Okay, answer my own question. I checked the aws console and the pending resources are gone. So, just removed from the pending_operations section and import. It recovered. Still it might make senses for pulumi to automatically detect that and still not sure how got the update token has expired in the first place.