This message was deleted.

This is a feature called pseudo-deterministic naming. Can you share your declaration?

Sure @millions-furniture-75402 (in Python)

def create_ssm_role():
    ec2_role = aws.iam.Role(
        "managed-instance-role",
        aws.iam.RoleArgs(
            assume_role_policy=json.dumps({
                "Version": "2012-10-17",
                "Statement": {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "<http://ec2.amazonaws.com|ec2.amazonaws.com>",
                    },
                    "Action": "sts:AssumeRole",
                },
            })
        ),
        name = "managed-instance-role",
        tags = {'Name': 'managed-instance-role'}
    )

The declaration looks correct. and in aws it has the appended hash?

managed-instance-role-819d269

though, your last 2 kwargs look odd, I wouldn't expect the spaces

You think it's the spaces at issue? I can try it without them

I'm not sure if it is, but that's something that caught my eye. Have you destroyed it completed by refreshing, deploying without it, and then deploying again with it?

Without the spaces? No, but I can give that a go

I just meant the resource in general.

Oh, well I need that particular resource for the stack

It's possible, it really depends on the changes you have made and whether or not deploys have failed and what state that left the stack's state in. The first step is worth trying, refreshing the stack.

It's the sandbox account so it gets a lot of create/destroy activity

If Pulumi's state has drifted, it cannot accurately calculate the difference in state that will inform it of the changes to apply to resources.

Aha!

Diagnostics:
  aws:iam:Role (managed-instance-role):
    error: deleting urn:pulumi:sandbox-vpc::aws-vpc::aws:iam/role:Role::managed-instance-role: 1 error occurred:
        * deleting IAM Role (managed-instance-role-819d269): DeleteConflict: Cannot delete entity, must delete policies first.
        status code: 409, request id: 48a0193c-c4b0-409e-bc4a-249e5ef9040d

It was hanging on the delete of an older resource?

Yeah, it did the other stuff but was ignoring it

You might have a dependency issue too. I also noticed you had that in a function.

can you try different version?

ec2_role = aws.iam.Role(
    "managed-instance-role",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": {
            "Effect": "Allow",
            "Principal": {
                "Service": "<http://ec2.amazonaws.com|ec2.amazonaws.com>",
            },
            "Action": "sts:AssumeRole",
        },
    }),
    name = "managed-instance-role",
    tags = {'Name': 'managed-instance-role'}
)

or

ec2_role = aws.iam.Role(
    "managed-instance-role",
    aws.iam.RoleArgs(
        assume_role_policy=json.dumps({
            "Version": "2012-10-17",
            "Statement": {
                "Effect": "Allow",
                "Principal": {
                    "Service": "<http://ec2.amazonaws.com|ec2.amazonaws.com>",
                },
                "Action": "sts:AssumeRole",
            },
        }),
        name = "managed-instance-role",
        tags = {'Name': 'managed-instance-role'}
    )
)

Got it!

If you want to use a specific well-known name for a resource, you need to set the name argument. This is different from the name parameter. In the RoleArgs object, set the name there too.

So it was the "aws.iam.RoleArgs(" I removed it and now it's no longer appending the string to the resource name 🙂

Are you sure you need a specific name for the Role? Unless you have a good need for that, you should not remove the hash from the name. That hash allows Pulumi to gracefully replace the resource when necessary.

I have a cross account permissions setup with another account so keeping the name consistent is helpful

If you're setting them both up via Pulumi, that's not a problem. But if not, then you need a fixed name. Just use the name arg.