Pulumi "up" Shows an Unexpected Diff - Fix Drift in CI
Pulumi previewed changes you did not expect - a replace, an update, or a delete - because the real cloud state drifted, a provider upgrade changed how a resource is modeled, or an input is non-deterministic.
What this error means
pulumi preview in CI lists changes (often ~update or +-replace) for resources nobody edited. The same program against the same stack keeps showing the diff until the cause is reconciled, so the deploy is never a clean no-op.
Previewing update (prod):
Type Name Plan Info
~ aws:s3:Bucket assets update [diff: ~tags]
+- aws:ec2:Instance web replace [diff: ~userData]Common causes
Real drift outside Pulumi
Someone changed the resource in the console or another tool. Pulumi compares desired state to actual and proposes reverting the out-of-band change.
Provider upgrade or non-deterministic input
A new provider version changes defaults or how a property is computed, or an input derived from a timestamp/random value differs each run, so Pulumi sees a change every time.
How to fix it
Refresh state, then read the precise diff
Reconcile Pulumi’s view with reality first, then inspect exactly which property changed with --diff.
pulumi refresh --yes --stack org/proj/prod
pulumi preview --diff --stack org/proj/prodPin the provider and stabilize inputs
- Pin the provider version in the program so an upgrade does not silently reshape resources.
- Replace non-deterministic inputs (timestamps, random ids) with stable values or a
RandomIdresource Pulumi tracks. - If the drift is intentional, apply once to absorb it, then keep changes flowing through Pulumi only.
How to prevent it
- Run
pulumi previewin PR checks so unexpected diffs surface before deploy. - Pin provider versions and bump them deliberately.
- Make all infra changes through Pulumi, not the console, to avoid drift.