So, it looks like I have two options for pulling in existing AWS resources: pulumi import from the command line, or typescript like this: let group = new aws.ec2.SecurityGroup("my-sg", { name: "my-sg-62a569b", ingress: [{ protocol: "tcp", fromPort: 80, toPort: 80, cidrBlocks: ["0.0.0.0/0"] }], }, { import: "sg-04aeda9a214730248" }); What are the pros/cons of the two methods?

The import command gives you the code snippet that you have to add to your app vs. if you already know the exact inputs of the resource you are importing, you can declare it yourself. Note that the important thing is the inputs have to exactly match the resource as it exists in your cloud provider. If you had a more complex resource to import, starting with the command might be easier as it'll give you the code snippet you have to add.