update not detected for value in azure-native:apimanagement:ApiOperationPolicy

[otahirs]

What happened?

The diff detection for the value property in azure-native:apimanagement:ApiOperationPolicy is not working properly. In most cases if the value parameter is altered, the pulumi preview/up shows no update.
Strangely, there exist a hot part in the string, which if changed, correctly triggers an update.

Example

we have existing policy in azure with this configuration, if we change the value property (while keeping the hot part intact), no change is detected
ps: change in other properties is detected normally

const apiOperationPolicy = new azure_native.apimanagement.ApiOperationPolicy(
    `${operation.id}-policy`,
    {
      apiId: apiId,
      format: 'xml',
      operationId: opId,
      policyId: 'policy',
      resourceGroupName: 'rg-name',
      serviceName: service-name',
      value: pulumi.interpolate`<policies>
          <inbound>
          <base />
          <rewrite-uri template="?" copy-unmatched-params="false" />
          <set-header name="Content-Type" exists-action="override">
          <value>application/json</value>
          </set-header>
          <authentication-managed-identity resource="https://management.azure.com/" />
          <set-variable name="ResourceId" value="/subscriptions/45f8986b-d7d0-49fd-a1fc-1c296b9f6406/resourceGroups/my-rg/providers/Microsoft.DocumentDB/databaseAccounts/my-db-account-name" />
          <set-backend-service base-url=" ...redacted... " />
          <set-body>@{  ...redacted... }</set-body>
          </inbound>
          <backend>
          <base />
          </backend>
          <outbound>
          <base />
          </outbound>
          <on-error>
          <base />
          </on-error>
      </policies>`
    },
    { parent },
  );

if the value string is altered, no change is detected.
UNLESS the following hot part is changed, in that case the change is detected

the hot part
/subscriptions/45f8986b-d7d0-49fd-a1fc-1c296b9f6406/resourceGroups/my-rg/providers/Microsoft.DocumentDB/databaseAccounts/my-db-account-name" />
starts with after the <set-variable name="ResourceId" value=, ends with the end of the line

===

to continue in the investigation, if the initial value property from the example is stripped down only to the hot part - to the following minimal version - then still NO change is not detected.

      value: `/subscriptions/45f8986b-d7d0-49fd-a1fc-1c296b9f6406/resourceGroups/my-rg/providers/Microsoft.DocumentDB/databaseAccounts/my-db-account-name" />\r`,

however, ANY character change in that string (including the " />\r part) will trigger an update

Output of pulumi about

CLI
Version      3.133.0
Go Version   go1.23.1
Go Compiler  gc

Host     
OS       Microsoft Windows 11 Enterprise
Version  10.0.22631 Build 22631
Arch     x86_64

Additional context

related issue #3202

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[danielrbradley]

Hi @otahirs thanks for reaching out.

Yes, it looks very similar to #3202 so it might be worth combining the conversation into that issue - so we might want to close this as a duplicate if so.

On the last time of investigating the other issue, the reported code was not a complete, standalone program that we could run and see the issue to investigate further. When I attempted to build a program as described it didn't exhibit the same issue. In order to diagnose this further we're needing a complete runnable program (along with all depdency versions) which reliably demonstrates the issue. If you're able to provide this then that would help move this forward to a point of resolution.

I have a hunch that it might be related to the value being interpolated with an output which is perhaps unknown, but really need a setup which demonstrates this or indicates some other factor.

[otahirs]

I cannot promise I will have time to create a proper runnable program, that is, this issue is hard to reproduce. It did not exhibited even on all of the datacenter instances, even though it showed consistently for the ones that were affected.

To comment on your hunch, I had a similar feeling at first, however, as I pointed out, this following version also showed no update, no outputs present in the value. Nonetheless, if I changed any character in the value after the strip down to this version, then the change would appear.

const apiOperationPolicy = new azure_native.apimanagement.ApiOperationPolicy(
    `${operation.id}-policy`,
    {
      apiId: apiId,
      format: 'xml',
      operationId: opId,
      policyId: 'policy',
      resourceGroupName: 'rg-name',
      serviceName: service-name',
      value: `/subscriptions/45f8986b-d7d0-49fd-a1fc-1c296b9f6406/resourceGroups/my-rg/providers/Microsoft.DocumentDB/databaseAccounts/my-db-account-name" />\r`,
    },
    { parent },
  );