No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

You should not remove those values. Those values are what's actually used in the AWS API. Pulumi just manages them for you if you use the policy attachment resources, or lets you manage them yourself if you use the Role properties directly.

Generally: don't refresh if you don't have to.

As a specific workaround for this, assuming you're using the attachment resources, you can add `ignoreChanges` on the inline and managed policy ARN properties.

Thank you <@U012UJTT55M> for responding. Please correct me if I'm wrong. Are you saying that there is a difference between `managedPolicyArns`  being set in code by me and being set by Pulumi? How does Pulumi track whether it set it to store it in the state or whether I set it to store it in the state? I expected that the two notes were about it being present in the state or absent from the state. Policies do get attached and are managed by Pulumi when setting the following `managedPolicyArns: []` and using something like `aws.iam.RolePolicyAttachment`.

If that is the case, it may be worth adding another note about this in the documentation to explain this difference as it is unexpected.

&gt; How does Pulumi track whether it set it to store it in the state or whether I set it to store it in the state?
It doesn't. Instead, it tells you not to do this:
&gt; NOTE: For a given role, this resource is incompatible with using the aws.iam.Role resource managed_policy_arns argument. When using that argument and this resource, both will attempt to manage the role’s managed policy attachments and the provider will show a permanent difference.