pulumi preview

keeps showing changes to the stack, when none are made: Looks like the container definition / task definitions are showing changes due to ouputs being mapped to the environments: [] array, or secrets: [] array. Any ideas on how to solve this?

+-aws:ecs/taskDefinition:TaskDefinition: (replace)
            [id=use1-dev-registrar-api]
            [urn=urn:pulumi:dev::aws::awsx:x:ecs:EC2TaskDefinition$aws:ecs/taskDefinition:TaskDefinition::use1-dev-registrar-api]
            [provider=urn:pulumi:dev::aws::pulumi:providers:aws::default_3_21_0::10e8b33b-1a70-4ffc-bb0e-8c586673f58f]
          ~ containerDefinitions: "[secret]" => "[secret]"
            > aws:autoscaling/group:Group: (read)
                [id=ecs-use1-dev-edge-services-df916d8-Instances-OEURTU97PJME]
                [urn=urn:pulumi:dev::aws::awsx:x:ecs:Cluster$awsx:x:autoscaling:AutoScalingGroup$aws:autoscaling/group:Group::ecs-use1-dev-edge-services]
                [provider=urn:pulumi:dev::aws::pulumi:providers:aws::default_3_21_0::10e8b33b-1a70-4ffc-bb0e-8c586673f58f]
        ~ aws:ecs/service:Service: (update)
            [id=arn:aws:ecs:us-east-1:REDACTED:service/ecs-use1-dev-edge-services-cluster-7f77f63/use1-dev-registrar-api-ff48eab]
            [urn=urn:pulumi:dev::aws::awsx:x:ecs:EC2Service$aws:ecs/service:Service::use1-dev-registrar-api]
            [provider=urn:pulumi:dev::aws::pulumi:providers:aws::default_3_21_0::10e8b33b-1a70-4ffc-bb0e-8c586673f58f]
          ~ taskDefinition: "arn:aws:ecs:us-east-1:REDACTED:task-definition/use1-dev-registrar-api:569" => output<string>

i think pulumi is using the terraform aws provider underneath

hm. thank you for the insight. However, I'm not sure what is expected, because it's converting from [secret] => [secret]

Try

pulumi stack export --file mine.json ; pulumi refresh ; pulumi stack export --file theirs.json

and compare.

k, will do, give me 2 mins

Some of those might have to be copied as per @acceptable-jackal-53536’s suggestion.. hard to tell which ones..

Theirs

"assumeRolePolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"<http://sqs.amazonaws.com|sqs.amazonaws.com>\",\"<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>\",\"<http://ec2.amazonaws.com|ec2.amazonaws.com>\",\"<http://sns.amazonaws.com|sns.amazonaws.com>\"]},\"Action\":\"sts:AssumeRole\"}]}",

Mine:

"assumeRolePolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"<http://sns.amazonaws.com|sns.amazonaws.com>\",\"<http://ec2.amazonaws.com|ec2.amazonaws.com>\",\"<http://sqs.amazonaws.com|sqs.amazonaws.com>\",\"<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>\"]},\"Action\":\"sts:AssumeRole\"}]}",

Yep, I want through that exercise in a few policies. Took a few hours, but it's been solid ever since.

okay cool. what about the secrets tho? it's encoded. I have no idea what it should be

Generally you can ignore those, they won't be the problem. It'll be list-like things (orders change) or encoded JSON docs.

okay cool

Pulumi does quite well at detecting non-identical similarities. Just needs occasional help.

Thank you very much