However, once it's imported, you can change security groups. You don't need to add to it, just change it.

If you'd loaded it using

Instance.get()

then you'd be out of luck, but since you imported it, you can just add a new security group ID to the constructor, and Pulumi will take care of the rest.

If it's not too much, where can I read about Association?

Instance.get()

may help me with getting the values first, I think

You can directly edit the security groups in the instance object. You change the contents of the vpcSecurityGroupId array.

Pulumi is a declarative system, which makes the resources in your cloud provider (AWS) look like the resources defined in your source code. When you change your source code, it changes AWS. You don't construct the resource then modify it: you change the original constructor and redeploy.

vpcSecurityGroupIds is not read only as an argument to the constructor. Only the output is readonly. This is intentional: to change the security groups, you change the parameters to the constructor. Even though this originally came from output Pulumi, this is the correct way to change the instance. Because once you ran

pulumi import

, the resource became Pulumi-managed.

You said earlier

So, if I already have securityGroup1 and I just want to add securityGroup2 , I can't because I need to read the value first

This is not correct. You don't need to read the value first. The value was read during

pulumi import

, and again every time you do a

pulumi up

. It is maintained in your Pulumi state. You just need to add securityGroup2 (to the constructor) and run

pulumi up

. Pulumi works its magic and AWS is updated.

Based on the info, this is what I got:

// default security group
const defaultSg = new aws.ec2.SecurityGroup("defaultSg", {
  description: "default VPC security group",
  name: "default",
  revokeRulesOnDelete: false,
}, {
  protect: true,
})

// cluster security group
const appSecurityGroups = app.cluster.securityGroups;

const rds = new aws.rds.Instance("blog", {
  autoMinorVersionUpgrade: true,
  copyTagsToSnapshot: true,
  deleteAutomatedBackups: true,
  deletionProtection: true,
  identifier: "blog",
  instanceClass: "db.t3.micro",
  monitoringInterval: 0,
  performanceInsightsEnabled: false,
  publiclyAccessible: false,
  skipFinalSnapshot: true,
  storageEncrypted: true,
  vpcSecurityGroupIds: [defaultSg.id, appSecurityGroups[0].id]
}, {
  protect: true,
});

When I import the RDS for the first time, the

vpcSecurityGroupIds

are not there. So, if I add a new security group, it'll remove the previous config. So, I figured, just read the security group and assign them together like that. That will ensure it won't remove the original security group. Obviously not really a good solution as I need to get all security group first before I declare the RDS rather than merging what security group the RDS has with the new one

This is the generated code

Edit the Pulumi generated code.