This message was deleted.

Does whatever user/role Pulumi uses have permission? If not, then you'll have to fix that.

I used my account role. Turns out the issue came from a nested dependency to a db subnet which also did not get deleted and without deleting it, none of the ENIs, SGs or Subnets could be deleted.

Ah. Usually that sort of thing reports an error, but if the API accepts the request and the failure doesn't happen until later, then there's nothing Pulumi can do about it..