narrowed it down a bit - the

get_

methods like

get_ami

and

get_security_groups

are querying into the wrong AWS region; i.e. not the same region where pulumi is provisioning resources.... hmmm

if you've specified a different 'provider' you may need to supply that provider as the configuration in the last parameter of the

get_

method. In python that might look like:

get_security_group(id=<some_sg_id>, opts=pulumi.InvokeOptions(provider=my_custom_provider))

Figured it out. What was happening was that in my

~/.aws/config

file, my region was set to

us-west-2

. In the auto-generated pulumi config, though, the region was set to

us-east-1

. For some reason pulumi was respecting the region from the

~/.aws/config

file when creating resources, but was using the region from the pulumi config when querying resources.