I think I have exactly the same problem as immediately above (my creds rotated and there's stale state stuck in the providers), this time with the Cloudflare and DigitalOcean providers, but I can't fix it with

pulumi up

because Pulumi incorrectly thinks it needs to recreate all my resources. I tried

pulumi stack export

but I don't know with what to replace the

token

and

apiToken

input and output strings in the providers: when I replace them with the appropriate encrypted values from my

Pulumi.<stack>.yaml

file, I get "could not deserialize deployment: invalid character 'Y' after top-level value" on the import, so presumably they need to be somehow different between the state file and the stack config file. I also tried

pulumi refresh --target <urn of the provider>

, but that appears to have been a no-op; and

pulumi up --target <urn of the provider>

said there was no resource with that URN. How can I tell Pulumi to use the correct credentials in a refresh operation?

👋 Can you see the URNs for the providers from the state file? You might be able to do a

pulumi up --target=provider_urn

to get just the provider state updated to the latest tokens, and then do a refresh to get everything else updated.

Yeah, I copy-pasted the URNs from the

pulumi stack export

output - just tried again with the same "no resource with that URN" result

I'll check that, can't see why default providers would be skipped from targets. Delete and re-import should at least get your state fixed up for now.

Could it have been bad shell escaping?

There are no shell metacharacters in any of my tokens, if that's what you mean