aws.cloudfront.Distribution Missing required property 'restrictions' but field is optional

[anentropic]

What happened?

I have a Python 3.11 project using pulumi-aws==6.17.0

when creating a cloudfront distribution the type annotation on the Distribution resource in pulumi has:

restrictions: Optional[pulumi.Input[pulumi.InputType['DistributionRestrictionsArgs']]] = None,

but if I omit this arg, or pass restrictions=None, I get an error when I pulumi up the stack:

        distro = aws.cloudfront.Distribution(
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/Users/anentropic/Library/Caches/pypoetry/virtualenvs/pgb-XSaIC7TY-py3.11/lib/python3.11/site-packages/pulumi_aws/cloudfront/distribution.py", line 1434, in __init__
        __self__._internal_init(resource_name, *args, **kwargs)
      File "/Users/anentropic/Library/Caches/pypoetry/virtualenvs/pgb-XSaIC7TY-py3.11/lib/python3.11/site-packages/pulumi_aws/cloudfront/distribution.py", line 1490, in _internal_init
        raise TypeError("Missing required property 'restrictions'")
    TypeError: Missing required property 'restrictions'

so it seems like this field is not actually optional

Example

distro = aws.cloudfront.Distribution(
    "myproj",
    default_root_object="index.html",
    default_cache_behavior=aws.cloudfront.DistributionDefaultCacheBehaviorArgs(
        cache_policy_id=cache_policy.id,
        target_origin_id="myproj-s3-origin",
        allowed_methods=['GET', 'HEAD'],
        cached_methods=['GET', 'HEAD'],
        viewer_protocol_policy="https-only",
    ),
    enabled=True,
    origins=[
        aws.cloudfront.DistributionOriginArgs(
            origin_id="myproj-s3-origin",
            domain_name=bucket.bucket_regional_domain_name,
            origin_access_control_id=oac.id,
        )
    ],
    # restrictions=None,
)

Output of pulumi about

CLI
Version      3.98.0
Go Version   go1.21.5
Go Compiler  gc

Plugins
NAME          VERSION
aws           6.17.0
cloudflare    5.16.0
digitalocean  4.25.0
python        unknown

Host
OS       darwin
Version  14.1.1
Arch     arm64

This project is written in python: executable='/Users/anentropic/Library/Caches/pypoetry/virtualenvs/pgb-XSaIC7TY-py3.11/bin/python3' version='3.11.7'

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[anentropic]

I can get past it by supplying:

    restrictions=aws.cloudfront.DistributionRestrictionsArgs(
        geo_restriction=aws.cloudfront.DistributionRestrictionsGeoRestrictionArgs(
            restriction_type="none",
        )
    ),

but then I hit the next error:

cloudfront/distribution.py", line 1496, in _internal_init
        raise TypeError("Missing required property 'viewer_certificate'")
    TypeError: Missing required property 'viewer_certificate'

...so it looks like there's a bunch of properties typed as optional which are really required

or maybe there's some missing/broken code that is supposed to transform the default None values into the more fully specified default value expected by the underlying provider

[anentropic]

FWIW it seems like this field is required in the underlying terraform provider https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#restrictions

[iwahbe]

Hi @anentropic. I understand your confusion. In Pulumi's python SDKs, there are 2 ways to pass arguments to a resource.

Directly to the resource constructor:

Distribution(name, restrictions=your_restrictions)

Via a resource args bundle:

Distribution(name, args=DistributionArgs(restrictions=your_restrictions))

It seems like we only have correct Optional typing for the Args variant. I'll pass this feedback to our codegen team.

[anentropic]

hmm I can see now that there are four relevant type signatures

you're already using @overload to provide the alternative call styles for Distribution.__init__ so there's:

1. the non-args object overload form ... this is the one where I'd like to see the types of individual args like restrictions reflect whether they are actually required or not (currently all typed as optional)
2. the args object overload form where no individual args should be passed
3. the actual non-overload form, accepting *args and **kwargs, seems fine
4. the _internal_init called from __init__ which doesn't have an @overload and all args are typed as optional, seems fine

hopefully this is possible to fix and is not a result of some limitation in the Python type checkers... thanks for looking :)