ecs.Service deployment marked successfully updated in pulumi when ECS deployment failed and has been rolled back

[eliskovets]

Describe what happened

When the ECS service has deployment_circuit_breaker configured with rollback=True, even if deployment of a new version of task definition failed and ECS rolled back service to the previous stable version, pulumi still marks the deployment of ecs.Service resources as successfullyupdated.

     Type                 Name                            Status             Info
     pulumi:pulumi:Stack  dev                         2 warnings
 ~   └─ aws:ecs:Service   service  updated (246s)     [diff: ~taskDefinition]

Sample program

name ="test"

ecs_cluster = aws.ecs.Cluster(
    name,
    settings=[
        aws.ecs.ClusterSettingArgs(
            name="containerInsights",
            value="enabled",
        )
    ],
)

aws.ecs.Service(
    name,
    cluster=ecs_cluster.arn,
    desired_count=2,
    launch_type="FARGATE",
    task_definition=task_definition.arn,
    name="service",
    deployment_circuit_breaker=aws.ecs.ServiceDeploymentCircuitBreakerArgs(enable=True, rollback=True),
    deployment_maximum_percent=200,
    deployment_minimum_healthy_percent=100,
    network_configuration=aws.ecs.ServiceNetworkConfigurationArgs(
        assign_public_ip=False,
        subnets=ecs_subnets.ids,
        security_groups=[sg.id],
    ),
    wait_for_steady_state=True,
  )

Log output

No response

Affected Resource(s)

No response

Output of pulumi about

CLI
Version      3.130.0
Go Version   go1.22.6
Go Compiler  gc

Host
OS       darwin
Version  14.6.1
Arch     arm64

Backend
Name           pulumi.com
Token type     personal

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

Thanks for reporting this bug @eliskovets , at a first glance this appears to be the result of https://github.com/hashicorp/terraform-provider-aws/issues/19519

A fully-self contained example including a task that fails the health checks to reproduce this would be highly appreciated.

[eliskovets]

I guess it's more connected to the issue https://github.com/hashicorp/terraform-provider-aws/issues/20858