https://pulumi.com logo
Powered by
Title
p

purple-plumber-90981

04/28/2021, 10:52 PM
in aws.iam for RolePolicyAttachment, every time i “pulumi up” the existing attachments are removed and new ones added. Is this expected behaviour ? I would think that as my attachments are unchanged, nothing should be removed/recreated
sample’ish code in thread
l

little-cartoon-10569

04/28/2021, 10:52 PM
No, that doesn't usually happen.
p

purple-plumber-90981

04/28/2021, 10:53 PM
that is an example of what i see every time
the only real changes were to cluster and nodegroup
here is my role and attachment code
l

little-cartoon-10569

04/28/2021, 10:54 PM
Are you changing the name every time? Can't see in that screenshot. The code would probably be more useful?
p

purple-plumber-90981

04/28/2021, 10:54 PM
lol im getting to it
👍 1
role
eks_admin_role = aws.iam.Role(
    "itplat_eks_clusteradmin_role",
    assume_role_policy=eks_assume_role_policy,
    name="itplat_eks_clusteradmin_role",
    tags={
        "clusterAccess": "itplat_eks_admin",
    },
    opts=pulumi.ResourceOptions(provider=providers['us-east-1']),
attachment
# attach AmazonEC2FullAccess policy to the eks_admin_role
eksworker_policy_attachment_admin_role = aws.iam.RolePolicyAttachment(
    "eksworker_attach_ec2Policy_to_" + str(eks_admin_role.name),
    policy_arn="arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
    role=eks_admin_role.name,
    opts=pulumi.ResourceOptions(provider=providers['us-east-1']),
)
the same code is duplicated for other roles and attachments but the structure is the same
l

little-cartoon-10569

04/28/2021, 10:56 PM
That looks like the problem. 
eks_admin_role.name
is an output, and non-deterministic.
Use the same value as you pass in to the role, rather than the name from the role, even though they have the same value.
p

purple-plumber-90981

04/28/2021, 10:57 PM
erm . . . i would prefer not to as i want to have them generated later
are you saying eks_admin_role.name is not a string ?
l

little-cartoon-10569

04/28/2021, 10:57 PM
You can use the same variable and pass it to both constructors
Yes, it's not a string, it's an Output<string>.
p

purple-plumber-90981

04/28/2021, 10:58 PM
could i just str() it
l

little-cartoon-10569

04/28/2021, 10:58 PM
No, it's not available at construction time.
It comes back from the provisioning of the resource asynchronously, potentially long after construction time.
p

purple-plumber-90981

04/28/2021, 10:59 PM
right because this is all decoupled
sigh, i should have realised that
ok that is enough to get me past my current issue… i will redesign as per your suggestion
👍 1
thank you for the learning
🙇 1
#awsJoin Slack
Powered by