Cognito - always replacing resource

I’m deploying a Cognito resource with the following config:

new aws.cognito.UserPool("api-user-pool", {
        passwordPolicy: {
            minimumLength: 8,
            requireLowercase: false,
            requireNumbers: false,
            requireSymbols: false,
            requireUppercase: false,
            temporaryPasswordValidityDays: 7
        },
        adminCreateUserConfig: {
            allowAdminCreateUserOnly: true
        },
        autoVerifiedAttributes: ["email"],
        emailConfiguration: {
            emailSendingAccount: "COGNITO_DEFAULT"
        },
        mfaConfiguration: "OFF",
        userPoolAddOns: {
            advancedSecurityMode: "OFF" /* required */
        },
        usernameAttributes: ["email"],
        verificationMessageTemplate: {
            defaultEmailOption: "CONFIRM_WITH_CODE"
        },
        schemas: [
            {
                attributeDataType: "String",
                name: "email",
                required: true,
                developerOnlyAttribute: false,
                mutable: true
            },
            {
                attributeDataType: "String",
                name: "family_name",
                required: true,
                developerOnlyAttribute: false,
                mutable: true
            },
            {
                attributeDataType: "String",
                name: "given_name",
                required: true,
                developerOnlyAttribute: false,
                mutable: true
            }
        ]
    })

After trying to redeploy the stack, the userPool always gets replaced, even though the config is the same. This should not happen.

Expected Behavior

The Cognito user pool should not get replaced, it should stay the same.

Current Behavior

The Cognito user pool is being replaced.

Steps to Reproduce

1. Create a simple Pulumi index.ts and paste the above code.
2. Run pulumi up
3. Run pulumi up again - it will tell you that it will replace the Cognito user pool

What I’ve discovered

I went to my state file, and discovered that in there, in the schemas property, each item has also:

stringAttributeConstraints: {
                    maxLength: "2048",
                    minLength: "0"
                }

After I’ve added this to each item in my template, everything started to work correctly.

So it seems that for some reason, the state file and my template are not the same (because of stringAttributeConstraints property difference), and then Pulumi decides to replace the resource. Not sure if this means something to you guys, but nevertheless, I decided to include it in the report.

[stack72]

Thank you!!

[lukehoban]

FWIW - I now see this in the diff:

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::testaws::pulumi:pulumi:Stack::testaws-dev]
    ~ aws:cognito/userPool:UserPool: (update)
        [id=us-west-2_WAb4b9DxY]
        [urn=urn:pulumi:dev::testaws::aws:cognito/userPool:UserPool::api-user-pool]
        [provider=urn:pulumi:dev::testaws::pulumi:providers:aws::default_5_21_1::0856075f-1ec7-42ae-9e4f-c349510331c0]
      ~ schemas: [
          ~ [0]: {
                  ~ attributeDataType         : "String" => "String"
                  + developerOnlyAttribute    : false
                  ~ mutable                   : true => true
                  ~ name                      : "family_name" => "email"
                  ~ required                  : true => true
                  - stringAttributeConstraints: {
                      - maxLength: "2048"
                      - minLength: "0"
                    }
                }
          ~ [1]: {
                  ~ attributeDataType         : "String" => "String"
                  + developerOnlyAttribute    : false
                  ~ mutable                   : true => true
                  ~ name                      : "given_name" => "family_name"
                  ~ required                  : true => true
                  - stringAttributeConstraints: {
                      - maxLength: "2048"
                      - minLength: "0"
                    }
                }
          ~ [2]: {
                  ~ attributeDataType         : "String" => "String"
                  + developerOnlyAttribute    : false
                  ~ mutable                   : true => true
                  ~ name                      : "email" => "given_name"
                  ~ required                  : true => true
                  - stringAttributeConstraints: {
                      - maxLength: "2048"
                      - minLength: "0"
                    }
                }
        ]

The reordering rendering being noisy is due to https://github.com/pulumi/pulumi-terraform-bridge/issues/186.

The removal of stringAttributeConstraints is due to https://github.com/hashicorp/terraform-provider-aws/issues/20276.