How does Pulumi Terraform Bridge deal with default values configured in a resource? I am running into an issue i.e. a resource is defined as this:

"list_policy": {
		(...)
				"allow": {
					(...)
							"all": {
								Type:         schema.TypeBool,
								Optional:     true,
############ --->		    	Default:      false,                 <-- Default Value #########
								ExactlyOneOf: []string{"list_policy.0.allow.0.all", "list_policy.0.allow.0.values"},
							},
							"values": {
								Type:         schema.TypeSet,
								Optional:     true,
								ExactlyOneOf: []string{"list_policy.0.allow.0.all", "list_policy.0.allow.0.values"},
								Elem:         &schema.Schema{Type: schema.TypeString},
								Set:          schema.HashString,
							},
						},
					},
				},

https://github.com/terraform-providers/terraform-provider-google/blob/1f9e0cb9c3cef1c65cfd2054ca8dfd2795ac42a6/google/resource_google_organization_policy.go#L55 And I created it like this:

new projects.OrganizationPolicy('Only allow resource in Europe', {
    constraint: 'gcp.resourceLocations',
    project: gcloud.project,
    listPolicy: {
        allow: {
            values: ['in:europe-west4-locations']
        }
    }
})

What would be the value of

resource.listPolicy.allow.all

?

Interesting. I would not have expected that resource to work in Terraform either. But if it does, then this is a bug in the Pulumi Terraform bridge handling of default application.

@white-balloon-205 actually I mapped the pulumi config to terraform there, I did not reproduce it. I also found their tests which do cover this area quite well so right now Pulumi Terraform Bridge is the main suspect

Got it - so this is then a bug in the Pulumi Terraform Bridge.

Is there a general guide on how to debug the output Pulumi send to terraform?

See https://www.pulumi.com/docs/troubleshooting/#verbose-logging for verbose logs which will include the values marshalled to and from all provider calls. But if the bug is what we are assuming here - I expect this will show that the default is being applied earlier that Terraform would apply it, and thus triggering the ExactlyOneOf.

So I ran the script with logging enabled and we can indeed see the default value being applied. You can clearly see the input value being just the ‘values’ list, and then a few steps later ‘all’ is applied.