removing vpcConfig from CallbackFunction does not result in change detection

[lalitkapoor]

What happened?

I want to remove the VPC configuration from a lambda function, but doing so and running pulumi up does not detect any changes.

Expected Behavior

pulumi up should detect the change in configuration

Steps to reproduce

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";

const STACK = pulumi.getStack().trim();

const CIDR_BLOCK = "10.0.0.0/16";

// Construct a VPC
const vpc = new awsx.ec2.Vpc("main", {
  cidrBlock: CIDR_BLOCK,
  subnets: [
    { type: "public", name: "main-public" },
    { type: "private", name: "main-private" },
    { type: "isolated", name: "db" }
  ],
  tags: { env: STACK }
});

var securityGroupIds: pulumi.Input<pulumi.Input<string>[]> = [];

const defaultSecurityGroup = new aws.ec2.SecurityGroup("default", {
  vpcId: vpc.id,
  ingress: [],
  egress: [
    {
      protocol: "-1",
      fromPort: 0,
      toPort: 0,
      cidrBlocks: ["0.0.0.0/0"],
      ipv6CidrBlocks: ["::/0"]
    }
  ]
});

securityGroupIds.push(defaultSecurityGroup.id);

const testHandler = function(
  vpc: awsx.ec2.Vpc,
  securityGroupIds: pulumi.Input<string>[]
) {
  return new aws.lambda.CallbackFunction(`test-${STACK}`, {
    tags: { env: STACK },
    runtime: "nodejs16.x",
    policies: [
      aws.iam.ManagedPolicy.LambdaFullAccess,
      aws.iam.ManagedPolicy.CloudWatchFullAccess,
      aws.iam.ManagedPolicy.CloudWatchEventsFullAccess,
      aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole
    ],
    vpcConfig: {
      subnetIds: vpc.privateSubnetIds,
      securityGroupIds: securityGroupIds
    },
    callbackFactory: () => {
      return async (request: awsx.apigateway.Request) => {
        console.log(request.body);
        return { statusCode: 202 };
      };
    }
  });
};

const test = testHandler(vpc, securityGroupIds);
export const testId = test.id;

Note vpcConfig . If I remove vpcConfig from the callback function configuration and run pulumi up it does not detect any changes.

Output of pulumi about

CLI          
Version      3.73.0
Go Version   go1.20.5
Go Compiler  gc

Plugins
NAME            VERSION
aws             5.10.0
aws             4.38.1
aws-apigateway  0.0.6
docker          3.1.0
nodejs          unknown

Host     
OS       darwin
Version  13.3.1
Arch     arm64

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[kpitzen]

Hi @lalitkapoor - thank you for submitting this issue! Your repro seems comprehensive enough for us to take a look at this, so we'll get it lined up as soon as we can. Thank you again!

[lalitkapoor]

@kpitzen While this issue is being addressed, is there a recommended work around?

[lalitkapoor]

@kpitzen bump for any advice here. Thanks.

[lukehoban]

This does appear to be a bug in the diff logic, most likely in tfbridge.

While this issue is being addressed, is there a recommended work around?

A workaround though is to change the vpcConfig to this instead of removing it:

    vpcConfig: {
      subnetIds: [],
      securityGroupIds: [],
    },

I tried that out and it does correctly remove the VPC configuration on the lambda.

[VenelinMartinov]

This issue seems to have been fixed in recent versions of the aws provider. I tested this with 5.10.0 and it reproduced but with 6.17.0 running the steps does produce a diff in the lambda function, although there's nothing in the detailed diff.

I also verified that the state is correctly updated after running pulumi up after commenting out the vpcConfig.

The issue with makeDetailedDiff is tracked under pulumi/pulumi-terraform-bridge#1504