refresh is supposed to reconcile the pulumi checkpoint of your stack with the various cloud APIs in case things were updated out-of-band