I'm having some issues with Pulumi destroy - it seems to leave some aws resources behind (igw, instance profile...). Is this normal with Pulumi?

Nope - I have never seen a destroy succeed without deleting a resource managed by the stack. Do you have any repro or log of the output you saw where it said it succeeded destroying but did not?

Thanks for the info. I'll investigate this a bit.