anybody aware why we get such a behavior (and how we can debug the source)?

++aws:ec2/flowLog:FlowLog: (create-replacement)
                [id=fl-XXX]
                [urn=urn:pulumi:staging::XXX-vpc::XXX:AWS:Network$aws:ec2/vpc:Vpc$aws:ec2/flowLog:FlowLog::stusea1-XXX-vpc-flowlog]
                [provider=urn:pulumi:staging::XXX-vpc::pulumi:providers:aws::default_4_26_0::XXX]
              + iamRoleArn: "arn:aws:iam::XXX:role/stusea1-XXX-vpc-flowlog-role-972cb33"
            +-aws:ec2/flowLog:FlowLog: (replace)
                [id=fl-XXX]
                [urn=urn:pulumi:staging::XXX-vpc::XXX:AWS:Network$aws:ec2/vpc:Vpc$aws:ec2/flowLog:FlowLog::stusea1-XXX-vpc-flowlog]
                [provider=urn:pulumi:staging::XXX-vpc::pulumi:providers:aws::default_4_26_0::XXX]
              + iamRoleArn: "arn:aws:iam::XXX:role/stusea1-XXX-vpc-flowlog-role-972cb33"
            --aws:ec2/flowLog:FlowLog: (delete-replaced)
                [id=fl-XXX]
                [urn=urn:pulumi:staging::XXX-vpc::XXX:AWS:Network$aws:ec2/vpc:Vpc$aws:ec2/flowLog:FlowLog::stusea1-XXX-vpc-flowlog]
                [provider=urn:pulumi:staging::XXX-vpc::pulumi:providers:aws::default_4_26_0::XXX]

seems pulumi wants to replace the ARN (which is the same) and this fails cause the resource already exist this happens on every up

Are either of the resources being created inside an

apply()

? I would expected to see that behaviour if the role was created inside

apply()

.

nah all are inline with no apply, this was an API incompatibility for EC2FlowLog