Support replace_triggered_by

[t0yv0]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Terraform supports the lifecycle configuration replace_triggered_by. Top resource examples in AWS use this, including aws.lambda.Permission and aws.ec2.SecurityGroup. It is not immediately clear to me how to accomplish this in Pulumi, so perhaps we need to figure out the gaps here before addressing the translation per se - nothing in https://www.pulumi.com/docs/concepts/options/ is immediately obvious to use here.

Beside examples I suspect this idiom will be something that users migrating from TF would be wondering about when working with Pulumi.

If omitting the qualifier argument (which forces re-creation each time a function version is published), a lifecycle block can be used to ensure permissions are re-applied on any change to the underlying function.

resource "aws_lambda_permission" "logging" {
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.example.function_name
  principal     = "events.amazonaws.com"
  source_arn    = "arn:aws:events:eu-west-1:111122223333:rule/RunDaily"

  lifecycle {
    replace_triggered_by = [
      aws_lambda_function.example
    ]
  }
}

Affected area/feature