Running

pulumi down

on a stack with a VPC and a ipam pool sets the cidr in a failed-provision state and locks the entire thing. I cannot remove it because Pulumi deleted the VPC but the CIDR refuses to deprovision because of this.

For cases like this you should leverage the dependsOn resourceOption to control deletion more closely.

Oh, good point. I just assumed it knew the order of everything as that was my experience from pulumi+azure. Thanks 👍