Hi everyone, I'm wondering why is Pulumi trying to replace the KV secret instead of modifying it in place. Reading through the docs it seems that properties or tags shouldn't require a replacement

+-azure-native:keyvault:Secret: (replace) 🔒
        [id=/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.KeyVault/vaults/[redacted]/secrets/[redacted]]
        [urn=urn:pulumi:[redacted]::[redacted]::azure-native:keyvault:Secret::[redacted]]
        [provider: urn:pulumi:[redacted]::[redacted]::pulumi:providers:azure-native::default_2_53_0::81cbf36d-7404-4317-90ce-e4107d10bad7 => urn:pulumi:[redacted]::[redacted]::pulumi:providers:azure-native::default_2_88_0::8653cdca-6bd5-44dd-a5ab-9025a89d4981]
      ~ properties: {
          - attributes: {
              - enabled: true
            }
          + value     : [secret]
        }
      + tags      : {
          + automation : "[redacted]"
          + environment: "[redacted]"
          + project    : "[redacted]"
          + stack      : "[redacted]"
          + team       : "[redacted]"
          + type       : "Pulumi.AzureNative.KeyVault.Secret"
        }

@bulky-receptionist-64562 - It looks like the value is also being updated in your example. I wonder if it's because KeyVault treats secret value changes as individual revisions within the secret itself so sees it as a replace.