Hi For a resource like `aws iam Role` where there is a prope

Question

Hi For a resource like `aws iam Role` where there is a property `managedPolicyArns` if you import the resource or run `pulumi up refresh` pulumi will populate `managedPolicyArns` with the policy even if you use `aws iam PolicyAttachment` `aws iam RolePolicyAttachment` and `aws iam RolePolicy` <https www pulumi com registry packages aws api docs iam role |Pulumi warns that you should not use both> It is possible to use Resource Tranforms to remove `managedPolicyArns` but then running `pulumi up refresh` results in policies being detached and then only maybe being reattached Is it possible to use a resource like `aws iam Role` without `managedPolicyArns` in practice or do you really not have a choice

little-cartoon-10569 · Answer

You should not remove those values Those values are what s actually used in the AWS API Pulumi just manages them for you if you use the policy attachment resources or lets you manage them yourself if you use the Role properties directly

little-cartoon-10569 · Answer

Generally don t refresh if you don t have to

little-cartoon-10569 · Answer

As a specific workaround for this assuming you re using the attachment resources you can add `ignoreChanges` on the inline and managed policy ARN properties

curved-appointment-51749 · Answer

Thank you < little cartoon 10569> for responding Please correct me if I m wrong Are you saying that there is a difference between `managedPolicyArns` being set in code by me and being set by Pulumi How does Pulumi track whether it set it to store it in the state or whether I set it to store it in the state I expected that the two notes were about it being present in the state or absent from the state Policies do get attached and are managed by Pulumi when setting the following `managedPolicyArns ` and using something like `aws iam RolePolicyAttachment` If that is the case it may be worth adding another note about this in the documentation to explain this difference as it is unexpected

little-cartoon-10569 · Answer

gt How does Pulumi track whether it set it to store it in the state or whether I set it to store it in the state It doesn t Instead it tells you not to do this gt NOTE For a given role this resource is incompatible with using the aws iam Role resource managed policy arns argument When using that argument and this resource both will attempt to manage the role s managed policy attachments and the provider will show a permanent difference