I'm just getting started and have a fairly small update going on that is taking a long time (updating an aws security group taking more than 10 minutes). Is there a good way to see what's happening behind the scenes?

You can turn up logging (

-v=9 --logtostderr

), but if the problem is in the provider rather than Pulumi, then that won't help much.

Are you using time-based AWS credentials by any chance? I’ve seen this myself with session-based creds that expire before I run Pulumi.

i am but there should be about 22 hours left on it

Credentials are often an issue. Are you using an explicit Pulumi provider that uses non-default credentials? Are you assuming a role that requires MFA (and not using MFA)? Have you multiple sources of credentials defined at once, and Pulumi is picking up a different one than you think it should be?

ahh, turns out it just took a really long time to tell me that there was a dependency issue (seems object needed to be deleted and recreated because the description wasn't the same)

That's very fast when Pulumi knows about the must-delete rule. If it's slow, it's probably your provider that is refusing to update. You can speed that up a lot by telling Pulumi that description is a cannot-update field. Onesec I'll get the docs...

looking back the provider made that clear to me, it just didn't have enough information to know it would fail. surprised it didn't return more quickly but just didn't understand the error from AWS and was trying to retry some number of times.