Okay, yes--this is definitely the fault of tfbridge. When constructing a Terraform resource state from a Pulumi resource state, we convert the state to a TF resource config and then read each field out of the config: https://github.com/pulumi/pulumi-terraform/blob/master/pkg/tfbridge/schema.go#L580-L597

It looks like we may be a bit overzealous w.r.t. the fields we read. Rather than reading only those fields which are defined by the input state, we read all fields defined by the TF schema.

As a consequence of this, TF ends up handing back empty default values for some undefined fields.

This is the theory, at least. 🙂 It's a bit surprising that we don't see this in other parts of the bridge that use the relevant function, but nothing else jumps out at me.

@microscopic-florist-22719 I gave your pgavlin/attributes branch of pulumi-terraform a go and it fixed this problem of the network erroneously being updated 👍