Can someone help with this horrible bit of code that always wants to delete/replace network associations each time I up the stack its in: var i = 0; for (var subnetId of privateSubnetIds) { new aws.ec2clientvpn.NetworkAssociation(

assoc-${i}

, { clientVpnEndpointId: vpnEndpoint.id, subnetId: subnetId, }); i++; }

Can you provide the

pulumi preview --diff

output?

+-awsec2clientvpn/networkAssociationNetworkAssociation: (replace) [id=cvpn-assoc-0a6ba882ef5d3b908] [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-0] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] ~ subnetId: "subnet-08301af09876e1446" => "subnet-0d8f31780fdb9602b" +-awsec2clientvpn/networkAssociationNetworkAssociation: (replace) [id=cvpn-assoc-0d393de78cdc9259f] [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-2] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] ~ subnetId: "subnet-08301af09876e1446" => "subnet-037eec31203453d7b"

Where is

privateSubnetIds

coming from?

The associations were created with .sort() but I still get the error. I removed them and tried again just in case, but still have the same problem. Here's a preview, up and preview.  pl preview --diff Previewing update: pulumipulumiStack: (same) [urn=urnpulumistage:managed infrapulumipulumiStack:managed-infra-stage] + awsec2clientvpn/networkAssociationNetworkAssociation: (create) [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-0] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] clientVpnEndpointId: "cvpn-endpoint-00f28758291a1c579" subnetId : "subnet-0d8f31780fdb9602b" + awsec2clientvpn/networkAssociationNetworkAssociation: (create) [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-2] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] clientVpnEndpointId: "cvpn-endpoint-00f28758291a1c579" subnetId : "subnet-037eec31203453d7b" + awsec2clientvpn/networkAssociationNetworkAssociation: (create) [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-1] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] clientVpnEndpointId: "cvpn-endpoint-00f28758291a1c579" subnetId : "subnet-08301af09876e1446" Resources: + 3 to create 51 unchanged Permalink: https://app.pulumi.com/Synthesis-AI-Dev/managed-infra/stage/previews/1dce16cf-6e05-4fbc-9731-7e0522537381  master  managed-infra  pl up --yes Previewing update (Synthesis-AI-Dev/stage): Type Name Plan pulumipulumiStack managed-infra-stage + ├─ awsec2clientvpnNetworkAssociation assoc-2 create + ├─ awsec2clientvpnNetworkAssociation assoc-1 create + └─ awsec2clientvpnNetworkAssociation assoc-0 create Resources: + 3 to create 51 unchanged Updating (Synthesis-AI-Dev/stage): Type Name Status pulumipulumiStack managed-infra-stage + ├─ awsec2clientvpnNetworkAssociation assoc-2 created + ├─ awsec2clientvpnNetworkAssociation assoc-1 created + └─ awsec2clientvpnNetworkAssociation assoc-0 created Outputs: allSubnetIds : [ [0]: "subnet-071cc2414add306b0" [1]: "subnet-0c92dfb7944f0d429" [2]: "subnet-0ef0eeb105af9a7fe" [3]: "subnet-0d8f31780fdb9602b" [4]: "subnet-08301af09876e1446" [5]: "subnet-037eec31203453d7b" ] privateSubnetIds: [ [0]: "subnet-0d8f31780fdb9602b" [1]: "subnet-08301af09876e1446" [2]: "subnet-037eec31203453d7b" ] publicSubnetIds : [ [0]: "subnet-071cc2414add306b0" [1]: "subnet-0c92dfb7944f0d429" [2]: "subnet-0ef0eeb105af9a7fe" ] region : "us-east-2" vpcId : "vpc-0bec8002f61d4a4ce" Resources: + 3 created 51 unchanged Duration: 6m13s  pl preview --diff Previewing update (Synthesis-AI-Dev/stage): pulumipulumiStack: (same) [urn=urnpulumistage:managed infrapulumipulumiStack:managed-infra-stage] +-awsec2clientvpn/networkAssociationNetworkAssociation: (replace) [id=cvpn-assoc-0b73da15f9a0f5591] [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-1] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] ~ subnetId: "subnet-037eec31203453d7b" => "subnet-08301af09876e1446" +-awsec2clientvpn/networkAssociationNetworkAssociation: (replace) [id=cvpn-assoc-0497a0192f16ad1b8] [urn=urnpulumistage:managed infraawsec2clientvpn/networkAssociationNetworkAssociation:assoc-0] [provider=urnpulumistage:managed infrapulumiprovidersawsdefault 1 19 0:20df1138-1914-4916-aa26-b87c05e0ab2d] ~ subnetId: "subnet-037eec31203453d7b" => "subnet-0d8f31780fdb9602b" Resources: +-2 to replace 52 unchanged

If

privateSubnetId

is unique & stable (doesn't change), then you should be able to hash (sha1/md5) that value and use it to create an ID that won't change. If the ID doesn't change, pulumi won't try to delete/create - it will only update if the subnetId of vpnEndpoint.id value changes.

I would think privateSubnetId is unique and stable after the sort. I was trying to create a unique name with the assoc-${i} there. I'm not sure why a more complex string there would help things unless I need to use that value in some other way.

Does it make any difference if you use the subnetIds to name the association? ``assoc-${subnetId}``

i'll give that a shot. it's certainly makes for a cleaner look.

Seems like a bug to me. Not sure how else to explain it 😞