AWS v7 Provider upgrade #6259

jamesgibbons92 · 2025-12-06T00:57:14Z

AWS provider upgade has some breaking changes which requires some manual intervention before the user should deploy using the new version.
The steps are explained here https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration

~~Upgrade pulumi to latest version (this contains the new arg flag --run-program for refresh). (Thanks to @abnud11)~~ This will be merged separately in another PR.
Upgrade AWS from v6 -> v7 (Thanks to @abdnud11)
Add provider major upgrade check when running sst diff or sst deploy. Which asks the user to explicitly run sst refresh to migrate their state to the new version. Deploy/diff will be blocked until this is done and no resources in your state are using an outdated version.
Add --run-program pulumi arg to refresh command, which is required for the migration.

jamesgibbons92 · 2025-12-19T16:35:48Z

Draft message for release notes:

This release updates the aws provider from v6 to v7. This major upgrade contains a number of breaking changes and deprecations. Follow the guide here https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration/ to view the changes and update any affected pulumi aws components you may have.
There should be no breaking changes to your SST components (except for possibly any inputs you were transforming), however as part of the upgrade you must migrate your state using sst refresh before deploying with the new provider. It's advisable to also use sst diff after this command to ensure there are no unexpected changes.

jamesgibbons92 · 2025-12-19T16:38:28Z

One thing to consider, adding support for --refresh arg to the deploy command, to automatically run refresh before deploy. This would provide a way of getting around having to do a manual refresh step before deploy and may be useful for people that have lots of stages to update.

abnud11 · 2026-01-07T18:14:25Z

I hope we can push on this PR as a lot of features are blocked by it 👍
@jamesgibbons92 @vimtor

jamesgibbons92 · 2026-01-08T23:41:09Z

@vimtor Now that pulumi has been merged I've updated this PR so it's good to review now.
I'm doing some more testing, but would appreciate a second pair of eyes on this as well!

austeane · 2026-01-20T01:20:02Z

Would love for this to be merged, it's key for my project, and I've switched to using this branch as my base.

vimtor

hey @jamesgibbons92

i left a couple of minor comments about the migration steps

everything else seems to be working. great job!

will be testing more examples today to see if they still work

vimtor · 2026-01-20T09:48:55Z

cmd/sst/deploy.go

+			"",
+			"```bash frame=\"none\"",
+			"sst deploy --refresh",
+			"```",
+			"Pass --refresh flag to refresh your state resources before deploying any changes.",
+			"This is useful for making sure your state reflects your cloud resources accurately before applying updates.",


thinking about what's the difference between sst deploy --refresh and sst refresh i discovered that the refresh command is broken in this pr:

default_7_12_0 pulumi:providers:aws pulumi:providers:aws resource 'default_7_12_0' has a problem: Missing region information Make sure you have set your AWS region, e.g. `pulumi config set aws:region us-west-2`.

regardless of whether we need this new flag, the user should be able to do:

sst refresh

sst deploy

to upgrade their state right? @jamesgibbons92

if that's the case we might want to keep it simple and don't introduce new flags

Yeh it's not necessary, I can remove it.
But you said the refresh command is broken? Or was it just when using as a deploy arg?

when i tried doing:

sst refresh

sst deploy

to migrate the state i got an error

did it work for your?

Refresh and deploy did work for me off this branch

got this error when trying the refresh then deploy:

i'm also thinking that if someone runs sst refresh and they’re on a new version they might accidentally upgrade their state. seems unlikely though

maybe we should be more explicit - either with a major version that auto-refreshes the state on the first deploy or a specific sst upgrade command

i'm not sure tbh, what do you think @austeane @jamesgibbons92?

@vimtor can you DM me your sst.config.ts so I can reproduce the region error - I've not seen it in my testing.

i'm also thinking that if someone runs sst refresh and they’re on a new version they might accidentally upgrade their state. seems unlikely though

I don't know how we could possibly handle this scenario. We would probably to a sst major version update anyway for the breaking changes, so it's up to the users to check the release notes and upgrade on a lower environment.

maybe we should be more explicit - either with a major version that auto-refreshes the state on the first deploy or a specific sst upgrade command

Yeh I think major version, i'm not sold on auto refresh, as users need to check their non-sst aws components and make any relevent updates. And I feel like having refresh and deploy as separate steps gives people time to check the refresh or recover if something goes wrong with state migration - they can fix this by rolling back to state with no changes to their infra. Wheras with an auto-refresh before a deploy it would just continue on with deploy which no chance to verify the changes between.

@vimtor Do you have region set in your aws profile? I can reproduce this error if I remove my region config.
Looks like sst defaults to us-east-1 if you have no default region set. but this doesn't seem to play well with the --run-program pulumi arg.

@vimtor this should be resolved now if you can test again.
The issue was --run-program arg makes it such that the refresh command uses the latest provider you have in your program, rather than the one that is stored in state.
SST does not pass the provider config to pulumi cli via the --config arg when calling the refresh command (and it's not supported in the version of pulumi we're using). So to resolve i've set the AWS_REGION in the environment variables similarly to how sst sets AWS_PROFILE.

vimtor · 2026-01-20T09:50:24Z

pkg/project/preflight.go

+		providerName: "aws",
+		fromVersion:  "6.0.0",
+		toVersion:    "7.0.0",
+		message:      "Detected AWS provider upgrade to v7.\n\nUpgrading from v6 to v7 introduces some breaking changes and requires state migration before deploying. Refer to the SST release notes and the pulumi migration guide to make the relevent changes before deploying: https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration \n\nThis notice will clear after migrating your state",


Suggested change

message: "Detected AWS provider upgrade to v7.\n\nUpgrading from v6 to v7 introduces some breaking changes and requires state migration before deploying. Refer to the SST release notes and the pulumi migration guide to make the relevent changes before deploying: https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration \n\nThis notice will clear after migrating your state",

message: "Detected AWS provider upgrade to v7.\n\nUpgrading from v6 to v7 introduces some breaking changes and requires state migration before deploying. Refer to the SST release notes and the Pulumi migration guide to make the relevent changes before deploying: https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration \n\nThis notice will clear after migrating your state",

from this message it didn't become clear that:

the user needs to refresh the state

the migration is one-way only? (i tried going back and it didn't work)

Yes I don't think you can rollback easily by downgrading the sst package, this would have to be handled on the provider level anyway.
Users would have to rollback the state manually, probably by restoring a previous version in the state s3 bucket (we should really have a cli command for this)

makes sense

maybe we should be more explicit in the error about which commands have to be run and that rolling back is "impossible"?

alternatively we could run the commands for the user and show a nice confirmation UI like this:
#5109

but i believe just being more explicit should be enough

I'll update the copy to be more specific. I was expecting the more detailed steps to go in the release notes on github but it doesn't hurt to be specific here as well.

www/src/content/docs/docs/examples.mdx

This will ensure it's available to the pulumi engine during refresh when using --run-program as refresh does not take the --config arg

This was referenced Dec 6, 2025

Aurora PG Serverless Version mismatch #6156

Closed

Bug: Impossible to upgrade from min 0 ACU to >0 ACU in aurora postgresql. #5546

Open

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 7ecfba8 to 0cd4502 Compare December 7, 2025 00:05

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 7cdee66 to 3f57e52 Compare December 19, 2025 14:03

jamesgibbons92 changed the title ~~Pulumi and aws v7 Provider upgrades~~ AWS v7 Provider upgrade Dec 19, 2025

jamesgibbons92 mentioned this pull request Dec 19, 2025

Upgrade plan for @pulumi/aws to v7 #6033

Open

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 3f57e52 to 79c8374 Compare December 19, 2025 21:55

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 79c8374 to bd42373 Compare January 8, 2026 23:22

jamesgibbons92 marked this pull request as ready for review January 8, 2026 23:32

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 9120021 to 9bc91fa Compare January 8, 2026 23:43

vimtor self-assigned this Jan 9, 2026

vimtor mentioned this pull request Jan 11, 2026

feat(aws): add support for Node.js 24.x runtime #6243

Open

jsve mentioned this pull request Jan 18, 2026

Update docs about lambda streaming through API Gateway #6310

Open

vimtor suggested changes Jan 20, 2026

View reviewed changes

jamesgibbons92 force-pushed the aws-provider-7-12 branch 2 times, most recently from a79f7ba to 1457dce Compare January 23, 2026 22:13

AWS Provider v7.12

473cf54

jamesgibbons92 force-pushed the aws-provider-7-12 branch from 1457dce to 473cf54 Compare January 23, 2026 22:16

jamesgibbons92 added 2 commits January 24, 2026 00:28

Set AWS_REGION in env

b212c94

This will ensure it's available to the pulumi engine during refresh when using --run-program as refresh does not take the --config arg

Update migration message

312f74f

	message: "Detected AWS provider upgrade to v7.\n\nUpgrading from v6 to v7 introduces some breaking changes and requires state migration before deploying. Refer to the SST release notes and the pulumi migration guide to make the relevent changes before deploying: https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration \n\nThis notice will clear after migrating your state",
	message: "Detected AWS provider upgrade to v7.\n\nUpgrading from v6 to v7 introduces some breaking changes and requires state migration before deploying. Refer to the SST release notes and the Pulumi migration guide to make the relevent changes before deploying: https://www.pulumi.com/registry/packages/aws/how-to-guides/7-0-migration \n\nThis notice will clear after migrating your state",

AWS v7 Provider upgrade #6259

Are you sure you want to change the base?

AWS v7 Provider upgrade #6259

Uh oh!

Conversation

jamesgibbons92 commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jamesgibbons92 commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jamesgibbons92 commented Dec 19, 2025

Uh oh!

abnud11 commented Jan 7, 2026

Uh oh!

jamesgibbons92 commented Jan 8, 2026

Uh oh!

austeane commented Jan 20, 2026

Uh oh!

vimtor left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jamesgibbons92 Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jamesgibbons92 Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jamesgibbons92 commented Dec 6, 2025 •

edited

Loading

jamesgibbons92 commented Dec 19, 2025 •

edited

Loading

jamesgibbons92 Jan 23, 2026 •

edited

Loading

jamesgibbons92 Jan 20, 2026 •

edited

Loading