No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

i _think_ pulumi is using the terraform aws provider underneath

what i've seen with terraform/aws is that with specific resources it can change the representation when it gets saved

in my script it was `2400:cb00::/32` which got converted to `2400:cb00:0000:0000:0000:0000:0000:0000/32`

so when it compared the addresses, it saw it as different and an update would always run

solution was to take the format as it appeared in aws and update my script to be the same

hm. thank you for the insight.  However, I'm not sure what is expected, because  it's converting from [secret] =&gt; [secret]

Try `pulumi stack export --file mine.json ; pulumi refresh ; pulumi stack export --file theirs.json` and compare.

<@U012UJTT55M> - sorry for the delayed response.  There are thousands of differences.

The outputs.secretBinary.cipherText and outputs.secretString.cipherText for `aws:ecs/taskDefinition:TaskDefinition` are showing differences.

and assumeRolePolicy for `aws:iam/role:Role`

Some of those might have to be copied as per <@U01K08U3EL9>’s suggestion.. hard to tell which ones..

*Theirs*
```"assumeRolePolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"<http://sqs.amazonaws.com|sqs.amazonaws.com>\",\"<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>\",\"<http://ec2.amazonaws.com|ec2.amazonaws.com>\",\"<http://sns.amazonaws.com|sns.amazonaws.com>\"]},\"Action\":\"sts:AssumeRole\"}]}",```
Mine:
```"assumeRolePolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"<http://sns.amazonaws.com|sns.amazonaws.com>\",\"<http://ec2.amazonaws.com|ec2.amazonaws.com>\",\"<http://sqs.amazonaws.com|sqs.amazonaws.com>\",\"<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>\"]},\"Action\":\"sts:AssumeRole\"}]}",```

Yep, I want through that exercise in a few policies. Took a few hours, but it's been solid ever since.

okay cool.  what about the secrets tho? it's encoded. I have no idea what it should be

Generally you can ignore those, they won't be the problem. It'll be list-like things (orders change) or encoded JSON docs.

Pulumi does quite well at detecting non-identical similarities. Just needs occasional help.