Is there any way to support resources that can only be replaced and not updated in place?

[empath-nirvana]

I'm trying to create a github organization secret with a custom github provider i made with upjet.

Currently, the terraform provider for github marks all fields for a github organization secret as "forceNew", so we can't update the secret.

There seems to be no way to allow prevent_destroy on any resource? Is there any way to make this work without deleting the crossplane resource and recreating it?

[bradkwadsworth-mw]

+1
I've run into this issue when trying to re-create IAM members in GCP if a role or member needs to be modified.

[jeanduplessis]

Would this proposal that introduces more granular management policies help here?