Hrm, I had a

protected: true

flag on an AWS Secrets manager resource. I changed the resource name and took the protected flag off because it coudln't delete a protected resource to do a renaming. It's still giving me a protection error even with protected flag gone: