The Environment Variable Keep Replacing

[KienKeng107]

What happened?

I just created the AWS CloudFront public key and added it to the environment as a secret variable by running this command:

cat ./public_key.pem | pulumi config set public_key --secret

I was able to deploy the public key to CloudFront successfully. However, every time I run pulumi preview or pulumi up, the public key is being replaced.

Example

pulumi.develop.yaml file

config:
  ...
  ...
  public-key:
    secure: AAABAJOP0wyBsseRieHS9v69QAG5d3FgKlesm98Q6SAjSavuP/dzEH6EMIrouDnS/yxJz+dzLH4FcqMy7sb2ymekYYX/6p3J21/4yrOHCdBraJcfM4GKwc1ITElpauvMfKvI51r+NAlax3E4M8Qp8qnVCCLcgmfdWjyMXWAo+T2J+zmZ8htKvLoyHfOKY6/ahKIke/Kvlu9F60yFcNFvc1aWWX/s+7UAq2CH1dVYnmeDKmwRwVUTqHL+v420gT5Nz6iT55LrlhfM7pQOgcyR0ctq9AQ5UO7n7CJodBITSUNLtgAJqwSb6vCJMK4jIbVmf4nOxz9Jll7iiJD+WmnT6QFEePkMofFgJWAXN0NLksKXKm8ziY9Mpry9Dss4HQqLgPK85RzxLNM35D4x2xxzvuHFASc+V+qwq8+ZyJSgltlbtTTn1wnfTKAN+TUS8quK1jTPmqoY4kLMCg7ai08B5lWCwSF7z5gPquY3aAXW0ZEvdA9nrRCJMuWlCA5ZGO8KZafLI43F9+6TOB9jvojMQlqr+7bPmmNrinrkJXvTKfFCsLmRxMnFimX7FtpSB1UFoFmo1SV6LsciSEYRTl/vnfQLd2WtE7ijw1Fac0q5yBEm7o7tJDXtsvQRVwWrS6zkieM=
  ....
  .....

Output of pulumi about

pulumi version : v3.140.0
Language: Golang
Platform: AWS

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

I can reproduce the problem - the difference is that the program contains the key material without the ending newline, but the provider somehow normalizes to adding a newline at the end. You can work around as follows for now:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const cfg = new pulumi.Config();

const pk = cfg.requireSecret("public_key")
    // Ensure that the key ends with a newline.
    .apply(s => s + "\n");

const publicKey = new aws.cloudfront.PublicKey("my-pk", {
    encodedKey: pk,
});

Once the newline is added there is no more permanent replace plans.

[t0yv0]

I have filed an upstream issue as the Pulumi provider is inheriting this behavior from the Terraform provider. This could be best fixed upstream by using DiffSuppressFunc or similar functionality: hashicorp/terraform-provider-aws#40295