I am not entirely sure how to reproduce yet, but it appears Pulumi has managed to get out of sync with itself (only one github action runs it), and it has the diff for an update wrong. It wants to remove what I want to add, and correctly in AWS the state reflects what Pulumi wanted to remove. Looking at the Pulumi scripts, they clearly agree with me, not Pulumi. I have no idea whats going on, but currently I have a hard time trusting the state managed by Pulumi. Has anyone seen anything similar? Could it potentially be a problem where a github action times out or something and appears to have successfully completed, but the state was not completely transferred to the pulumi service?

Could it potentially be a problem where a github action times out or something and appears to have successfully completed, but the state was not completely transferred to the pulumi service?

That's possible but the state will record that it started the operation, and warn you about partial operatings if that happens. Can you

pulumi refresh

the stack to see if pulumi thinks it's out of sync with AWS?

Not easily, no. I can add a manually trigger to the github action and see, but for now I ended up committing a change that removed the resource, and recreated it again, and it appears to add or remove actions within this AWS policy just fine now. If it happens again, I will do a refresh and perhaps create a bug report / reply in this thread?

Bug reports are easier to keep track of

Sure, I will create one if it happens again and try to reproduce it if possible

Just post as much info as possible, what happened, the output from the

up

that failed, etc. If we need more we can reply to the ticket.