This message was deleted.

considering the external account will have policies based on the full resource name which won’t be automatically updated by a rebuild of the resource being shared

Disclaimer: I don’t work for Pulumi. I think the solution here is to turn autonaming off and add

deleteBeforeReplace.

dang i was afraid of that 😅

If the only thing that is changing is the name and not the resource, you could also use alias. Here is a blog called Refactoring Pulumi Code with `aliases`