Also, secondary suggestion: On the timeline tag of the update activities resources that are replaced could appear 2 times, one for when a new one is created and another for when the previous resource is deleted. It is strange how it appears today. The key needs to be replaced for the provider to change, but since it is only completely replaced after its dependency are updated it shows up after it, which can be confusing if someone needs check the operations at some point (auditing for example, it is not clear when the new resource was created).