SQS RedriveAllowPolicy shows spurious JSON diff

[csssuf]

Describe what happened

Similar to #2307, a JSON diff always shows up for the sqs.RedriveAllowPolicy resource, even when no actual changes will be made.

Sample program

import pulumi
from pulumi_aws import sqs

dlq = sqs.Queue("demo-dlq")
queue = sqs.Queue(
    "demo-queue",
    redrive_policy=pulumi.Output.json_dumps(
        {
            "deadLetterTargetArn": dlq.arn,
            "maxReceiveCount": 2,
        }
    )
)

redrive_allow_policy = sqs.RedriveAllowPolicy(
    "demo",
    queue_url=dlq.id,
    redrive_allow_policy=pulumi.Output.json_dumps(
        {
            "redrivePermission": "byQueue",
            "sourceQueueArns": [queue.arn],
        }
    )
)

Log output

Enter your passphrase to unlock config/secrets
Previewing update (dev):
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::pulumi:pulumi:Stack::pulumi-sqs-redrive-allow-policy-dev]
    ~ aws:sqs/redriveAllowPolicy:RedriveAllowPolicy: (update)
        [id=https://sqs.us-east-1.amazonaws.com/<snip>/demo-dlq-478d13f]
        [urn=urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::aws:sqs/redriveAllowPolicy:RedriveAllowPolicy::demo]
        [provider=urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::pulumi:providers:aws::default_6_59_0::a91c1d2b-d05e-49d0-9084-4ff4e6e2003d]
      ~ redriveAllowPolicy: "\"{\\\"redrivePermission\\\": \\\"byQueue\\\", \\\"sourceQueueArns\\\": [\\\"arn:aws:sqs:us-east-1:<snip>:demo-queue-b866e9f\\\"]}\"" => "\"{\\\"redrivePermission\\\": \\\"byQueue\\\", \\\"sourceQueueArns\\\": [\\\"arn:aws:sqs:us-east-1:<snip>:demo-queue-b866e9f\\\"]}\""
Resources:
    ~ 1 to update
    3 unchanged

Affected Resource(s)

sqs.RedriveAllowPolicy

Output of pulumi about

CLI
Version      3.137.0
Go Version   go1.23.2
Go Compiler  gc

Plugins
KIND      NAME    VERSION
resource  aws     6.59.0
language  python  unknown

Host
OS       darwin
Version  14.6.1
Arch     arm64

This project is written in python: executable='/Users/james.forcier/scratch/pulumi-sqs-redrive-allow-policy/venv/bin/python' version='3.12.4'

Current Stack: organization/pulumi-sqs-redrive-allow-policy/dev

TYPE                                           URN
pulumi:pulumi:Stack                            urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::pulumi:pulumi:Stack::pulumi-sqs-redrive-allow-policy-dev
pulumi:providers:aws                           urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::pulumi:providers:aws::default_6_59_0
aws:sqs/queue:Queue                            urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::aws:sqs/queue:Queue::demo-dlq
aws:sqs/queue:Queue                            urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::aws:sqs/queue:Queue::demo-queue
aws:sqs/redriveAllowPolicy:RedriveAllowPolicy  urn:pulumi:dev::pulumi-sqs-redrive-allow-policy::aws:sqs/redriveAllowPolicy:RedriveAllowPolicy::demo


Found no pending operations associated with dev

Backend
Name           C-15543-JFORCIE
URL            s3://<snipped>
User           james.forcier
Organizations
Token type     personal

Dependencies:
NAME        VERSION
pip         24.3.1
pulumi_aws  6.59.0
setuptools  75.4.0
wheel       0.45.0

Pulumi locates its logs in /var/folders/l1/yml6k89923d2z90rvbmrlt780000gq/T/ by default

Additional context

Fixed by #4749

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[flostadler]

Thanks a lot @csssuf for filing the issue and creating a PR right away! I'll have a look at it

[flostadler]

I was able to reproduce this using terraform. What's notable is that this doesn't work using terraforms jsonEncode as it trims all white-strings. Formatting seems to be what triggers this problem because a json string without any white space works in Pulumi as well.

This is the Terraform code for the repro:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

resource "aws_sqs_queue" "demo_dlq" {
  name_prefix = "sqs-redrive-policy-diff-"
}

resource "aws_sqs_queue" "demo_queue" {
  name_prefix = "sqs-redrive-policy-diff-"

  redrive_policy = jsonencode({
    deadLetterTargetArn = aws_sqs_queue.demo_dlq.arn
    maxReceiveCount     = 2
  })
}

resource "aws_sqs_queue_redrive_allow_policy" "example" {
  queue_url = aws_sqs_queue.demo_dlq.id

  redrive_allow_policy = "{\"redrivePermission\": \"byQueue\", \"sourceQueueArns\": [\"${aws_sqs_queue.demo_queue.arn}\"]}"
}

[flostadler]

We should be able to fix this with a patch on our side, while cutting an issue and bug fix upstream.

While investigating this, I also found that this similar patch should be fixed upstream as well: https://github.com/pulumi/pulumi-aws/blob/master/patches/0022-Fix-spurrious-json-diff-for-redrive_policy.patch

[flostadler]

Upstream issue: hashicorp/terraform-provider-aws#40119