Or as a separate solution to the same problem from the previous thread: what is the correct way to create an aws.ssoadmin.AccountAssignment for a group pushed from Okta (and created in the same Pulumi project, via the Okta provider)?