Does pulumi not modify security policies from code? I add a rule 1 to a policy and do pulumi up. Then, I changed the rules param of that policy to just have rule 2. What I see - both rule 1 and 2 are attached to the policy. Why is that? How can I have a refresh?

If you did all of this through Pulumi (and didn't make any changes in the console), you're likely seeing a bug in the provider. Please file an issue here: https://github.com/pulumi/pulumi-gcp/issues