Any ideas for why this is failing even though the config is clearly there?

Configuration:
    aws:region: us-east-1
    root:tag: latest

     Type                          Name                             Status                  Info
     pulumi:pulumi:Stack           root-dev                         **failed**              1 error
 -   ├─ aws:ec2:SecurityGroupRule  web-listener-external-0-egress   **deleting failed**     1 error
 -   ├─ aws:ec2:SecurityGroupRule  web-listener-external-0-ingress  **deleting failed**     1 error
     ├─ aws:lb:LoadBalancer        root-nlb
     ├─ aws:lb:TargetGroup         tg
     ├─ aws:lb:TargetGroup         web-tg
     └─ aws:ec2:SecurityGroup      web-lb

Diagnostics:
  aws:ec2:SecurityGroupRule (web-listener-external-0-egress):
    error: Plan apply failed: 1 error occurred:
        * missing required configuration key "aws:region": The region where AWS operations will take place. Examples are us-east-1, us-west-2, etc.
    Set a value using the command `pulumi config set aws:region <value>`.

  pulumi:pulumi:Stack (root-dev):
    error: update failed

  aws:ec2:SecurityGroupRule (web-listener-external-0-ingress):
    error: Plan apply failed: 1 error occurred:
        * missing required configuration key "aws:region": The region where AWS operations will take place. Examples are us-east-1, us-west-2, etc.
    Set a value using the command `pulumi config set aws:region <value>`.

Try setting it in the env var

AWS_REGION

? I think that should be picked up, just to rule out whether or not the config is picked up or not.

Thanks for the suggestion. That's made a bit of a difference, but getting a whole bunch of other errors now... Think the state is just completely borked somehow.