https://pulumi.com logo
Title
d

dry-journalist-60579

03/22/2023, 7:16 PM
For some reason, when I run
pulumi up
on a stack that includes a ecr Repository and a RepositoryPolicy, it thinks the policy is different every run:
# Allow app subaccounts to pull from image repository
repository_policy = aws.ecr.RepositoryPolicy(
    "repository-policy",
    repository=repository.name,
    policy={
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AllowCrossAccountPull",
                "Effect": "Allow",
                "Principal": {
                    "AWS": [
                        f"arn:aws:iam::{account_id}:root"
                        for account_id in ALLOWED_ACCOUNT_IDS
                    ]
                },
                "Action": [
                    "ecr:BatchCheckLayerAvailability",
                    "ecr:BatchGetImage",
                    "ecr:GetDownloadUrlForLayer",
                ],
            }
        ],
    },
)
m

melodic-tomato-39005

03/22/2023, 10:31 PM
That’s potentially a bug. Could you file an issue, either in pulumi-aws for the classic provider or pulumi-aws-native for the native provider? Ideally with a complete program to reproduce, but we can figure it out if that’s difficult to extract. Thanks!
d

dry-journalist-60579

03/22/2023, 10:32 PM
Ah interesting, will do, thank you!
@melodic-tomato-39005 I realized that I never opened this issue… here it is: https://github.com/pulumi/pulumi-aws/issues/2491 Still seems to be happening on my end with latest versions of Pulumi
m

melodic-tomato-39005

04/26/2023, 6:42 PM
thank you!
d

dry-journalist-60579

04/26/2023, 6:43 PM
Does the use of
awsx
raise any flags for you?
And is it possible there’s a similar non-idempotent issue with
aws:cloudformation:Stack
?
m

melodic-tomato-39005

04/26/2023, 6:50 PM
awsx
seems unrelated at first glance. We actually have a small number of similar issues open where Pulumi thinks unchanged resources have changed. That suggests an underlying bug. I’m compiling these at the moment so we can track this down. Sorry for the trouble!
d

dry-journalist-60579

04/26/2023, 7:25 PM
Should I open an issue for the
aws:cloudformation:Stack
one as well?
m

melodic-tomato-39005

04/26/2023, 7:28 PM
Hmm, yes I think that would be good to have a full picture, if you don’t mind
d

dry-journalist-60579

04/26/2023, 7:38 PM
Thank you!