Am I understanding correctly that for

ec2.KeyPair

, we need to manually create then import?

you don’t need to import, you can generate it using the TLS package set it using the public key data property: https://github.com/jaxxstorm/pulumi-examples/blob/e6fc90bf0e4337ce8d87edede537de6e8b40b291/python/aws/cloudformation_template/__main__.py#L7-L17

Oh I see - thanks Lee!