I'm encountering an error that is almost certainly a bug with the aws-native provider. I have an IPSet with a single tag applied and it works but subsequent updates fail with the following error:

aws-native:wafv2:IPSet (dev-whitelist-global):
    error: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: a6668364-2888-479c-8e12-8c0179ccc795, api error ValidationException: Model validation failed (#/Tags: expected minimum item count: 1, found: 0)

In order to get around this, I need to comment out the tags and it works for one deploy. Then on the next deploy that updates the IPSet it fails with the same error and I need to uncomment the tags for it to succeed and the cycle repeats. The tags are just

[
  {
    key: 'env',
    value: 'development',
  },
]

Please file an issue in the aws native provider repo

Looks like someone already reported it https://github.com/pulumi/pulumi-aws-native/issues/415