Plugin Framework based resources display confusing diffs

[t0yv0]

What happened?

It remains the case that Plugin Framework based resources do not implement the detailedDiff computation as yet, which can lead to sub-optimal experiences for users of these resources. For example, since Pulumi CLI does not yet natively understand the Set data type, making changes to properties typed as Set will show extraneously long diffs (this is essentially #186 but specifically for Plugin Framework based resources).

Example

For a worked example, let us consider an aws.appconfig.Environment resource which is an example of a resource that is using Plugin Framework and has a Set-typed property.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const cfg = new pulumi.Config();

const step = cfg.requireNumber("step");


const exampleApplication = new aws.appconfig.Application("example", {
    name: "example-application-tf",
    description: "Example AppConfig Application",
});

function cpuUtilAlarm(n: number): aws.cloudwatch.MetricAlarm {
    return new aws.cloudwatch.MetricAlarm(`metricalarm${n}`, {
        name: `metricalarm${n}`,
        comparisonOperator: "GreaterThanOrEqualToThreshold",
        evaluationPeriods: 2,
        metricName: "CPUUtilization",
        namespace: "AWS/EC2",
        period: 120,
        statistic: "Average",
        threshold: 80,
        alarmDescription: "This metric monitors ec2 cpu utilization",
        insufficientDataActions: [],
    });
}

const testRole = new aws.iam.Role("appconfig-monitoring-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Sid: "",
            Principal: {
                Service: "appconfig.amazonaws.com",
            },
        }],
    }),
});

const example = new aws.appconfig.Environment("example", {
    name: "example-environment-tf",
    description: "Example AppConfig Environment",
    applicationId: exampleApplication.id,
    monitors: step === 0 ? [
        {
            alarmArn: cpuUtilAlarm(1).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(2).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(3).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(4).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(5).arn,
            alarmRoleArn: testRole.arn,
        },
    ] : [
        {
            alarmArn: cpuUtilAlarm(1).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(2).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(4).arn,
            alarmRoleArn: testRole.arn,
        },
        {
            alarmArn: cpuUtilAlarm(5).arn,
            alarmRoleArn: testRole.arn,
        },
    ]
});

export const envID = example.id;

To reproduce:

#!/usr/bin/env bash

set -euo pipefail

pulumi destroy --yes
pulumi config set step 0
pulumi up --yes --skip-preview
pulumi config set step 1
pulumi preview --diff

This will output:

View Live: https://app.pulumi.com/anton-pulumi-corp/aws-appconfig-set-diffs/dev/previews/c708fa14-f53c-45e9-a3c1-9cbca358fe82

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::aws-appconfig-set-diffs::pulumi:pulumi:Stack::aws-appconfig-set-diffs-dev]
    ~ aws:appconfig/environment:Environment: (update)
        [id=00fr7nd:g4fi554]
        [urn=urn:pulumi:dev::aws-appconfig-set-diffs::aws:appconfig/environment:Environment::example]
        [provider=urn:pulumi:dev::aws-appconfig-set-diffs::pulumi:providers:aws::default_6_63_0::ac944680-fbc5-4194-8fbb-446a89ec6e17]
      ~ monitors: [
            [0]: {
                    alarmArn    : "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm1"
                    alarmRoleArn: "arn:aws:iam::616138583583:role/appconfig-monitoring-role-6e33f25"
                }
            [1]: {
                    alarmArn    : "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm2"
                    alarmRoleArn: "arn:aws:iam::616138583583:role/appconfig-monitoring-role-6e33f25"
                }
          ~ [2]: {
                  ~ alarmArn    : "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm3" => "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm4"
                    alarmRoleArn: "arn:aws:iam::616138583583:role/appconfig-monitoring-role-6e33f25"
                }
          ~ [3]: {
                  ~ alarmArn    : "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm4" => "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm5"
                    alarmRoleArn: "arn:aws:iam::616138583583:role/appconfig-monitoring-role-6e33f25"
                }
          - [4]: {
                  - alarmArn    : "arn:aws:cloudwatch:us-east-1:616138583583:alarm:metricalarm5"
                  - alarmRoleArn: "arn:aws:iam::616138583583:role/appconfig-monitoring-role-6e33f25"
                }
        ]
    - aws:cloudwatch/metricAlarm:MetricAlarm: (delete)
        [id=metricalarm3]
        [urn=urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm3]
        [provider=urn:pulumi:dev::aws-appconfig-set-diffs::pulumi:providers:aws::default_6_63_0::ac944680-fbc5-4194-8fbb-446a89ec6e17]
        actionsEnabled         : true
        alarmDescription       : "This metric monitors ec2 cpu utilization"
        comparisonOperator     : "GreaterThanOrEqualToThreshold"
        evaluationPeriods      : 2
        insufficientDataActions: []
        metricName             : "CPUUtilization"
        name                   : "metricalarm3"
        namespace              : "AWS/EC2"
        period                 : 120
        statistic              : "Average"
        threshold              : 80
        treatMissingData       : "missing"
Resources:
    ~ 1 to update
    - 1 to delete
    2 changes. 7 unchanged

Note that only one element was removed from the user program, but the diff is confusing because four entries are shown.

Output of pulumi about

CLI          
Version      3.141.0
Go Version   go1.23.3
Go Compiler  gc

Plugins
KIND      NAME    VERSION
resource  aws     6.63.0
resource  awsx    2.19.0
resource  docker  4.5.7
resource  docker  3.6.1
language  nodejs  unknown

Host     
OS       darwin
Version  14.6.1
Arch     arm64

This project is written in nodejs: executable='/run/current-system/sw/bin/node' version='v20.18.0'

Current Stack: anton-pulumi-corp/aws-appconfig-set-diffs/dev

TYPE                                    URN
pulumi:pulumi:Stack                     urn:pulumi:dev::aws-appconfig-set-diffs::pulumi:pulumi:Stack::aws-appconfig-set-diffs-dev
pulumi:providers:aws                    urn:pulumi:dev::aws-appconfig-set-diffs::pulumi:providers:aws::default_6_63_0
aws:cloudwatch/metricAlarm:MetricAlarm  urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm4
aws:cloudwatch/metricAlarm:MetricAlarm  urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm5
aws:appconfig/application:Application   urn:pulumi:dev::aws-appconfig-set-diffs::aws:appconfig/application:Application::example
aws:cloudwatch/metricAlarm:MetricAlarm  urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm1
aws:cloudwatch/metricAlarm:MetricAlarm  urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm2
aws:iam/role:Role                       urn:pulumi:dev::aws-appconfig-set-diffs::aws:iam/role:Role::appconfig-monitoring-role
aws:cloudwatch/metricAlarm:MetricAlarm  urn:pulumi:dev::aws-appconfig-set-diffs::aws:cloudwatch/metricAlarm:MetricAlarm::metricalarm3
aws:appconfig/environment:Environment   urn:pulumi:dev::aws-appconfig-set-diffs::aws:appconfig/environment:Environment::example


Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/anton-pulumi-corp
User           anton-pulumi-corp
Organizations  anton-pulumi-corp, moolumi, demo, pulumi
Token type     personal

Dependencies:
NAME            VERSION
@pulumi/aws     6.63.0
@pulumi/awsx    2.19.0
@pulumi/pulumi  3.142.0
@types/node     18.19.67
typescript      5.7.2

Pulumi locates its logs in /var/folders/gd/3ncjb1lj5ljgk8xl5ssn_gvc0000gn/T/com.apple.shortcuts.mac-helper// by default

Additional context

Please keep this issue open until there is a bridge release fixing the problem. There was a lot of work done toward this problem:

• [Plugin Framework] Support computing DetailedDiff in Diff method for best CLI experience #752 has an implementation currently under a flag
• Detailed diff does not mark fully computed properties for recomputation when the resource is replaced #2660 seems to regress behavior meaningfully and blocks the current implementation and needs to be addressed first
• Accurate bridge previews rollout plan #2598 tracks rollout

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).