Up-to-date check is broken for resources that have a map to be late-initialized

[muvaf]

What happened?

When a resource has a map field with at least one value, it's not late-initialized because the field is considered to have non-zero value, hence the user's desire about the field. However, in some cases, external APIs assign defaults to other fields of the same map. So, you end up with a map that is not late initialized but also doesn't match what's in the cloud API, so it repeatedly reports that resource is not up to date.

How can we reproduce it?

aws_backup_region_settings resource gets to Ready and Synced states but it never marks Test state to be True, which is how we make sure resource gets into a stable state where there is no update needed. So, at every reconcile, it requests the update call to be made. The reason is that it has two maps under spec.forProvider and if you give only some of the fields, then it reports diff since it can't fill the rest with late-init.

[luebken]

Currently we don't have an assessment of the impact and we will revisit this. Please add your example if you encounter this.