Pulumi AWS Provider

Carrying state migrations in a patch carries significant risk because Pulumi's bridge behavior might not persist migrations as expected. For example, during a no-refresh pulumi up, the bridge might run an upgrader during diff computation, but if no diff is detected, the upgraded state may not be written to disk, leading to old state being used during later deletions.

Before carrying a state migration, you must:

• Confirm the migration is required instead of making provider operations compatible with existing state.
• Compare the schema version and migration with the upstream pull request.
• Explain how future upstream replacements will consume state written by this patch.
• Add a Pulumi provider-upgrade test that covers:
  • Creating state with a released provider.
  • No-refresh updates.
  • Refresh operations.
  • Direct deletions.
• Preserve identifiers needed by later operations unless live lifecycle evidence proves a migration is necessary.

Version 7 introduces support for IAM role chaining by changing the assumeRole property to a list that accepts multiple arguments. This is now represented by the assumeRoles property.

If you are providing the assumeRole property on the Provider or using the aws:assumeRole configuration, you must update your code to use the new list-based format.

Provider Configuration Change:

v6 (Old):

const provider = new aws.Provider("provider", {
    assumeRole: {roleArn: baseRole.arn},
});

v7 (New):

const provider = new aws.Provider("provider", {
    assumeRoles: [{roleArn: baseRole.arn}],
});

Pulumi Config Change:

v6 (Old):

config:
  aws:assumeRole:
    roleArn: arn:aws:iam::12345678912/someRole

v7 (New):

config:
  aws:assumeRoles:
    - roleArn: arn:aws:iam::12345678912/someRole

import * as aws from '@pulumi/aws';

const provider = new aws.Provider("provider", {
    assumeRoles: [{roleArn: baseRole.arn}],
});