Update plan error: delete-replaced is not allowed by the plan: this resource is constrained to replace

[adam-kiss-sg]

What happened?

Was trying to deploy using update plans, and got the following error: delete-replaced is not allowed by the plan: this resource is constrained to replace

Steps to reproduce

1. Create the following stack with pulumi up:

   "use strict";
   const pulumi = require("@pulumi/pulumi");
   const aws = require("@pulumi/aws");
   
   const iamForLambda = new aws.iam.Role("iamForLambda", {
     assumeRolePolicy: `{
       "Version": "2012-10-17",
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Principal": {
             "Service": "lambda.amazonaws.com"
           },
           "Effect": "Allow",
           "Sid": ""
         }
       ]
     }
     `,
   });
   const testLambda = new aws.lambda.Function("testLambda", {
     code: new pulumi.asset.FileArchive("lambda"),
     role: iamForLambda.arn,
     handler: "index.test",
     runtime: "nodejs16.x",
     name: "repro-test"
   });
   
   const eventRuleDaily = new aws.cloudwatch.EventRule("eventRuleDaily", {
     scheduleExpression: "cron(0 12 * * ? *)",
   })
   
   new aws.cloudwatch.EventTarget("event-target-daily", {
     arn: testLambda.arn,
     rule: eventRuleDaily.name,
     targetId: "TestTarget",
   })
   
   new aws.lambda.Permission("permission-daily", {
     action: "lambda:InvokeFunction",
     function: testLambda.arn,
     principal: "events.amazonaws.com",
     source_arn: eventRuleDaily.arn,
   })
   

2. change the lambda name
3. run pulumi preview --save-plan plan.json
4. run pulumi up --plan plan.json

Expected Behavior

The update should work

Actual Behavior

Get the error message: delete-replaced is not allowed by the plan: this resource is constrained to replace

Output of pulumi about

CLI
Version 3.40.2
Go Version go1.19.1
Go Compiler gc

Plugins
NAME VERSION
aws 5.16.2
docker 3.4.1
nodejs unknown

Host
OS ubuntu
Version 20.04
Arch x86_64

This project is written in nodejs: executable='/usr/bin/node' version='v16.13.0'

Current Stack: dev

TYPE URN
pulumi:pulumi:Stack urn:pulumi:dev::pulumilambda::pulumi:pulumi:Stack::pulumilambda-dev
pulumi:providers:aws urn:pulumi:dev::pulumilambda::pulumi:providers:aws::default_5_16_2
aws:iam/role:Role urn:pulumi:dev::pulumilambda::aws:iam/role:Role::iamForLambda
aws:cloudwatch/eventRule:EventRule urn:pulumi:dev::pulumilambda::aws:cloudwatch/eventRule:EventRule::eventRuleDaily
aws:lambda/function:Function urn:pulumi:dev::pulumilambda::aws:lambda/function:Function::testLambda
aws:cloudwatch/eventTarget:EventTarget urn:pulumi:dev::pulumilambda::aws:cloudwatch/eventTarget:EventTarget::event-target-daily
aws:lambda/permission:Permission urn:pulumi:dev::pulumilambda::aws:lambda/permission:Permission::permission-daily

Found no pending operations associated with dev

Backend
Name SG0166
URL file://stacks
User adam-kiss
Organizations

Dependencies:
NAME VERSION
@pulumi/awsx 0.40.1
@pulumi/pulumi 3.40.2
@pulumi/aws 5.16.2

Pulumi locates its logs in /tmp by default

Additional context

$ pulumi preview --save-plan plan.json
Previewing update (dev):
     Type                           Name                Plan        Info
     pulumi:pulumi:Stack            pulumilambda-dev                
 +-  ├─ aws:lambda:Permission       permission-daily    replace     [diff: ~function,statementId]
 +-  ├─ aws:lambda:Function         testLambda          replace     [diff: ~name]
 ~   └─ aws:cloudwatch:EventTarget  event-target-daily  update      [diff: ~arn]
 
Resources:
    ~ 1 to update
    +-2 to replace
    3 changes. 3 unchanged

Update plan written to 'plan.json'
Run `pulumi up --plan='plan.json'` to constrain the update to the operations planned by this preview

$ pulumi up --plan plan.json
Previewing update (dev):
     Type                    Name              Plan     Info
     pulumi:pulumi:Stack     pulumilambda-dev           
     └─ aws:lambda:Function  testLambda                 1 error
 
Diagnostics:
  aws:lambda:Function (testLambda):
    error: delete-replaced is not allowed by the plan: this resource is constrained to replace

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[Frassle]

Thanks for this report, I've tracked this down to an issue with generating the plans for resources that are being replaced due to dependencies on others resources that are being replaced. Working on a smaller reproduction to add to our test suite and a fix now.