Is there a way to tell pulumi to update aws tags? It appears that it has identified that there’s a difference in tags, but doesn’t actually do anything about it.

updating stack...
Updating (test22):

    pulumi:pulumi:Stack AUTOIAM-TAMTOOL-test22 running
    aws:iam:User test22  [diff: ~tags]
 ~  aws:iam:UserPolicy useast-partner-datafeed updating [diff: ~policy]
 ~  aws:iam:UserPolicy useast-partner-datafeed updated [diff: ~policy]
    pulumi:pulumi:Stack AUTOIAM-TAMTOOL-test22

Resources:
    ~ 1 updated
    2 unchanged

can you show me the expanded diff?

of the tags? or is that a pulumi option to display an expanded diff?

You can select "Details" when running from the CLI, or run

pulumi diff

with the detailed option (I forget what it is..)

or run

pulumi diff

with the detailed option

It's

--diff

. So

pulumi up --diff

or

pulumi preview --diff

.

sorry to make it even more complicated, but i’m using the automation api

The automation-api shouldn't affect things so long as the stack exists in state. You can still run

pulumi preview --diff --stack <stackname>

from the command line. You might need to create a temporary "fake" stack yaml file? Not sure. Ideally, you won't have to...

i think i was able to achieve the same thing using

await stack.PreviewAsync(new PreviewOptions() {Diff = true});

i don’t see the iam user tags in the diff at all. this is the policy update that’s also happening.

Previewing update (test22):
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:test22::AUTOIAM-TAMTOOL::pulumi:pulumi:Stack::AUTOIAM-TAMTOOL-test22]
    ~ aws:iam/userPolicy:UserPolicy: (update)
        [id=test22:thetradedesk-useast-partner-datafeed]
        [urn=urn:pulumi:test22::AUTOIAM-TAMTOOL::aws:iam/userPolicy:UserPolicy::thetradedesk-useast-partner-datafeed]
        [provider=urn:pulumi:test22::AUTOIAM-TAMTOOL::pulumi:providers:aws::default_5_13_0::288879a8-1da1-4fcb-ac19-7f4d43bc7d7c]
      ~ policy: (json) {
            Id       : "AutoIAM"
          ~ Statement: [
              ~ [0]: {
                        Action   : "s3:ListBucket"
                      ~ Condition: {
                          ~ StringLike: {
                              ~ s3:prefix: [
                                    [0]: "test22/*"
                                    [1]: "test222/*"
                                    [2]: "test2222/*"
                                  + [3]: "test22222/*"
                                ]
                            }
                        }
                        Effect   : "Allow"
                        Resource : "arn:aws:s3:::thetradedesk-useast-partner-datafeed"
                        Sid      : "thetradedeskuseastpartnerdatafeed1"
                    }
              ~ [1]: {
                        Action  : [
                            [0]: "s3:GetObject"
                            [1]: "s3:GetObjectAcl"
                        ]
                        Effect  : "Allow"
                      ~ Resource: [
                            [0]: "arn:aws:s3:::thetradedesk-useast-partner-datafeed/test22/*"
                            [1]: "arn:aws:s3:::thetradedesk-useast-partner-datafeed/test222/*"
                            [2]: "arn:aws:s3:::thetradedesk-useast-partner-datafeed/test2222/*"
                          + [3]: "arn:aws:s3:::thetradedesk-useast-partner-datafeed/test22222/*"
                        ]
                        Sid     : "thetradedeskuseastpartnerdatafeed2"
                    }
                [2]: {
                        Action  : [
                            [0]: "s3:GetBucketLocation"
                            [1]: "s3:GetBucketACL"
                        ]
                        Effect  : "Allow"
                        Resource: "arn:aws:s3:::thetradedesk-useast-partner-datafeed"
                        Sid     : "thetradedeskuseastpartnerdatafeed3"
                    }
            ]
            Version  : "2012-10-17"
        }
Resources:
    ~ 1 to update
    2 unchanged

Hmm. Odd. How have you updated the tags? Is it by changing defaultTags? Afaik, those updates only happen when resources are also changed for other reasons. But if you've changed tags, then it should work...

No. I’m passing a dictionary that has 1 new tag in addition to the old tag.

Don't know. It may be a map implementation issue, and JS' idea of falsy including the empty string.

yes basically map class. I’m using C# dotnet, so it’s the Dictionary class. so basically it went from

{{"SomeOriginalTag", "SomeValue"}}

to

{{"SomeOriginalTag","SomeValue"}, {"POO-111", ""}}

and that didn’t work with the value as an empty string, which is a valid tag according to aws

Yes it should. There is a bug: that should work. I don't know how it works under the hood, but if the problem is with falsy values and empty strings (seems unlikely, I don't think "" is falsy in C#?), then you might try using the C# equivalent of

pulumi.output("")

? Since it's a "real" object, it might get around the "there's no object here, I'm skipping this" problem; but Pulumi still resolves it to the empty string.

it doesn’t look like I can do that since UserArgs accepts tags as a Dictionary<string,string> as referenced here if you click on C# https://www.pulumi.com/registry/packages/aws/api-docs/iam/user/#inputs

I'm pretty confident that the docs mean Input<string> when they say string. Look in the real API. The docs are simplified for readability.

it appears that Tags takes an InputMap<string>. A dictionary<string,string> seems to be automatically converted. I created an InputMap<string> object and passed that instead, but results are the same maybe because it’s still using string. I’m not really seeing a way to pass in Input<string> or Output<string>.

Have you tried

Pulumi.Output.Create("")

? Without the ToString(), that'd be wrong.

I did but inputmap<string> won’t take an output object

I don't know about the C# implementation. In Typescript, Outputs are Inputs; is that the same in C#? Or do you have to wrap an output to make it into an input?

I think the string is the input. The InputMap<string> takes strings, not Inputs. I could be misunderstanding how this works though.

It should take Input<string>, which (in Typescript) is a union of string and Output<string>. Everything in Pulumi that takes a string can also take an Output<string>.

Ok, so I created an InputMap<string> object and saw that .Add() takes a string and an Input<string>. I was able to do an Output.Create(“”) and pass that in for an Input<string> like you said. I then passed this object instead of the dictionary. The end result is the same. Tag difference identified and no action.

var inputmap = new InputMap<string>();
inputmap.Add("AutoIAMCreated", "true");
inputmap.Add("test",Output.Create(""));

updating stack...
Updating (test22):

    pulumi:pulumi:Stack AUTOIAM-TAMTOOL-test22 running
    aws:iam:User test22  [diff: ~tags]
    aws:iam:UserPolicy thetradedesk-useast-partner-datafeed
    pulumi:pulumi:Stack AUTOIAM-TAMTOOL-test22

Resources:
    3 unchanged

😞

yeah that looks pretty similar. their dictionary is <string,object> but mine was <string,string>. InputMap is a Pulumi class.

Vote for the issue then, add some notes / MCVE, and watch it 🙂

set a slack reminder for tomorrow morning. heading home. glad it wasn’t just me.