This message was deleted.

Failing all else I guess you could create a log group and import that too 😅

Ok apologies I've figured it out - if you set

cloudwatchLogGroupArn

to an empty string in the code, then Pulumi just removes it from the property set and the import agrees they match