but that begs the question: how does one force a regeneration

Maybe

pulumi up --replace 'random_password_urn'

. I forget if it's possible though

yeah, good point one could just remove that ressource

Just set a random string as a value for one of the keys in passed in to the

keepers

parameter if you want Pulumi to regenerate the random value. Depending on your programming language but this would roughly be one way of doing that in Python..

import uuid;
from pulumi_random import RandomString

RandomString(
  ...
   keepers = {
       "trigger": uuid.uuid4().hex.upper()[0:6]
   },
)