How can I import a

gcp:serviceAccount/key:Key

with the

serviceAccountId

? When I run

pulumi import

with the

name

and

id

, I get a warning that

serviceAccountId

is missing, even if I add it to the JSON file. I can still complete the import, but the state is created without the

serviceAccountId

, and if I add it to the code, Pulumi thinks it's a different resource and wants to replace the imported one.

I ran into the same problem a few months ago as I was migrating from terraform. I believe this is somehow related to the resource lifecycle: updates trigger a resource replacement, which makes sense given that

Key

resource contains sensitive data. Have you tried using aliases?

TIL about aliases. I'll try that.