StorageAccount create fails with transient error, resource is created in Azure and never recorded in Pulumi state — refresh doesn't detect it

[andrej98]

What happened?

During the create of a storage account an error occured:

error: Status=409 Code="StorageAccountOperationInProgress" Message="An operation is currently performing on this storage account that requires exclusive access."

However, in Azure the resource got created after that.
On retry attempts, the error was:

error: cannot create already existing resource <resource-id>

pulumi refresh does not detect it, because the resource was not created in the pulumi state, even though it exists in Azure.

The workaround solution is to import the resource into pulumi, or delete it in Azure and try pulumi up again.
I think the proper solution would be that the next pulumi refresh and pulumi up to fix it. It should be able to recover from these transient errors, and not expect the user to fix it manually.

Example

Create a resource with pulumi UP that fails with transient error, while the resource gets created in Azure. The subsequent pulumi UP will fail due to error: cannot create already existing resource

Output of pulumi about

2026-06-26T11:06:12.1878317Z Version 3.248.0
2026-06-26T11:06:12.1878509Z Go Version go1.26.4
2026-06-26T11:06:12.1878684Z Go Compiler gc
2026-06-26T11:06:12.1878759Z
2026-06-26T11:06:12.1882287Z Host
2026-06-26T11:06:12.1882651Z OS ubuntu
2026-06-26T11:06:12.1882877Z Version 24.04
2026-06-26T11:06:12.1883044Z Arch x86_64
2026-06-26T11:06:12.1883119Z
2026-06-26T11:06:12.1891446Z Environment Variables:
2026-06-26T11:06:12.1893626Z Name Value
2026-06-26T11:06:12.1893991Z PULUMI_EXPERIMENTAL true
2026-06-26T11:06:12.1894352Z PULUMI_HOME "/mnt/vss/_work/_temp/1782471962013"
2026-06-26T11:06:12.1894725Z PULUMI_SKIP_CHECKPOINTS true

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[Zaid-Ajaj]

Hi there @andrej98 thanks for filing the issue. This one seems a bit weird; Azure returns an error but still creates the resource in the cloud anyways. When Pulumi receives an error during creation, we assume the resource has been created. pulumi refresh won't work like you said because you are syncing what's in the state with the cloud, not vice-versa. For that, you would need pulumi import and import the storage account resource to bring it into the Pulumi state.

That said, this specific transient error happens when there are multiple actors operating on the same resource. How is that the case in your program, can you elaborate?

Also this specific error code is handled as part of a "resource conflict" and is retried a number of times before giving up. Which version of azure-native are you using? You might not have a recent version that retries the creation when encountering a creation error

[andrej98]

Hi Zaid, Thanks for looking into this.
Regarding multiple actors, I don't think there are any, we have multiple datacenters, in all of them but one the storage account was created successfully. Also the storage account was brand new, so nothing else was touching it. Within the program, the only dependent sub-resource (BlobServiceProperties) consumes the account's name output, so it shouldn't be any problem.
The version of azure-native was 3.19.0. so the retries should already be implemented there. And we also do the retries in CI in case of failures, and the subsequent retry already returned error: cannot create already existing resource

[Zaid-Ajaj]

Thanks @andrej98 for the follow-up! that's interesting then because we do check and retry this error since v3.13.0 🤔 it is possible that BlobServiceProperties is operating on the storage account but if it depends on an output, it shouldn't do anything until the storage account is created and available. This could be an eventual-consistency issue from Azure where the API says the StorageAccount is created (but it isn't) then the BlobServiceAccount operates on it.

Your error message; where does it originate from? the creation of StorageAccount or the creation of BlobServiceProperties?

[andrej98]

I think it failed during StorageAccount creation.
I can see this log

+ azure-native:storage:StorageAccount: (create)

and I don't see any create log for the corresponding BlobServiceProperties.
Then in the next preview I can see it wanted to create both the StorageAccount and corresponding BlobServiceProperties resource. And in the subsequent UP attempts it failed on storage account already existing.