I noticed that when I remove this code everything is fine:

_, err = ec2.NewNatGateway(ctx, n.genUniqName("nat-gateway-foo", i), &ec2.NatGatewayArgs{
			AllocationId: elasticIP.ID(),
			SubnetId:     subnetPriv.ID(),
			Tags: pulumi.StringMap{
				"Name": pulumi.String(n.genUniqName("nat-gateway-foo", i)),
			},
		}, pulumi.Parent(elasticIP))
		if err != nil {
			return err
		}

I’m wondering why is that.

I’m creating elasticIP in the same loop as this NewNatGateway:

for i, subnetPriv := range n.Subnets.PrivateSubnets {

And I don’t have any other place with nat-gateway or eip.

ahh ok, my bad - by mistake I used private subnet for it, instead of public 🤦‍♂️