I performed a parameter update on a cloudformation stack, the update failed, and the

pulumi update

did not fail.

Hmm - that sounds like possibly a bug. If you can reproduce, could you open a GitHub issue?

The CF update failed because the IAM user that ran

pulumi update

did not have permission to do an operation required when updating the CF parameter.