Hello, I am building out a/n AWS VPC with Pulumi and am seeing a strange issue with how pulumi "thinks" Network Acl Rules need to be replaced, specifically it states that the change is in the Rule action, however the Rule Actions are statically assigned. An example would be the following. 

acl_rules = [
    {
        "resource_name": "privateInboundDynamic",
        "egress": "True",
        "from_port": "1024",
        "to_port":"65535",
        "protocol": "6",
        "cidr_block": "0.0.0.0/0",
        "rule_number": "10",
        "network_acl_id": privateACL.id,
        "rule_action": "Allow"
    },
    {
        "resource_name": "privateOutboundUdpDns",
        "egress": "True",
        "from_port": "53",
        "to_port":"53",
        "protocol": "17",
        "cidr_block": "0.0.0.0/0",
        "network_acl_id": privateACL.id,
        "rule_number": "20",
        "rule_action": "Allow"
    }
]

for x in range(0, len(acl_rules)):  
    print("[INFO] DEBUG -> %s" % str(acl_rules[x]))
    aws.ec2.NetworkAclRule(
        resource_name=acl_rules[x]['resource_name'], 
        cidr_block=acl_rules[x]['cidr_block'], 
        egress=acl_rules[x]['egress'], 
        from_port=acl_rules[x]['from_port'], 
        network_acl_id=acl_rules[x]['network_acl_id'], 
        protocol=acl_rules[x]['protocol'], 
        rule_action=acl_rules[x]['rule_action'], 
        rule_number=acl_rules[x]['rule_number'], 
        to_port=acl_rules[x]['to_port']
    )

Review Of changes with plum preview:
+-  ├─ aws:ec2:NetworkAclRule  publicOutboundDynamic     replace     [diff: ~ruleAction]

preview --diff

"allow"