I noticed that the passwordPolicy of cognito is recognized as changed everytime I update the stack, while actually it is not. Is this a design on purpose? or bug?

Are you setting the policy inside an

apply

?

apply

isn't deterministic so pulumi preview can't tell what the value will be; it may be reporting a potential change to be on the safe side.

Thanks but I think no? I am simply use

new aws.cognito.UserPool()

to declare the resource.

And that's not inside a call to

apply()

? In that case I don't know. You could set the actual value in the args so that it's not relying on the default.

const userPool = new aws.cognito.UserPool("guests", {
  passwordPolicy: {
    minimumLength: 20,
    requireLowercase: false,
    requireNumbers: false,
    requireSymbols: false,
    requireUppsercase: false,
    temporaryPasswordValidity: -1
  }
});

No it’s not. And yeah it’s all explicit declared…that’s odd.

export const userPool = new aws.cognito.UserPool(
  resourceName(stack, "user-pool", "cognito"),
  {
    ...
    passwordPolicy: {
      minimumLength: 8,
      requireLowercase: true,
      requireNumbers: true,
      requireSymbols: true,
      requireUppercase: true,
    },
    ...
  }
);

Have a look at the detailed difference, maybe there's more info there.