diff --git a/unstable/logging/logging.go b/unstable/logging/logging.go
index 5474305442..7577726779 100644
--- a/unstable/logging/logging.go
+++ b/unstable/logging/logging.go
@@ -207,10 +207,15 @@ func setupRootLoggers(ctx context.Context, output io.Writer) context.Context {
 }
 
 // Choose the default level carefully: logs at this level or higher (more severe) will be shown to the user of Pulumi
-// CLI directly by default. Experimentally it seems that Info is too verbose, for example Cloudflare provider emits
-// routine authentication messages at INFO level.
+// CLI directly by default. Experimentally it seems that WARN is too verbose:
+//
+// - AWS (via terraform-plugin-sdk@v2) emits developer logs at WARN which are not shown to terraform users.
+//
+// Citation:
+// - https://github.com/hashicorp/terraform-plugin-sdk/blob/43cfd3282307f68ea77eb4c15548100386f3a317/helper/customdiff/force_new.go#L32-L35
+// - https://github.com/pulumi/pulumi-aws/issues/3389
 func defaultTFLogLevel() hclog.Level {
-	return hclog.Warn
+	return hclog.Error
 }
 
 func makeLoggerOptions(name string, level hclog.Level, output io.Writer) *hclog.LoggerOptions {
@@ -270,26 +275,7 @@ func (w *logSinkWriter) Write(p []byte) (n int, err error) {
 }
 
 func parseTfLogEnvVar() hclog.Level {
-	env, present := os.LookupEnv(tfLogEnvVar)
-	if !present {
-		return hclog.NoLevel
-	}
-	switch strings.ToUpper(env) {
-	case "ERROR":
-		return hclog.Error
-	case "WARN":
-		return hclog.Warn
-	case "INFO":
-		return hclog.Info
-	case "TRACE":
-		return hclog.Trace
-	case "DEBUG":
-		return hclog.Debug
-	case "OFF":
-		return hclog.Off
-	default:
-		return hclog.NoLevel
-	}
+	return hclog.LevelFromString(os.Getenv(tfLogEnvVar))
 }
 
 var quotedUrnPattern = regexp.MustCompile(`[ ]urn=["]([^"]+)["]`)
diff --git a/unstable/logging/logging_test.go b/unstable/logging/logging_test.go
index a721682637..f8ba811f32 100644
--- a/unstable/logging/logging_test.go
+++ b/unstable/logging/logging_test.go
@@ -31,6 +31,8 @@ import (
 func TestLogging(t *testing.T) {
 	urn := resource.URN("urn:pulumi:prod::web::custom:resources:Resource$random:index/password:Password::my-pw")
 
+	warn := map[string]string{"TF_LOG": "WARN"}
+
 	cases := []struct {
 		name string
 		opts LogOptions
@@ -39,8 +41,11 @@ func TestLogging(t *testing.T) {
 		env  map[string]string
 	}{
 		{
-			name: "WARN and higher propagates by default",
+			name: "logging is disabled by default",
 			opts: LogOptions{},
+			env: map[string]string{
+				"TF_LOG": "",
+			},
 			emit: func(ctx context.Context) {
 				tflog.Trace(ctx, "Something went wrong TRACE")
 				tflog.Debug(ctx, "Something went wrong DEBUG")
@@ -49,10 +54,6 @@ func TestLogging(t *testing.T) {
 				tflog.Error(ctx, "Something went wrong ERROR ")
 			},
 			logs: []log{
-				{
-					msg: `Something went wrong WARN`,
-					sev: diag.Warning,
-				},
 				{
 					msg: `Something went wrong ERROR`,
 					sev: diag.Error,
@@ -114,6 +115,7 @@ func TestLogging(t *testing.T) {
 		{
 			name: "URN propagates when set",
 			opts: LogOptions{URN: urn},
+			env:  warn,
 			emit: func(ctx context.Context) {
 				tflog.Warn(ctx, "OK")
 			},
@@ -121,6 +123,7 @@ func TestLogging(t *testing.T) {
 		},
 		{
 			name: "Provider propagates when set",
+			env:  warn,
 			opts: LogOptions{ProviderName: "random"},
 			emit: func(ctx context.Context) {
 				tflog.Warn(ctx, "OK")
@@ -130,6 +133,7 @@ func TestLogging(t *testing.T) {
 		{
 			name: "ProviderVersion propagates when set",
 			opts: LogOptions{ProviderName: "random", ProviderVersion: "4.12.0"},
+			env:  warn,
 			emit: func(ctx context.Context) {
 				tflog.Warn(ctx, "OK")
 			},
@@ -137,6 +141,7 @@ func TestLogging(t *testing.T) {
 		},
 		{
 			name: "User Logging",
+			env:  warn,
 			opts: LogOptions{URN: urn},
 			emit: func(ctx context.Context) {
 				log := getLogger(ctx)