Getting an Update without a Diff on BucketReplicationConfig when update package from v5 to v6

[zbuchheit]

What happened?

When attempting to run Pulumi Up after updating from v5 to v6 BucketReplicationConfig gives an update without a diff.

Example

Example Code

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws" // Update to v6 after up to see the issue
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/iam" // Update to v6 after up to see the issue
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/s3" // Update to v6 after up to see the issue

	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		srcBucket, err := s3.NewBucket(ctx, "srcBucket", &s3.BucketArgs{
			Versioning: &s3.BucketVersioningArgs{
				Enabled: pulumi.Bool(true),
			},
		}, pulumi.IgnoreChanges([]string{"replicationConfiguration"}))
		if err != nil {
			return err
		}
		destBucket, err := s3.NewBucket(ctx, "destinationBucket", &s3.BucketArgs{
			Versioning: &s3.BucketVersioningArgs{
				Enabled: pulumi.Bool(true),
			},
		})
		if err != nil {
			return err
		}

		role, err := iam.NewRole(ctx, "myRole", &iam.RoleArgs{
			AssumeRolePolicy: pulumi.String(`{
				"Version": "2012-10-17",
				"Statement": [
					{
						"Action": "sts:AssumeRole",
						"Principal": {
							"Service": "s3.amazonaws.com"
						},
						"Effect": "Allow"
					}
				]
			}`),
		})
		if err != nil {
			return err
		}

		callerIdentity, err := aws.GetCallerIdentity(ctx, nil, nil)
		if err != nil {
			return err
		}

		_, err = s3.NewBucketReplicationConfig(ctx, "replication", &s3.BucketReplicationConfigArgs{
			Role:   role.Arn,
			Bucket: srcBucket.ID(),
			Rules: s3.BucketReplicationConfigRuleArray{
				s3.BucketReplicationConfigRuleArgs{
					Id:     pulumi.String("rule1"),
					Status: pulumi.String("Enabled"),
					Filter: s3.BucketReplicationConfigRuleFilterArgs{},
					Destination: s3.BucketReplicationConfigRuleDestinationArgs{
						Account: pulumi.String(callerIdentity.AccountId),
						Bucket:  destBucket.Arn,
					},
					DeleteMarkerReplication: s3.BucketReplicationConfigRuleDeleteMarkerReplicationArgs{
						Status: pulumi.String("Enabled"),
					},
				},
			},
		})
		if err != nil {
			return err
		}

		// Export the name of the bucket
		ctx.Export("bucketName", srcBucket.ID())
		return nil
	})
}

Example Output

     Type                               Name         Plan       
     pulumi:pulumi:Stack                aws-go-dev              
 ~   └─ aws:s3:BucketReplicationConfig  replication  update     

Resources:
    ~ 1 to update
    4 unchanged

Do you want to perform this update? details
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::aws-go::pulumi:pulumi:Stack::aws-go-dev]
    ~ aws:s3/bucketReplicationConfig:BucketReplicationConfig: (update)
        [id=srcbucket-def88ff]
        [urn=urn:pulumi:dev::aws-go::aws:s3/bucketReplicationConfig:BucketReplicationConfig::replication]
        bucket    : "srcbucket-def88ff"
        role      : "arn:aws:iam::redacted:role/myRole-f1e7743"
        rules     : [
            [0]: {
                deleteMarkerReplication: {
                    status    : "Enabled"
                }
                destination            : {
                    accessControlTranslation: {
                        owner     : "Destination"
                    }
                    account                 : "redacted"
                    bucket                  : "arn:aws:s3:::destinationbucket-c3d0fe0"
                }
                filter                 : {
                }
                id                     : "rule1"
                status                 : "Enabled"
            }
        ]

Output of pulumi about

CLI          
Version      3.105.0
Go Version   go1.21.6
Go Compiler  gc

Plugins
NAME  VERSION
aws   6.22.1
go    unknown

Host     
OS       darwin
Version  14.2.1
Arch     arm64

This project is written in go: executable='/opt/homebrew/bin/go' version='go version go1.21.6 darwin/arm64'

Current Stack: zbuchheit-pulumi-corp/aws-go/dev

TYPE                                                    URN
pulumi:pulumi:Stack                                     urn:pulumi:dev::aws-go::pulumi:pulumi:Stack::aws-go-dev
pulumi:providers:aws                                    urn:pulumi:dev::aws-go::pulumi:providers:aws::default
aws:iam/role:Role                                       urn:pulumi:dev::aws-go::aws:iam/role:Role::myRole
aws:s3/bucket:Bucket                                    urn:pulumi:dev::aws-go::aws:s3/bucket:Bucket::destinationBucket
aws:s3/bucket:Bucket                                    urn:pulumi:dev::aws-go::aws:s3/bucket:Bucket::srcBucket
aws:s3/bucketReplicationConfig:BucketReplicationConfig  urn:pulumi:dev::aws-go::aws:s3/bucketReplicationConfig:BucketReplicationConfig::replication


Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/zbuchheit-pulumi-corp
User           zbuchheit-pulumi-corp
Organizations  zbuchheit-pulumi-corp,
Token type     personal

Dependencies:
NAME                                 VERSION
github.com/pulumi/pulumi-aws/sdk/v6  6.22.1
github.com/pulumi/pulumi/sdk/v3      3.105.0

Additional context

It seems to have to do something with the DeleteMarkerReplication and Filter fields. I don't get this behavior when those fields are not set.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[iwahbe]

Thanks for opening an issue @zbuchheit. Just to clarify, is the update persistent or does it go away if you actually run the update once?

[zbuchheit]

it goes away after you run the update once. It does result in some changes in the state when I checked the diff from before and after.