TestAccCloudWatchOidcManual does not refresh cleanly

[t0yv0]

What happened?

Non-empty diff when refreshing the program provisioned by TestAccCloudWatchOidcManual.

Because explicit provider computes a fresh token for assumeRoleWithWebIdentity on every program
invocation, this generates non-empty changes on the pulumi:provider:aws resource
assumeRoleWithWebIdentity field and trips up the default checks which need to be disabled.

In addition to this there's a variety of other non-empty diffs that may have separate root causes:

			// ~ aws:iam:Role everyMinute updated (1s) [diff: ~managedPolicyArns]
			// ~ aws:cloudwatch:EventTarget everyMinute updated (1s) [diff: +runCommandTargets]
			// ~ aws:lambda:Function everyMinute updated (1s) [diff: +replacementSecurityGroupIds~code,lastModified]

The ~code diff is explained by pulumi/pulumi-terraform-bridge#1595

Example

See TestAccCloudWatchOidcManual

Output of pulumi about

N/A

Additional context

N/A

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

~managedPolicyArns diff due to #2246

[t0yv0]

#3868 tracks the refresh bits specifically now..

Because explicit provider computes a fresh token for assumeRoleWithWebIdentity on every program
invocation

This is just the way the program written and is fine, won't fix on that one.