What works: • Everything works if I am not using a component as part of a package with a generated SDK (i.e. importing the Python library and using the component resource directly works perfectly) • If I don't set any Output values in the configuration for the ingress rules, it also works when used from the packaged component library What doesn't work: • For some reason, when I try to use, for example, a

pulumi.Output[str]

value for a CIDR block in one of the configuration values for an ingress rule, instead of just setting the cidr block setting as an Output, it appears that the entire ingress_rules setting gets turned into a pulumi.Output So I have code like this defining my component (omitting the pydantic model configs that allow it to accept arbitrary types and all that):

import pydantic

...
class EC2SecurityGroupIngressRule(pydantic.BaseModel):
    """Config for an AWS EC2 Security Group ingress rule."""
...

    ipv4_cidr_block: Input[str] | None = None
    """The IPv4 CIDR block this rule applies to."""

class EC2SecurityGroupArgs(pydantic.BaseModel):
    """Config for an AWS EC2 Security Group."""

...
    ingress_rules: Mapping[str, EC2SecurityGroupIngressRule] | None = None
    """The ingress rules for the security group."""

Instead of getting a Mapping, I'm getting a pulumi.Output for

ingress_rules

and I know this because Pydantic says so:

error: custom:index:EC2SecurityGroup resource 'my-group' has a problem: Unexpected <class 'Exception'>: 1 validation error for EC2SecurityGroupArgs                               
    ingress_rules                                                                                                                                                                                   
      Input should be a valid dictionary [type=dict_type, input_value=<pulumi.output.Output object at 0x7ff549a22c40>, input_type=Output]                                                           
        For further information visit <https://errors.pydantic.dev/2.11/v/dict_type>:
...

I have tried recreating this issue using TypedDicts but the amount of work it takes to recreate all of the moving bits is monumental and I don't want to have to give up type safety and model validators to easily set defaults just to be able to write multi-language components.

The place where I am instantiating the component resource looks like this:

my_security_group = EC2SecurityGroup(
            f"{resource_id}-something",
            args=EC2SecurityGroupArgs(
                name=f"vpc-{resource_id}-my-endpoint",
                description="Security group for my endpoint",
                ingress_rules={
                    "https": EC2SecurityGroupIngressRuleArgs(
                        name="https",
                        protocol=EC2SecurityGroupRuleProtocol.TCP,
                        from_port=443,
                        to_port=443,
                        ipv4_cidr_block=vpc.ipv4_cidr_block, <--- This is an Output[str]
                        description="Allow HTTPS access",
                    ),

                },
                vpc_id=vpc.vpc_id,
            ),
        )

It's not like I am wrapping this argument in an apply() call or something, so I have absolutely no idea what I could possibly be doing here to even end up in the situation where I have an output for this value. It just doesn't make any sense and I can't see anything super obvious that I have done wrong on my side

this would still be valid for just T

Having the whole dict get converted to an Output makes handling the data in the component very painful as you potentially have layers of Outputs and the whole component's content might as well live in an apply, and (as far as I understand) you wouldn't be able to see what changes would be made during an update if the whole thing lives in an apply

Just seems very unusual to me that this Output object needs to be bubbled all the way to the top

all I can advise as a starting point for now though is just to start implementing Input[...] into your models and see how quickly you hit a complexity wall

I think the part where this really hurts is that because my Mapping is being used to create objects, I don't know how I can avoid creating resources within an apply, which makes creating multiple resources inside the component resource difficult from a map not work well, which is what creating component resources is all about. Are there any ways to work around that?

Holy guacamole, I recreated it. It seems like resource transforms break this. I'm going to log an issue with my recreation

https://github.com/pulumi/pulumi/issues/20536 is the issue logged