Funny enough I'm here with another issue involving security groups, but instead of trying to get rid of my stack I'm simply trying to update it. For some reason, Pulumi wants to delete a couple of security groups that are in use by other resources; I believe it thinks that a replacement security group has been made and is trying to remove the "old" one. Obviously it can't delete the group and I get the same error as Krishna above me, but I don't want the group to be deleted. Looking in the dashboard, there are no configuration differences I can see between the resource in Pulumi, the AWS resource, and my code. Running a refresh doesn't seem to fix it either. Is there a way to get this to stop happening?
As an update to this for future eyes, turns out there's somehow two resources that have exactly the same URN yet refer to two different resources. This could make sense if it was in the middle of replacing a security group that had dependents and failed, but then I'd question why it even attempted to delete them in the first place.