ListenerCertificate logical name change may not always re-attach to Listener

Describe what happened

Customer reports possible variant of #1923 specific to ListenerCertificate.

Prerequisites:

Ability to create DNS CNAME for certificate. This is outside the scope of this issue. The issue assumes the CNAME is already created and valid for the DomainName in question.
The DomainName will not change throughout this issue repro.

Steps to reproduce:

pulumi up the sample program. Note this may require multiple ups depending on whether the DNS CNAME for the certificate is already created and correct and how long the validation takes.
Verify the Certificate is attached to the Listener under "Listener certificates for SNI".
Change the logical name of the ListenerCertificate:var exampleListenerCertificate = new Aws.LB.ListenerCertificate("example", new() to var exampleListenerCertificate = new Aws.LB.ListenerCertificate("example-chg", new()
Perform a pulumi up

     Type                           Name                Status              
     pulumi:pulumi:Stack            aws-cs-scratch-dev                      
 +   ├─ aws:lb:ListenerCertificate  example-chg         created (0.57s)     
 -   └─ aws:lb:ListenerCertificate  example             deleted (0.22s)     

Resources:
    + 1 created
    - 1 deleted
    2 changes. 38 unchanged

Duration: 8s

Verify the Certificate is attached to the Listener under "Listener certificates for SNI".

Expected Behavior:

The ListenerCertificate is attached to the Listener.

Actual Behavior:

The pulumi up succeeds however the ListenerCertificate is not attached to the Listener. A pulumi refresh followed by a pulumi up is required for the Certificate to be reattached under "Listener certificates for SNI"

Sample program

var vpc = new Vpc("scratch-vpc");

var primaryCert = new Aws.Acm.Certificate("example", new CertificateArgs
    {
        DomainName = "www.mycompany.com",
        ValidationMethod = "DNS",
        KeyAlgorithm = "RSA_2048",
        ValidationOptions = new[]
        {
            new Aws.Acm.Inputs.CertificateValidationOptionArgs
            {
                DomainName = "www.mycompany.com",
                ValidationDomain = "mycompany.com",
            },
        },
    });

var frontEnd = new Aws.LB.LoadBalancer("front_end", new()
    {
        Name = "test-lb-tf",
        Internal = false,
        LoadBalancerType = "application",
        Subnets = vpc.PrivateSubnetIds,
        EnableDeletionProtection = false
    });

var frontEndTargetGroup = new Aws.LB.TargetGroup("frontend-tg", new()
    {
        Name = "frontend-lb-tg",
        Port = 80,
        Protocol = "HTTP",
        VpcId = vpc.VpcId,
    });

var frontEndListener = new Aws.LB.Listener("front_end",
    new ListenerArgs
    {
        LoadBalancerArn = frontEnd.Arn,
        Port = 443,
        Protocol = "HTTPS",
        SslPolicy = "ELBSecurityPolicy-2016-08",

        CertificateArn = primaryCert.Arn,

        DefaultActions = new[]
        {
            new Aws.LB.Inputs.ListenerDefaultActionArgs
            {
                Type = "forward",
                TargetGroupArn = frontEndTargetGroup.Arn,
            },
        },
    });

// additional cert for SNI
var exampleListenerCertificate = new Aws.LB.ListenerCertificate("example", new()
    {
        ListenerArn = frontEndListener.Arn,
        CertificateArn = primaryCert.Arn,
    });

Log output

No response

Affected Resource(s)

Aws.Acm.Certificate Aws.LB.Listener Aws.LB.ListenerCertificate

Output of `pulumi about`

CLI
Version 3.133.0 Go Version go1.23.1 Go Compiler gc

Plugins KIND NAME VERSION resource aws 6.51.1 resource awsx 2.14.0 resource docker 4.5.5 language dotnet unknown resource random 4.16.4

Host
OS darwin Version 14.6.1 Arch arm64

This project is written in dotnet: executable='/Users/rsmith/.dotnet/dotnet' version='8.0.302'

Current Stack: rsmith-pulumi-corp/aws-cs-scratch/dev

TYPE pulumi:pulumi:Stack pulumi:providers:awsx awsx:ec2:Vpc pulumi:providers:aws aws:acm/certificate:Certificate pulumi:providers:aws aws:acm/certificateVali aws:ec2/vpc:Vpc aws:ec2/subnet:Subnet aws:ec2/subnet:Subnet aws:ec2/subnet:Subnet aws:ec2/subnet:Subnet aws:ec2/subnet:Subnet aws:ec2/internetGateway aws:ec2/subnet:Subnet aws:ec2/routeTable:RouteTable aws:ec2/routeTable:RouteTable aws:ec2/routeTable:RouteTable aws:ec2/routeTable:RouteTable aws:ec2/eip:Eip aws:ec2/routeTable:RouteTable aws:ec2/eip:Eip aws:ec2/eip:Eip aws:ec2/routeTable:RouteTable aws:ec2/routeTableAssoc aws:ec2/routeTableAssoc aws:ec2/routeTableAssoc aws:ec2/routeTableAssoc aws:ec2/route:Route aws:ec2/route:Route aws:ec2/natGateway:NatGateway aws:ec2/natGateway:NatGateway aws:ec2/routeTableAssoc aws:ec2/routeTableAssoc aws:ec2/natGateway:NatGateway aws:ec2/route:Route aws:ec2/route:Route aws:ec2/route:Route aws:ec2/route:Route aws:lb/loadBalancer:LoadBalancer pulumi:providers:pulumi aws:lb/targetGroup:TargetGroup aws:lb/listener:Listener aws:lb/listenerCertific URN urn:pulumi:dev::aws-cs-scratch::pulumi:pulumi:Stack::aws-cs-scratch-dev urn:pulumi:dev::aws-cs-scratch::pulumi:providers:awsx::default_2_14_0 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc::scratch-vpc urn:pulumi:dev::aws-cs-scratch::pulumi:providers:aws::default_6_51_1 urn:pulumi:dev::aws-cs-scratch::aws:acm/certificate:Certificate::example urn:pulumi:dev::aws-cs-scratch::pulumi:providers:aws::default_6_47_0 dation:CertificateValidation urn:pulumi:dev::aws-cs-scratch::aws:acm/certificateValidation:CertificateValidation::example urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc::scratch-vpc urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-private-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-private-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-private-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-public-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-public-2 :InternetGateway urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/internetGateway:InternetGateway::scratch-vpc urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet::scratch-vpc-public-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-private-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-private-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-private-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-public-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/eip:Eip::scratch-vpc-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-public-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/eip:Eip::scratch-vpc-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/eip:Eip::scratch-vpc-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable::scratch-vpc-public-1 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-private-3 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-private-1 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-public-3 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-private-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-public-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-public-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/natGateway:NatGateway::scratch-vpc-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/natGateway:NatGateway::scratch-vpc-2 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-public-2 iation:RouteTableAssociation urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/routeTableAssociation:RouteTableAssociation::scratch-vpc-public-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/natGateway:NatGateway::scratch-vpc-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-public-1 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-private-3 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-private-2 urn:pulumi:dev::aws-cs-scratch::awsx:ec2:Vpc$aws:ec2/vpc:Vpc$aws:ec2/subnet:Subnet$aws:ec2/routeTable:RouteTable$aws:ec2/route:Route::scratch-vpc-private-1 urn:pulumi:dev::aws-cs-scratch::aws:lb/loadBalancer:LoadBalancer::front_end urn:pulumi:dev::aws-cs-scratch::pulumi:providers:pulumi::default urn:pulumi:dev::aws-cs-scratch::aws:lb/targetGroup:TargetGroup::frontend-tg urn:pulumi:dev::aws-cs-scratch::aws:lb/listener:Listener::front_end ate:ListenerCertificate urn:pulumi:dev::aws-cs-scratch::aws:lb/listenerCertificate:ListenerCertificate::example

Found no pending operations associated with dev

Backend
Name pulumi.com URL https://app.pulumi.com/rsmith-pulumi-corp User rsmith-pulumi-corp Organizations rsmith-pulumi-corp Token type personal

Dependencies: NAME VERSION Pulumi 3.67.1 Pulumi.Aws 6.51.1 Pulumi.Awsx 2.14.0 Pulumi.Random 4.16.4

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

pulumi / pulumi-aws