No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

There is a "stables" list but we have no clue how to use it with credential providers.

I do this but I the providers don't change so the problem doesn't arise. My approach is to use define all the role-based profiles externally (in ~/.aws/config and ~/.aws/credentials), and my code in Pulumi builds the providers using the _region_ and _profile_ properties only, rather than _assumeRole_. It choose the values for _region_ and _profile_ based on the stack name.

Are you choosing the _profile_ / _assumeRule_ values based on StackReferences or some other Output value? So long as the parameters to your _aws.Profile_ are deterministic, you shouldn't be seeing providers that change and cause problems...

Output values (like StackReferences) aren't determinstic even if they're constant (at least, Pulumi can't assume they're deterministic). So that would cause problems.

Hey <@U012UJTT55M>, actually we are using Pulumi with Alicloud, but I think vendor doesn't matter here. We have introduced a service container like approach to retrieve  proper client object inside our Dynamic Resource Provider code by calling an alias name from inside of the provider. This generates issue as, with instance role, credentials are different every time. For now we have mitigated the problem by adding "___provider" to "ignore__changes" array as in "opts"