I've been getting a number of errors similar to this:

aws-native:ecs:TaskDefinition (winnie-web-task-staging):
    error: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: 45ff56cc-8cce-4eac-9ca3-2be60468d69b, NotUpdatableException: Invalid patch update: createOnlyProperties [/properties/TaskRoleArn] cannot be updated

Isn't this what pulumi is supposed to handle for me - creating a new resource and switching everything over to it?

Can you show the code mate?

in this case it was adding line 33 here:

16 task_definition = ecs.TaskDefinition(
17     resource_name='winnie-web-task-{}'.format(pulumi.get_stack()),
18     requires_compatibilities=['FARGATE'],
19     cpu='1024',
20     memory='2048',
21     container_definitions=[
22         ecs.TaskDefinitionContainerDefinitionArgs(
23             name='nginx',
24             image='<http://755158074228.dkr.ecr.us-west-2.amazonaws.com/winnie-nginx:1.0.4|755158074228.dkr.ecr.us-west-2.amazonaws.com/winnie-nginx:1.0.4>',
25             essential=True,
26         ),
27     ],
28     network_mode='awsvpc',
29     runtime_platform=ecs.TaskDefinitionRuntimePlatformArgs(
30         operating_system_family='Linux',
31     ),
32     execution_role_arn='arn:aws:iam::755158074228:role/ecsTaskExecutionRole',
33     task_role_arn='arn:aws:iam::755158074228:role/winnie-web',
34 )

but I've been encountering a number of similar errors the last day, where I add or remove or change a field in something, pulumi attempts to update it, and aws returns an api error

That is probably a bug in AWS Native. I'd suggest filing a GH issue. Just make sure you have a minimal but complete example to make it easy for our engineers to repro: https://github.com/pulumi/pulumi-aws-native/issues

Thanks, will do. (Sorry, got deathly sick last week and am just getting back to work again)

No worries! Feel better and we greatly appreciate your feedback!