Seeing some weird behavior on refreshes, ec2 security-group tag keys not being read as strings

This is a bug. https://github.com/pulumi/pulumi-terraform/issues/394

And the specific instance of it you are seeing is tracked in https://github.com/pulumi/pulumi-eks/issues/152.

This is fixed in 0.18.4 of the

aws

package.