can anybody tell me why the first version works and the second one doesn't?

def setup_s3_read_write_policy(buckets: List[pulumi.Output], project_name: str, instance_role: iam.Role):
    """
    Create a policy to access a list of buckets in R/W mode
    """
    def create_and_attach_policy(args: List) -> None:
        policy = json.dumps(
            {
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Action": ["s3:ListBucket"],
                        "Resource": [f"arn:aws:s3:::{arg}" for arg in args],
                    },
                    {
                        "Effect": "Allow",
                        "Action": "s3:GetObject",
                        "Resource": [f"arn:aws:s3:::{arg}/*" for arg in args],
                    },
                ],
            }
        )
        S3_POLICY_NAME = create_unique_name(f'{project_name}-buckets-policy')
        s3_policy = iam.Policy(S3_POLICY_NAME, policy=policy)
        S3_ROLE_POLICY_ATTACHMENT = create_unique_name(
            f'{project_name}-buckets-role-policy-attachment'
        )
        iam.RolePolicyAttachment(
            S3_ROLE_POLICY_ATTACHMENT, role=instance_role, policy_arn=s3_policy.arn
        )
    pulumi.Output.all(*[bucket.id for bucket in buckets]).apply(
        lambda args: create_and_attach_policy(args)
    )

def setup_s3_read_write_policy(buckets: List[pulumi.Output], project_name: str, instance_role: iam.Role):
    """
    Create a policy to access a list of buckets in R/W mode
    """
    def create_and_attach_policy(args: List) -> None:
        policy = json.dumps(
            {
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Action": ["s3:ListBucket"],
                        "Resource": [f"arn:aws:s3:::{arg.id}" for arg in args],
                    },
                    {
                        "Effect": "Allow",
                        "Action": "s3:GetObject",
                        "Resource": [f"arn:aws:s3:::{arg.id}/*" for arg in args],
                    },
                ],
            }
        )
        S3_POLICY_NAME = create_unique_name(f'{project_name}-buckets-policy')
        s3_policy = iam.Policy(S3_POLICY_NAME, policy=policy)
        S3_ROLE_POLICY_ATTACHMENT = create_unique_name(
            f'{project_name}-buckets-role-policy-attachment'
        )
        iam.RolePolicyAttachment(
            S3_ROLE_POLICY_ATTACHMENT, role=instance_role, policy_arn=s3_policy.arn
        )
    pulumi.Output.all(*[buckets]).apply(
        lambda args: create_and_attach_policy(args)
    )

I don't get why

pulumi.Output.all

works if I tell to wait explicitly for the id but not for the s3.Bucket object

Hello guys, I am trying to perform testing of custom components but I am still stucked see https://github.com/pulumi/pulumi/issues/5295 . Even if closed, I am not able to get the test pass and @faint-table-42725 explanation is not answering because I added a breakpoint with pdb

and I didn’t see it occurring

hi, I am looking for an easy way to get the current state of a deployment directly from python code. Right now I use a quick and dirty trick by running

pulumi stack export

command and extracting the relevant info from the JSON data:

jq = local["/usr/local/bin/jq"]
    pulumi = local["pulumi"]

    chain = pulumi["stack", "export"] | jq['.deployment.resources[] | select(.type == "pulumi:pulumi:Stack") | .outputs.netcams']
    netcams = json.loads(chain())

Should I wait for the python implementation of the Automation API? 😎

Hey everybody my firm is new to pulumi and I'm trying to do some simple stuff with it to get the hang of it. Im trying to push a container to ecr and then supply that container name to the task definition, which clearly requires a JSON serializable string. what is the best way to do that. everything i try is of type Output. Much thanks community!

Looking for some help here. getting the following error message when i try to create a cognito user pool client resource on aws "error creating ELBv2 Listener: InvalidLoadBalancerAction: OAuth flows must be enabled in the user pool client" what arguement enables Oath flows, Im passing in the following for the explicit_auth_flows parameter _explicit_auth_flows_=["ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"]). any thing simple am i missing. thanks in advance!

Are there any Python performance regression tests? On Kubernetes 1.18 clusters with the "serversideapply" feature gate set, we see pulumi-language-python-exec take 100% cpu for minutes as it appears to serialize every single f: managed field as an input. We're putting together a simpler repo now, but its because we do a .apply on a Deployment object, which causes the entire object to be converted into an input. Every single f: field is a nested input that has to be converted which takes a massive amount of time now.

We disable serversideapply on our kubernetes cluster (or downgrade to 1.17) and suddenly pulumi no longer takes 35 minutes to run pulumi up.

i'm looking for a way to create an AWS Lambda archive with dependencies, every time i run

pulumi up

. Is there a resource which will run a bash script or something, so that

pulumi.FileArchive

could run after?

Hi! I'm new to Pulumi and I'm having trouble with the sometimes Output, sometimes Awaitable situation.

When using

aws.ec2.getSubnetIds

, how do I get the result? I tried to

run_until_completion

the Awaitable but the loop is already running. Is there a way to have the main be an async function?

Another question, the documentation shows (https://www.pulumi.com/docs/intro/concepts/programming-model/#resource-get) I could do this:

group = aws.ec2.SecurityGroup.get('sg-0dfd33cdac25b1ec9')

but the signature of that very function takes a

resource_name

and an

id

as positional arguments. What am I missing?

I'm also new to Pulumi, but I think for

aws.ec2.SecurityGroup.get

the

resource_name

is a name that you choose (a label used to identify the resource in Pulumi) and the

id

is the actual security group id from EC2

But when instantiated in this way, Pulumi will not manage the resource so why have a resource_name?

🤷‍♂️ I guess it will show up in your app.pulumi.com control panel under that name... effectively you've "imported" a reference to it into Pulumi

I do not want to import it. I understand that the

get

of a resource does not import. Am I wrong?

.get()

does not import the resource, only gets a reference to it. The resource name is still required for Pulumi to track its usage internally, but does not change or affect the real resource.

OK, I could use some random string?

Sure. Or use the same name that you set as the variable name - e.g.

my_sg = aws.ec2.SecurityGroup.get('my_sg', 'sg-0dfd33cdac25b1ec9')

Thanks.

@gentle-diamond-70147 could you look at my second question?

is there anybody using pytest as a test framework? anybody who is mocking stack references also? would love to have some discussion about those, we have big issues with stack references in tests as PulumiMock doesn't seem to work with it

I made a repo with an example of what failure we have on stackreference => https://github.com/MattBlack85/pulumi_pytest any hint on this would be very much appreciated

#aws how to create new stage/update old after update api gw?

Hello! Newcomer to Pulumi and running into a snag. I'm running...

pubsub_topic = pubsub.Topic(
    "{}-topic".format(PUBSUB_TOPIC_PREFIX)
)

and...

logging_sink = logging.ProjectSink(
    resource_name="{}-sink".format(LOGGING_SINK_PREFIX),
    destination="<http://pubsub.googleapis.com/{}|pubsub.googleapis.com/{}>".format(pubsub_topic.id),
    filter='LOG_ID("<http://cloudaudit.googleapis.com/activity|cloudaudit.googleapis.com/activity>") OR LOG_ID("<http://externalaudit.googleapis.com/activity|externalaudit.googleapis.com/activity>") OR LOG_ID("<http://cloudaudit.googleapis.com/system_event|cloudaudit.googleapis.com/system_event>") OR LOG_ID("<http://externalaudit.googleapis.com/system_event|externalaudit.googleapis.com/system_event>") OR LOG_ID("<http://cloudaudit.googleapis.com/access_transparency|cloudaudit.googleapis.com/access_transparency>") OR LOG_ID("<http://externalaudit.googleapis.com/access_transparency|externalaudit.googleapis.com/access_transparency>")',
    opts=ResourceOptions(
            depends_on=[pubsub_topic]
        ),
)

Pulumi fails with:

gcp:logging:ProjectSink (dev-sink):
    error: 1 error occurred:
        * googleapi: Error 400: Cloud Pub/Sub URL is missing projects/[PROJECT_ID], badRequest

When I look at "details" view, I see this:

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::infrastructure::pulumi:pulumi:Stack::infrastructure-dev]
    + gcp:logging/projectSink:ProjectSink: (create)
        [urn=urn:pulumi:dev::infrastructure::gcp:logging/projectSink:ProjectSink::dev-sink]
        [provider=urn:pulumi:dev::infrastructure::pulumi:providers:gcp::default_4_3_0::4d0f3a00-dc97-4725-b036-499ca6b7f522]
        destination         : "<http://pubsub.googleapis.com/<pulumi.output.Output|pubsub.googleapis.com/<pulumi.output.Output> object at 0x112b44640>"
        filter              : "LOG_ID(\"<http://cloudaudit.googleapis.com/activity\|cloudaudit.googleapis.com/activity\>") OR LOG_ID(\"<http://externalaudit.googleapis.com/activity\|externalaudit.googleapis.com/activity\>") OR LOG_ID(\"<http://cloudaudit.googleapis.com/system_event\|cloudaudit.googleapis.com/system_event\>") OR LOG_ID(\"<http://externalaudit.googleapis.com/system_event\|externalaudit.googleapis.com/system_event\>") OR LOG_ID(\"<http://cloudaudit.googleapis.com/access_transparency\|cloudaudit.googleapis.com/access_transparency\>") OR LOG_ID(\"<http://externalaudit.googleapis.com/access_transparency\|externalaudit.googleapis.com/access_transparency\>")"
        name                : "dev-sink-bf1e116"
        uniqueWriterIdentity: false

When I see

<pulumi.output.Output object at 0x112b44640>

in the

destination

, it makes me think Pulumi hasn't deserialized the actual name, or there is some deferred evaluation that isn't happening? Any suggestions on how to troubleshoot?

Wow, wondering if I have fallen into this pit of despair.

Welp, this seemed to do the trick.

pubsub_topic = pubsub.Topic(
    "{}-topic".format(PUBSUB_TOPIC_PREFIX)
)

pubsub_topic_url = pubsub_topic.id.apply(
    lambda id: "<http://pubsub.googleapis.com/|pubsub.googleapis.com/>" + id
)

logging_sink = logging.ProjectSink(
    resource_name="{}-sink".format(LOGGING_SINK_PREFIX),
    destination=pubsub_topic_url,
    filter='LOG_ID("<http://cloudaudit.googleapis.com/activity|cloudaudit.googleapis.com/activity>") OR LOG_ID("<http://externalaudit.googleapis.com/activity|externalaudit.googleapis.com/activity>") OR LOG_ID("<http://cloudaudit.googleapis.com/system_event|cloudaudit.googleapis.com/system_event>") OR LOG_ID("<http://externalaudit.googleapis.com/system_event|externalaudit.googleapis.com/system_event>") OR LOG_ID("<http://cloudaudit.googleapis.com/access_transparency|cloudaudit.googleapis.com/access_transparency>") OR LOG_ID("<http://externalaudit.googleapis.com/access_transparency|externalaudit.googleapis.com/access_transparency>")'
)

https://www.pulumi.com/docs/intro/concepts/programming-model/#apply basically

TiL....