Constant configuration drift on Grant being shown and Grants are deleted

[PierreBeucher]

What happened?

Pulumi shows a constant diff for Grant resources. This is likely an issue already documented on Terraform provider: cyrilgdn/terraform-provider-postgresql#303

However, as Pulumi default behaviour is to create THEN delete, it ends-up deleting Grant altogether:

• Pulumi "creates" new resource - in fact applying an already existing Grant
• Then it "deletes" old resource, resulting in original Grant being deleted

End result: Grant is deleted

Expected Behavior

Pulumi detects diff normally. Grant is not deleted.

Steps to reproduce

Create a Grant like:

new postgresql.Grant(`my-grant`,
			{
				database: "database",
				objectType: "table",
				role: "role",
				privileges: ["SELECT", "UPDATE", "INSERT", "DELETE"],
				objects: [],
				schema: "schema"
			}
		)

Up a first time: Grant is created OK
Up a second time: Pulumi shows diff, deleting original Grant

Pulumi (automation API) shows output like this, clearly indicating deletion at the end:

 ++ postgresql:index:Grant RdsMigrationUserTablePrivileges creating replacement [diff: ~privileges]
 ++ postgresql:index:Grant RdsMigrationUserTablePrivileges created replacement [diff: ~privileges]
 +- postgresql:index:Grant RdsMigrationUserTablePrivileges replacing [diff: ~privileges]
 +- postgresql:index:Grant RdsMigrationUserTablePrivileges replaced [diff: ~privileges]
 -- postgresql:index:Grant RdsMigrationUserTablePrivileges deleting original [diff: ~privileges]
 -- postgresql:index:Grant RdsMigrationUserTablePrivileges deleted original [diff: ~privileges]

Output of pulumi about

 pulumi about
CLI          
Version      3.54.0
Go Version   go1.19.5
Go Compiler  gc

Host     
OS       nixos
Version  22.11 (Raccoon)
Arch     x86_64

Additional context

We implemented a workaround with deleteBeforeReplace: true, causing Grants to be deleted then recreated (so actually deleted for a few seconds, which is better than permanently)

new postgresql.Grant(`my-grant`,
			{
				database: "database",
				objectType: "table",
				role: "role",
				privileges: ["SELECT", "UPDATE", "INSERT", "DELETE"],
				objects: [],
				schema: "schema"
			},{ 
				deleteBeforeReplace: true
			}
		)

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[AaronFriel]

@PierreBeucher Thanks for flagging this! We can override the TF provider's behavior here to delete before replacing. It looks like there are two bugs though; the constant diff & the order of operations.