How can I make it so Pulumi creates a new WebACL and associates it with resources (a CloudFront Distribution) before deleting the old one?

Error deleting WAFv2 WebACL: WAFAssociatedItemException: AWS WAF couldn't perform the operation because your resource is being used by another resource or it's associated with another resource.

this is the default mode of operation, unless you turn off autonaming. have you explicitly named your resources?

I haven't, I ended up manually disassociating it and now it is working fine. I must have performed some sequence of changes that got it into a bad state.