Pending RDS changes without any changes to configuration

[mikstew]

What happened?

I made configuration changes to an AWS IAM resource, but noticed RDS changes pending in the preview.
It's always concerning when Pulumi is trying to make unintended changes. I checked the release notes for v6.28.1 and didn't see any mention of an update to this configuration.

Example

The following change was pending for all RDS clusters:
[provider: urn:pulumi:stage::infrastructure::pulumi:providers:aws::default_6_27_0::86914e59-5430-4ecd-9367-daf02b8cb348 => urn:pulumi:stage::infrastructure::pulumi:providers:aws::default_6_28_1::output<string>] + enableLocalWriteForwarding: false

Output of pulumi about

CLI
Version 3.108.0
Go Version go1.22.0
Go Compiler gc

Plugins
NAME VERSION
aws 6.28.1
aws 5.43.0
aws 5.43.0
aws 5.43.0
aws 4.38.1
awsx 1.0.6
awsx 1.0.6
cloudflare 4.16.0
docker 3.6.1
docker 3.6.1
eks 0.40.0
kubernetes 3.21.4
kubernetes 3.21.4
kubernetes 3.19.3
nodejs unknown
pagerduty 3.11.2
random 4.15.1
tls 4.4.0

Host
OS darwin
Version 12.7
Arch arm64

This project is written in nodejs: executable='/usr/local/bin/node' version='v20.9.0'

Dependencies:
NAME VERSION
@pulumi/pagerduty 3.11.2
@pulumi/random 4.15.1
@pulumi/tls 4.4.0
@simcubeltd/pulumi-onepassword 1.0.6
@typescript-eslint/eslint-plugin 5.62.0
object-hash 2.2.0
@pulumi/aws 6.28.1
@pulumi/eks 0.40.0
playwright 1.41.2
@pulumi/kubernetes 3.19.3
@types/object-hash 2.2.1
circleci-api 4.1.4
@pulumi/awsx 1.0.6
@pulumi/cloudflare 4.16.0
@types/node 14.18.63
eslint 8.57.0
typescript 4.9.5
@checkly/pulumi 1.1.4
@types/js-yaml 4.0.9
@typescript-eslint/parser 5.62.0
expect 29.7.0
js-yaml 4.1.0
@messari/infra 0.0.119
@pulumi/pulumi 3.107.0

Additional context

This issue appeared when updating from v.6.27.0 to v6.28.1.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[corymhall]

@mikstew it looks like this is due to an upstream change that added the new parameter enable_local_write_forwarding and set the default to false.

Related to #1625

[mikstew]

@corymhall I'm not sure how I missed that. Thanks for connecting the dots.