Lambda does not refresh cleanly

[t0yv0]

What happened?

Program:

using Pulumi;
using Aws = Pulumi.Aws;
using System.Text.Json;
using System.Collections.Generic;

return await Deployment.RunAsync(() =>
{

    var role = new Aws.Iam.Role("example-dotnet-lambda", new Aws.Iam.RoleArgs
    {
        AssumeRolePolicy = JsonSerializer.Serialize(new
        {
            Version = "2008-10-17",
            Statement = new[]
             {
                new
                {
                    Sid = "",
                    Effect = "Allow",
                    Principal = new
                    {
                        Service = "lambda.amazonaws.com"
                    },
                    Action = "sts:AssumeRole"
                }
            }
        }),
        ManagedPolicyArns = new[]
        {
            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        }
    });

    var lambda = new Aws.Lambda.Function("example", new Aws.Lambda.FunctionArgs
    {
        Runtime = "dotnet6",
        Code = new FileArchive("./files"),
        Handler = "DotnetLambda::DotnetLambda.Function::FunctionHandler",
        Role = role.Arn
    });

    var api = new Aws.ApiGatewayV2.Api("example", new Aws.ApiGatewayV2.ApiArgs
    {
        ProtocolType = "HTTP",
    });

    var httpIntegration = new Aws.ApiGatewayV2.Integration("example", new Aws.ApiGatewayV2.IntegrationArgs
    {
        ApiId = api.Id,
        IntegrationMethod = "POST",
        IntegrationType = "AWS_PROXY",
        PayloadFormatVersion = "2.0",
        IntegrationUri = lambda.InvokeArn

    });


    // Export the name of the bucket
    return new Dictionary<string, object?>
    {
        ["httpIntegration"] = httpIntegration.Id
    };
});

After:

pulumi up
pulumi refresh

Get this:

t0yv0@Antons-MacBook-Pro> pulumi refresh                                                                                                                                                                                                                                          ~/bugs/aws-2490
Previewing refresh (dev)

View in Browser (Ctrl+O): https://app.pulumi.com/anton-pulumi-corp/aws-2490/dev/previews/96222a52-f2f3-4893-b435-02d1e9a791fc

     Type                             Name                   Plan       Info
     pulumi:pulumi:Stack              aws-2490-dev
     ├─ aws:iam:Role                  example-dotnet-lambda
     ├─ aws:apigatewayv2:Integration  example
     ├─ aws:apigatewayv2:Api          example
 ~   └─ aws:lambda:Function           example                update     [diff: +replacementSecurityGroupIds]

Resources:
    ~ 1 to update
    4 unchanged

Do you want to perform this refresh?
No resources will be modified as part of this refresh; just your stack's state will be.
 details
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::aws-2490::pulumi:pulumi:Stack::aws-2490-dev]
    ~ aws:lambda/function:Function: (update)
        [id=example-050d155]
        [urn=urn:pulumi:dev::aws-2490::aws:lambda/function:Function::example]
        [provider=urn:pulumi:dev::aws-2490::pulumi:providers:aws::default_6_32_0::91badb86-a9ac-4cfb-88ec-3c30a5611af5]
        --outputs:--
      + replacementSecurityGroupIds : []

Do you want to perform this refresh?
No resources will be modified as part of this refresh; just your stack's state will be.
  [Use arrows to move, type to filter]
  yes
> no
  details

If I accept the refresh, subsequent up and refresh are clean no changes.

I suspect this is one of the cases where TF does not warn on refresh but silently normalizes the state by
auto-refreshing when doing several rounds of apply.

Example

See above.

Output of pulumi about

running 'dotnet build -nologo .'
  Determining projects to restore...

  All projects are up-to-date for restore.

  aws-2490 -> /Users/t0yv0/bugs/aws-2490/bin/Debug/net6.0/aws-2490.dll



Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:01.34

'dotnet build -nologo .' completed successfully
CLI          
Version      3.111.1
Go Version   go1.22.1
Go Compiler  gc

Plugins
NAME    VERSION
aws     6.32.0
dotnet  unknown

Host     
OS       darwin
Version  14.4.1
Arch     x86_64

This project is written in dotnet: executable='/Users/t0yv0/bin/dotnet' version='6.0.416'

Current Stack: anton-pulumi-corp/aws-2490/dev

TYPE                                      URN
pulumi:pulumi:Stack                       urn:pulumi:dev::aws-2490::pulumi:pulumi:Stack::aws-2490-dev
pulumi:providers:aws                      urn:pulumi:dev::aws-2490::pulumi:providers:aws::default_6_32_0
aws:apigatewayv2/api:Api                  urn:pulumi:dev::aws-2490::aws:apigatewayv2/api:Api::example
aws:iam/role:Role                         urn:pulumi:dev::aws-2490::aws:iam/role:Role::example-dotnet-lambda
aws:lambda/function:Function              urn:pulumi:dev::aws-2490::aws:lambda/function:Function::example
aws:apigatewayv2/integration:Integration  urn:pulumi:dev::aws-2490::aws:apigatewayv2/integration:Integration::example


Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/anton-pulumi-corp
User           anton-pulumi-corp
Organizations  anton-pulumi-corp, moolumi, pulumi
Token type     personal

Dependencies:
NAME        VERSION
Pulumi      3.63.1
Pulumi.Aws  6.32.0

Pulumi locates its logs in /var/folders/gk/cchgxh512m72f_dmkcc3d09h0000gp/T/com.apple.shortcuts.mac-helper// by default

Additional context

N/A

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).