IgnoreChanges works differently on refresh than it does on update about pulumi

[lunaris]

After some investigation, I think this is an issue in the provider (or rather, our bridging of the AWS provider), potentially due to the issues around handling sets and the reordering problems that ensue (see pulumi/pulumi-terraform-bridge#1904). Indeed, in that issue @t0yv0 predicts that it may have a knock-on effect on refreshes performing full diffs.

Reasons I'm inclined to say this isn't a bug that refresh has introduced:

• We are calling the exact same Diff method with the exact same arguments (including the passing of IgnoreChanges), and the provider has no way to know whether this is being called in response to a refresh or an update, so it shouldn't be able to introduce new (broken) behaviour.
• If I manually modify my state using export/import to reorder the two target groups until they (presumably) match the order the provider is going to pick, I still get diffs. If I use PULUMI_DEBUG_GRPC to dump the calls, I can see that a diff is being reported against the ARNs, even though they are byte-for-byte identical. This leads me to think it is the reordering issue -- the bridged provider spots the diff, Pulumi then reports it but it doesn't make sense/visually surface because our handling of the sets means that our consistent ordering masks the diff (see below where defaultActions[0].forward.targetGroups[0].arn is identical across all resource states).

{
  "method": "/pulumirpc.ResourceProvider/Diff",
  "request": {
    "id": "arn:aws:elasticloadbalancing:us-east-1:616138583583:listener/app/lb-c02916b/da56acbc7fbff239/0edf8d54df1a8fe7",
    "urn": "urn:pulumi:dev::elb-ignore-changes-bug::aws:lb/listener:Listener::listener",
    "olds": {
      ...
      "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:listener/app/lb-c02916b/da56acbc7fbff239/0edf8d54df1a8fe7",
      "defaultActions": [
        {
          ...
          "forward": {
            "stickiness": {
              "duration": 3600,
              "enabled": false
            },
            "targetGroups": [
              {
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg2-06f4221/b767b73c9c873857",
                "weight": 3
              },
              {
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg-17e0b6b/f084db5525f1dd3a",
                "weight": 2
              }
            ]
          },
          "order": 1,
          "redirect": null,
          "targetGroupArn": "",
          "type": "forward"
        }
      ],
      "id": "arn:aws:elasticloadbalancing:us-east-1:616138583583:listener/app/lb-c02916b/da56acbc7fbff239/0edf8d54df1a8fe7",
      "loadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:loadbalancer/app/lb-c02916b/da56acbc7fbff239",
      ...
    },
    "news": {
      "__defaults": [],
      "defaultActions": [
        {
          "__defaults": [],
          "forward": {
            "__defaults": [],
            "stickiness": {
              "duration": 3600
            },
            "targetGroups": [
              {
                "__defaults": [],
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg2-06f4221/b767b73c9c873857",
                "weight": 2
              },
              {
                "__defaults": [],
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg-17e0b6b/f084db5525f1dd3a",
                "weight": 1
              }
            ]
          },
          "type": "forward"
        }
      ],
      "loadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:loadbalancer/app/lb-c02916b/da56acbc7fbff239",
      "port": 80
    },
    "ignoreChanges": [
      "defaultActions[*].forward.targetGroups[*].weight"
    ],
    "oldInputs": {
      "__defaults": [],
      "defaultActions": [
        {
          "__defaults": [],
          "forward": {
            "__defaults": [],
            "stickiness": {
              "duration": 3600
            },
            "targetGroups": [
              {
                "__defaults": [],
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg2-06f4221/b767b73c9c873857",
                "weight": 3
              },
              {
                "__defaults": [],
                "arn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:targetgroup/tg-17e0b6b/f084db5525f1dd3a",
                "weight": 2
              }
            ]
          },
          "type": "forward"
        }
      ],
      "loadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:616138583583:loadbalancer/app/lb-c02916b/da56acbc7fbff239",
      "port": 80
    }
  },
  "response": {
    "stables": [
      "loadBalancerArn"
    ],
    "changes": "DIFF_SOME",
    "diffs": [
      "defaultActions",
      "defaultActions",
      "defaultActions",
      "defaultActions"
    ],
    "detailedDiff": {
      "defaultActions[0].forward.targetGroups[0].arn": {
        "kind": "UPDATE"
      },
      "defaultActions[0].forward.targetGroups[0].weight": {
        "kind": "UPDATE"
      },
      "defaultActions[0].forward.targetGroups[1].arn": {
        "kind": "UPDATE"
      },
      "defaultActions[0].forward.targetGroups[1].weight": {
        "kind": "UPDATE"
      }
    },
    "hasDetailedDiff": true
  },
  "metadata": {
    "kind": "resource",
    "mode": "client",
    "name": "aws"
  }
}

• There appears to be some funkiness with this specific example because e.g. a "clean" refresh seems very difficult -- the provider will set defaultActions[0].forward.stickiness.duration = 3600, for instance, which also shows up in the diff. If I fudge my state file using export/import to get rid of this, I can get rid of this but it could also be contributing since IgnoreChanges only affects what is shown, not what is applied to state.

My proposal would therefore be to close this in favour of pulumi/pulumi-terraform-bridge#1904. Thoughts?

[pierskarsenbarg]

Should this be closed or moved to the AWS provider repo?