if i provision a fargate profile for eks, i need to have a tag on the subnets that the group uses. the problem i am trying to solve is that those subnets already exist and i do not want to import them as managed resources in pulumi, i just want to ensure my tag is added. is there some way to only manage the tags on a resource?

I don't think I've come across functionality like that yet. Closest I can think of would be to import it and use the option

protect: true

on it, so that Pulumi can only modify it and not delete it.

Hey Kraig 👋 As tenwit points out, in one update you can

import

the sg and

protect

it, and use transformations on the sg to ignore changes to the sg

tags

. Then on a proceeding update, you can control and configure the tags map to what you need. You’ll want to include all existing tags in addition to the new one. Here’s a similar example that imports and modifies a sg that could help you.

excellent. thanks to you both!