Would the code below cause a “pulumi up” to replace servers every time debian updates the AMI? If so is it easy to pin it after the fact since that is not the behavior I want.

// Get latest Debian Buster AMI
const busterId = aws.getAmi({
    owners: ["136693071363"],
    mostRecent: true,
    filters: [{
        name: "name",
        values: ["debian-10-amd64-*"],
    }],
}, { async: true }).then(ami => ami.id);

yes, it would. Are you using a launchTemplate or directly on an ec2 instance?

Using it in a call to new aws.ec2.Instance

yeah you don't want

mostRecent

in that case, launchTemplates would help here because it would mean the new ec2 instance would have the latest but it wouldn't replace the existing instances

Thanks, any way to correct it without importing the instance? If I just change the ami to the full name of the one used will Pulumi stop recommending the upgrade?

Yea, if you change your

debian-10-amd64-*

filter to

debian-10-amd64-YYYMMDD

or whatever the exact name is that will pin it.

Awesome, thank you Cameron!