No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

was the update modifying an existing security group?

possible that we're pulling that in as a default for some reason

do you also have `aws.ec2.SecurityGroupRule` resources, or does the `aws.ec2.SecurityGroup` define all of its rules inline?

just for kicks, can you try "TCP" instead of "tcp"?

Added the ingress rule via AWS console then running `pulumi refresh` followed by `pulumi update` fixes it.

Lemme see if I can get into that state again.

That would be great. So far I've been unable to repro that as well.

Which versions of the packages are you working with?

```
"dependencies": {
        "@pulumi/pulumi": "0.16.6",
        "@pulumi/aws": "0.16.2",
        "@pulumi/aws-infra": "0.16.2",
        "@pulumi/cloud-aws": "0.16.0",
        "@pulumi/cloud": "0.16.0"
    }
```

Simply changing from tcp to -1 to tcp does not do it.

I think I got it. Go from
```
{
    protocol: "tcp",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
```
to
```
{
    protocol: "-1",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
```
to
```
{
    protocol: "-1",
        fromPort: 0,
    toPort: 0,
    cidrBlocks: ["0.0.0.0/0"]
}
```

That second configuration should not be allowed

Are you able to successfully run a `pulumi update` with

```
{
    protocol: "-1",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
```

Right. It failed deployment. But then going from the second to third resulted in the above exception.

my guess is that there's some bad interaction with terraform here

good to know that a `refresh` unblocked you

I've somehow managed to hit this multiple times. Some combo of refresh and/or stack export | import usually fixes things.

<https://github.com/pulumi/pulumi-aws/issues/398>