Provider property allowedAccountIDs are interpreted as numbers in v6

[ringods]

What happened?

Customer reported they have upgraded the provider to 6.0.x and we are seeing this error:

Diagnostics: pulumi:providers:aws (default_6_0_4): error: 
rpc error: code = Unknown desc = cannot encode provider configuration to call ValidateProviderConfig: 
objectEncoder failed on property "allowed_account_ids": 
set encoder failed: encoding element 0 ({5.30YYYYYYYYYe+11}): Expected a string, got: {5.30YYYYYYYYYe+11}

I wrapped this to multiple lines for readability and redacted the real account ID with Y characters.

Expected Behavior

Same behaviour as in v5.

Steps to reproduce

Start with v5 and this as working stack config:

config:
  aws:allowedAccountIds:
    - 0530YYYYYYYY

Upgrade the provider to v6 and the error appears.

Output of pulumi about

CLI          
Version      3.82.1
Go Version   go1.21.0
Go Compiler  gc

Plugins
NAME    VERSION
aws     6.0.4
nodejs  unknown

Host     
OS       darwin
Version  13.5.2
Arch     arm64

This project is written in nodejs: executable='/Users/ringods/.volta/bin/node' version='v16.19.1'

Current Stack: team-ce/zendesk-4011/ringo

Found no resources associated with team-ce/ringo

Found no pending operations associated with team-ce/ringo

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/v-ringo-pulumi-corp
User           v-ringo-pulumi-corp
Organizations  v-ringo-pulumi-corp, team-ce, pulumi

Dependencies:
NAME            VERSION
@pulumi/pulumi  3.82.1
@types/node     16.18.50
@pulumi/aws     6.0.4

Pulumi locates its logs in /var/folders/yq/10j1hf8s1ks9f23yxrdbbbb40000gn/T/ by default

Additional context

Workaround is to quote the values, so they are definitely interpreted as strings:

config:
  aws:allowedAccountIds:
    - "0530YYYYYYYY"

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[mikhailshilkov]

This seems to be coming from our TFPF integration which is indeed new in v6: https://github.com/pulumi/pulumi-terraform-bridge/blob/master/pf/tfbridge/provider_checkconfig.go#L105

cc @t0yv0 as our TFPF master

[ringods]

I didn't check explicitely, but a similar issue might exist for forbiddenAccountIds.

[iwahbe]

The following program is sufficient to reproduce the problem:

name: repro
runtime: yaml
resources:
  aws:
    type: pulumi:providers:aws
    properties:
      allowedAccountIds:
        - 6YYYYYYYYYYY
      region: us-west-2

I got the same error message as reported.

[mikhailshilkov]

Is it literally 6YYYYYYYYYYY or some number like 601234567890?

[iwahbe]

It's a number, yaml parses it as a number. The problem is that our SDKv2 based upstream would coerce the number to a string while the PF based upstream won't.

[t0yv0]

Thanks for that comment and just to make sure the coercion to string does not produce this:

"5.30YYYYYYYYYe+11"

right? But rather "0530YYYYYYYY"?

[iwahbe]

Good catch. I tested that we coerce without error in AWS, but it turns out that AWS doesn't validate these numbers on preview.

Fixed in pulumi/pulumi-terraform-bridge#1371.