probably because Pulumi is still rather new - spring boot on the other hand has been around for years so naturally there are going to be more components available.

@helpful-vegetable-35581 I like the idea of pulumi being multi-language and agnostic regarding packaging. @proud-artist-4864 you have brought a really good explanation. I still see value in the community modules (multi-language and using specific package technologies) and hope this will be adopted as the community grows @gray-elephant-37695 valid point and I hope as the community grows the number community modules will also grow

[AWS] Hey everyone, i'm want to implement a Pulumi resource that creates a Lambda@Edge function that is attached to a Cloudfront distribution and handles

viewer-request

events (the use case being that I want to implement Basic Authentication for a site that is still being prepared for launch). Is there an example around for that exact use case? I've seen a GitHub issue mentioning that use case and that the

aws-ts-static-website

describes using an edge function for a different purpose. If not I will just go from there 😉

I am having an issue with Pulumi resources not being destroyed correctly because dependent resources that need to be destroyed first have not finished. How do you change the order in which items are destroyed and make sure that items wait on the dependent resources to be destroyed first? (Stack details posted in the thread)

> node scripts/install-pulumi-plugin.js resource azure v0.17.4

[resource plugin azure-0.17.4] installing

error: could not load plugin for azure provider 'urn:pulumi:subscription::subscription::pulumi:providers:azure::default': no resource plugin 'azure-v0.17.3' found in the workspace or on your $PATH, install the plugin using `pulumi plugin install resource azure v0.17.3`

any ideas?

i'm referencing a package that says azure: "^0.17.3" but my parent project requires azure: "0.17.4" so they should be compatible surely?

What’s the process for getting new AWS resources in to Pulumi? I’m interested in websocket support from API Gateway v2, but Terraform doesn’t have it yet: https://github.com/terraform-providers/terraform-provider-aws/issues/7004 — I’m considering A) contributing it or B) implementing a dynamic provider or whatever it is called myself on top of the aws apis for the subset i need

Ran into a strange issue:

+  aws:dynamodb:Table madu2-products created 
 +  aws:dynamodb:Table madu2-products **creating failed** error: post-step event returned an error: failed to save snapshot: [403] Forbidden

I'm running into this issue on

new aws.ec2.Instance

- tags are set to lowercase and sometimes converted to snake_case - has this been fixed?

<https://github.com/pulumi/pulumi-terraform/issues/38>

. I'm also seeing a random extra space after my tag value

Working on my first attempt at a dynamic provider / resource. The immediate problem I’ve run in to: It’s very very slow! Just planning an empty dynamic resource (written in typescript) takes about 1min 30sec. That can’t be right… Any ideas?

what’s the right way to forward from an

awsx.elasticloadbalancingv2.ApplicationListener

to a port on an ecs service other than the port that it’s listening on? i.e. the AL listens on port 80 and forwards to port 8081 on the container. I assume you can’t pass the listener itself as an argument to the container’s

portMappings

?

Building a cloudfront distribution with an ACM cert - wondering if it's possible to look up an ACM certificate ARN which is locked to

us-east-1

, but have the distribution live in

us-west-2

. Is there a way to change the region for a bit then switch back for everything else in the code? Not fond of needed to hard-config the cert arn, but that looks like the simplest way? (It's a wildcard cert, so want to be able to use it in any region by lookup)

(using

aws.acm.getCertificate

)