I had a AWS Role resource that I imported into a stack that

Question

I had a AWS Role resource that I imported into a stack that I left as protected it s the AWSControlTowerAdmin role that control tower creates out the box I want to use Pulumi to lock down this role a bit more as per AWS <https docs aws amazon com controltower latest userguide roles how html|documentation> I successfully ran the stack and brought the role under Pulumi management I now want to refactor the code and I moved the resource into a `ComponentResource` When I rerun the stack it doesn t recognize it as an update and instead tries to recreate the resource It fails because `creating IAM Role AWSControlTowerAdmin EntityAlreadyExists Role with name AWSControlTowerAdmin already exists` any thoughts on the correct approach to this

little-cartoon-10569 · Answer

You can add a Pulumi alias or you can export the stack fix the URN and parent links and re import The alias option is easier slightly smiling face <https www pulumi com docs intro concepts resources options aliases >

dry-journalist-60579 · Answer

ahh

little-cartoon-10569 · Answer

Our you could remove the resource from the state and import it in the new location which is essentially the export edit import option but safer

dry-journalist-60579 · Answer

Is there a way I can find the old urn It seems to have disappeared from the stack s list of resources even though it never deleted it

little-cartoon-10569 · Answer

Export the stack and search for it

little-cartoon-10569 · Answer

It ll probably have a `delete true ` option

little-cartoon-10569 · Answer

Which is why you can t see it in the normal output

dry-journalist-60579 · Answer

gt Our you could remove the resource from the state and import it in the new location ^ how would this look

little-cartoon-10569 · Answer

`pulumi state delete resourceUrn`

little-cartoon-10569 · Answer

Then either `pulumi import` or write the code yourself and add the `import ` opt

dry-journalist-60579 · Answer

ahh ok

dry-journalist-60579 · Answer

Hmm weird I m not seeing the resource

dry-journalist-60579 · Answer

in the exported stack

dry-journalist-60579 · Answer

Maybe it did get deleted from the pulumi state

dry-journalist-60579 · Answer

ohh crap it was in a different stack man facepalming skin tone 4

dry-journalist-60579 · Answer

sorry

dry-journalist-60579 · Answer

So now that I ve found it I could do what you said and delete it from the state of that stack and import it into the new one

little-cartoon-10569 · Answer

Yes certainly And you can import it in the right place Since it s in a ComponentResource I wouldn t use `pulumi import` unless it can handle that Not sure You can write the code yourself and use the `import` opt

dry-journalist-60579 · Answer

<https www pulumi com docs intro concepts resources options import > what would the resource id be for this IAM role

little-cartoon-10569 · Answer

Have a look at the doc page for the resource the info is near the bottom of the page

dry-journalist-60579 · Answer

from the stack where it s living it seems like it s the role name

dry-journalist-60579 · Answer

yup right

little-cartoon-10569 · Answer

That s the Pulumi id You need to use the AWS ID which might be anthing Sometime they re weird composite string

little-cartoon-10569 · Answer

Ah yes it is the name then It always pays to check

dry-journalist-60579 · Answer

Why isn t it the ARN

little-cartoon-10569 · Answer

You ll have to ask the AWS API developers slightly smiling face

little-cartoon-10569 · Answer

It s not a Pulumi thing

dry-journalist-60579 · Answer

haha

dry-journalist-60579 · Answer

cool cool thank you so much

dry-journalist-60579 · Answer

actually one question can two distinct pulumi stacks manage the same resource If not will Pulumi stop you from trying

little-cartoon-10569 · Answer

They can but they shouldn t because of drift However you can use the ` get ` class method <https www pulumi com registry packages aws api docs iam role look up> to get a read only version of the resource in the project you don t want to manage it

little-cartoon-10569 · Answer

This wouldn t generally apply to two different stacks in the same project it s almost always an inter project thing

dry-journalist-60579 · Answer

ah so they ll just compete with each other to manage that resource

little-cartoon-10569 · Answer

Yes

dry-journalist-60579 · Answer

kk I was going to import as we talked about but realized I hadn t deleted it from the other stack and it got me wondering

dry-journalist-60579 · Answer

just confirming this just deletes the pulumi state and it does not affect the underlying AWS resource right

little-cartoon-10569 · Answer

It s `pulumi state delete` Yes that does not affect AWS only the Pulumi state file

dry-journalist-60579 · Answer

kk the message from `protect` still applies to the state

little-cartoon-10569 · Answer

Yes You can remove the `protect` via an up which will also do nothing to AWS then remove the resource from state

dry-journalist-60579 · Answer

thank you again