Allows secondary_private_ip_address_count to be updated in place

[lorengordon]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Updates support for private AWS NAT Gateway to allow secondary_private_ip_address_count to be updated in place

Relations

Closes #47476

References

Output from Acceptance Testing

❯ make testacc TESTS=TestAccVPCNATGateway_ PKG=ec2 ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 fix/private-natgw-secondary-ip-count 🌿...
TF_ACC=1 go1.26.2 test ./internal/service/ec2/... -v -count 1 -parallel 3 -run='TestAccVPCNATGateway_'  -timeout 360m -vet=off
2026/04/17 10:42:47 Creating Terraform AWS Provider (SDKv2-style)...
2026/04/17 10:42:47 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccVPCNATGateway_Identity_basic
=== PAUSE TestAccVPCNATGateway_Identity_basic
=== RUN   TestAccVPCNATGateway_Identity_regionOverride
=== PAUSE TestAccVPCNATGateway_Identity_regionOverride
=== RUN   TestAccVPCNATGateway_Identity_ExistingResource_basic
=== PAUSE TestAccVPCNATGateway_Identity_ExistingResource_basic
=== RUN   TestAccVPCNATGateway_Identity_ExistingResource_noRefreshNoChange
=== PAUSE TestAccVPCNATGateway_Identity_ExistingResource_noRefreshNoChange
=== RUN   TestAccVPCNATGateway_List_basic
=== PAUSE TestAccVPCNATGateway_List_basic
=== RUN   TestAccVPCNATGateway_List_includeResource
=== PAUSE TestAccVPCNATGateway_List_includeResource
=== RUN   TestAccVPCNATGateway_List_regionOverride
=== PAUSE TestAccVPCNATGateway_List_regionOverride
=== RUN   TestAccVPCNATGateway_basic
=== PAUSE TestAccVPCNATGateway_basic
=== RUN   TestAccVPCNATGateway_disappears
=== PAUSE TestAccVPCNATGateway_disappears
=== RUN   TestAccVPCNATGateway_ConnectivityType_private
=== PAUSE TestAccVPCNATGateway_ConnectivityType_private
=== RUN   TestAccVPCNATGateway_privateIP
=== PAUSE TestAccVPCNATGateway_privateIP
=== RUN   TestAccVPCNATGateway_tags
=== PAUSE TestAccVPCNATGateway_tags
=== RUN   TestAccVPCNATGateway_secondaryAllocationIDs
=== PAUSE TestAccVPCNATGateway_secondaryAllocationIDs
=== RUN   TestAccVPCNATGateway_addSecondaryAllocationIDs
=== PAUSE TestAccVPCNATGateway_addSecondaryAllocationIDs
=== RUN   TestAccVPCNATGateway_secondaryPrivateIPAddressCount
=== PAUSE TestAccVPCNATGateway_secondaryPrivateIPAddressCount
=== RUN   TestAccVPCNATGateway_secondaryPrivateIPAddressCountToSpecific
=== PAUSE TestAccVPCNATGateway_secondaryPrivateIPAddressCountToSpecific
=== RUN   TestAccVPCNATGateway_secondaryPrivateIPAddressCount_updateInPlace
=== PAUSE TestAccVPCNATGateway_secondaryPrivateIPAddressCount_updateInPlace
=== RUN   TestAccVPCNATGateway_secondaryPrivateIPAddresses
=== PAUSE TestAccVPCNATGateway_secondaryPrivateIPAddresses
=== RUN   TestAccVPCNATGateway_SecondaryPrivateIPAddresses_private
=== PAUSE TestAccVPCNATGateway_SecondaryPrivateIPAddresses_private
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalAuto
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalAuto
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalManual_AddAndRemove
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalManual_AddAndRemove
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalManual_ReplaceAndRemove
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalManual_ReplaceAndRemove
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalManual_AZNameToAZID
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalManual_AZNameToAZID
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalManual_AZIDToAZName
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalManual_AZIDToAZName
=== RUN   TestAccVPCNATGateway_availabilityModeRegionalSwitchMode
=== PAUSE TestAccVPCNATGateway_availabilityModeRegionalSwitchMode
=== CONT  TestAccVPCNATGateway_Identity_basic
=== CONT  TestAccVPCNATGateway_addSecondaryAllocationIDs
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalAuto
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalAuto (231.90s)
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalManual_AZNameToAZID
--- PASS: TestAccVPCNATGateway_Identity_basic (237.58s)
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalSwitchMode
--- PASS: TestAccVPCNATGateway_addSecondaryAllocationIDs (640.60s)
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalManual_AZIDToAZName
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalSwitchMode (586.87s)
=== CONT  TestAccVPCNATGateway_basic
--- PASS: TestAccVPCNATGateway_basic (216.86s)
=== CONT  TestAccVPCNATGateway_secondaryAllocationIDs
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalManual_AZNameToAZID (1116.32s)
=== CONT  TestAccVPCNATGateway_tags
--- PASS: TestAccVPCNATGateway_tags (273.59s)
=== CONT  TestAccVPCNATGateway_privateIP
--- PASS: TestAccVPCNATGateway_secondaryAllocationIDs (695.90s)
=== CONT  TestAccVPCNATGateway_ConnectivityType_private
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalManual_AZIDToAZName (1135.33s)
=== CONT  TestAccVPCNATGateway_disappears
--- PASS: TestAccVPCNATGateway_privateIP (218.80s)
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalManual_ReplaceAndRemove
--- PASS: TestAccVPCNATGateway_ConnectivityType_private (197.84s)
=== CONT  TestAccVPCNATGateway_availabilityModeRegionalManual_AddAndRemove
--- PASS: TestAccVPCNATGateway_disappears (273.12s)
=== CONT  TestAccVPCNATGateway_List_basic
--- PASS: TestAccVPCNATGateway_List_basic (232.93s)
=== CONT  TestAccVPCNATGateway_List_regionOverride
--- PASS: TestAccVPCNATGateway_List_regionOverride (218.14s)
=== CONT  TestAccVPCNATGateway_List_includeResource
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalManual_AddAndRemove (674.57s)
=== CONT  TestAccVPCNATGateway_secondaryPrivateIPAddressCount_updateInPlace
--- PASS: TestAccVPCNATGateway_List_includeResource (182.95s)
=== CONT  TestAccVPCNATGateway_SecondaryPrivateIPAddresses_private
--- PASS: TestAccVPCNATGateway_availabilityModeRegionalManual_ReplaceAndRemove (1101.38s)
=== CONT  TestAccVPCNATGateway_secondaryPrivateIPAddresses
--- PASS: TestAccVPCNATGateway_secondaryPrivateIPAddressCount_updateInPlace (343.51s)
=== CONT  TestAccVPCNATGateway_Identity_ExistingResource_basic
--- PASS: TestAccVPCNATGateway_Identity_ExistingResource_basic (288.23s)
=== CONT  TestAccVPCNATGateway_Identity_ExistingResource_noRefreshNoChange
--- PASS: TestAccVPCNATGateway_SecondaryPrivateIPAddresses_private (610.15s)
=== CONT  TestAccVPCNATGateway_Identity_regionOverride
--- PASS: TestAccVPCNATGateway_Identity_ExistingResource_noRefreshNoChange (257.99s)
=== CONT  TestAccVPCNATGateway_secondaryPrivateIPAddressCountToSpecific
--- PASS: TestAccVPCNATGateway_Identity_regionOverride (257.70s)
=== CONT  TestAccVPCNATGateway_secondaryPrivateIPAddressCount
--- PASS: TestAccVPCNATGateway_secondaryPrivateIPAddresses (659.82s)
--- PASS: TestAccVPCNATGateway_secondaryPrivateIPAddressCount (215.30s)
--- PASS: TestAccVPCNATGateway_secondaryPrivateIPAddressCountToSpecific (594.00s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        4093.839s
...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[lorengordon]

Test failures seem unrelated to the changeset. Can someone advise if I need to address them?

[lorengordon]

Finding some race conditions when increasing the secondary count. Moving PR to draft while I sort it out.

[lorengordon]

Ok, I think I got it. After way too much troubleshooting, ultimately turned out to be an eventual consistency issue when confirming that the secondary IP addresses had been assigned successfully. Updated the waiter to use ContinuousTargetOccurence and now it is behaving consistently.