Hi. I wanted to ignore other(not set by my pulumi-program) tag key-value pairs on an azure resourcegroup. The only way i found was to query the existing tags on the resourcegroup (if exists) and create a combined tag-set.

let tags: { [key: string]: string } = {
    foo: "abc",
    bar: "def"
}
const existingRG = azure.resources.getResourceGroup({ resourceGroupName: args.rgName }, options)
const combinedTags = existingRG.then(t => {
    const existingTags = t.tags || {}
    Object.keys(tags).forEach(k => {
        existingTags[k] = tags[k]
    })
    return existingTags
}).catch(e => {
    console.warn(`Failed to retrieve resource group: ${e.message}.`);
    return tags
})

I tried setting ignoreChanges to "tags", but that would ignore all changes, even those where I wanted to set a specific value and disable "drift-detection" on the important tags configured by my pulumi-code. Is there a simpler way to achieve this? I also have the problem that removing tags is not that easy that way and needs additional logic. Unfortunatly I did not found a way to access the state(stack-state) that was applied to azure during the last "pulumi up". Is there a way to access this state programmatically?

It's an interesting challenge – It would be nice to be able to access the diff at runtime where the refresh option is enabled but that might only be possible using the Automation API through

Preview

,

PropertyDiff

&

DiffKind

– although I've never tested those and that would probably require a bigger change to your usage pattern. Another solution which would be more transparent is to register a stack transform and do the lookup/combination in there. That way your declaration of resources doesn't get bloated with those extra lookups.