Hi, Hope someone can be off assistance - I'm guessing it's a bug in the Pulumi Cloud Service. I've tried setting up a simple test case:

import { LocalWorkspace } from '@pulumi/pulumi/automation';

LocalWorkspace.createOrSelectStack({
    stackName: 'debug-stack',
    workDir: 'debug'
}, {
    stackSettings: {
        ['debug-stack']: {
            config: {
                'debug-stack:accountId': '012345678912',
                'aws:allowedAccountIds': ['012345678912'],
                'aws:region': 'eu-west-1'
            }
        }
    },
    envVars: { AWS_PROFILE: 'REDACTED', PULUMI_ACCESS_TOKEN: 'REDACTED' }
}).then(stack => {
    stack.up({ onEvent: console.log }).then(result => console.log(result.summary));
});

What happens is, after the stack is created in the pulumi cloud, the stack is set without the trailing 0 on the accountId. The local

Pulumi.debug-stack.yaml

file is created correctly at this point. When running up, the state is read from the pulumi cloud and then fails, as it validates against allowed account ids [ '12345678912']. When looking at the up request onEvent output, the preludeEvent shows:

{
  sequence: 0,                                   
  timestamp: 1669902905,
  preludeEvent: {                                
    config: {                                    
      'aws:allowedAccountIds': '[12345678912]',  
      'aws:region': 'eu-west-1',
      'debug-stack:accountId': '1.2345678912e+10'
    }
  }
}

So my guess is there is a type conversion error happening in the Cloud Service.

Interesting, let me check with engineering.

Hi Engin, I've created a support ticket.

Many thanks Steffen!

Yeah, I noticed that I could not see the issue 😉. Thanks for keeping me updated and enjoy your weekend.

I moved the issue as it is an automation issue and not service-> https://github.com/pulumi/pulumi/issues/11518 Have a nice weekend too Steffen!

I've worked around it in our specific use case, so for now it isn't blocking - but it's not pretty either and this is still a thing that could give potential headaches down the line. The workaround plays on how the config is loaded, so we can set the

aws:allowedAccountIds

by doing

JSON.stringify(['012345678912'])

. This only works for objects.