fix(ec2): add ipv6CidrBlockCreated property to VPC for IPv6 CIDR block dependency

[pahud]

Issue # (if applicable)

Closes #36714.

Reason for this change

When using a dual-stack VPC and referencing vpc.vpcIpv6CidrBlocks to create dependent resources (like security groups), CloudFormation deployments may fail with race conditions because there's no explicit dependency on the AWS::EC2::VPCCidrBlock resource. Users experience intermittent deployment failures with:

Status: CREATE_FAILED
Status Reason: Template error: Fn::Select cannot select nonexistent value at index 0

The workaround required internal knowledge of the construct:

const vpcCidrBlock = vpc.node.findChild('ipv6cidr') as CfnVPCCidrBlock;
securityGroup.node.addDependency(vpcCidrBlock);

Description of changes

Added a new ipv6CidrBlockCreated: IDependable property to the VPC construct that allows users to establish a dependency on the IPv6 CIDR block being allocated before creating resources that reference vpcIpv6CidrBlocks.

• Added ipv6CidrBlockCreated property to IVpc interface
• Added ipv6CidrBlockCreated property to VpcBase abstract class
• Implemented ipv6CidrBlockCreated in Vpc class with DependencyGroup that contains the IPv6 CIDR block resource
• Added ipv6CidrBlockCreated to ImportedVpc and LookedUpVpc classes (empty DependencyGroup)
• Follows the existing internetConnectivityEstablished pattern

Usage Example:

const vpc = new Vpc(this, 'DualStackVpc', {
  ipProtocol: IpProtocol.DUAL_STACK,
});

const sg = new SecurityGroup(this, 'SG', { vpc });
sg.addIngressRule(
  Peer.ipv6(Fn.select(0, vpc.vpcIpv6CidrBlocks)),
  Port.tcp(443)
);

// Add dependency to ensure IPv6 CIDR block exists first
sg.node.addDependency(vpc.ipv6CidrBlockCreated);

This is NOT a breaking change - this is an additive change that does not affect existing behavior.

Describe any new or updated permissions being added

N/A - No IAM permission changes.

Description of how you validated changes

• Unit tests: Added 5 new unit tests in vpc.test.ts:
  • ipv6CidrBlockCreated is defined for dual-stack VPCs
  • ipv6CidrBlockCreated is defined for IPv4-only VPCs (empty DependencyGroup)
  • resources depending on ipv6CidrBlockCreated have correct DependsOn for dual-stack VPCs
  • resources depending on ipv6CidrBlockCreated have no DependsOn for IPv4-only VPCs
  • imported VPCs have ipv6CidrBlockCreated property (empty DependencyGroup)
• Integration test: Added integ.vpc-ipv6-cidr-block-dependency.ts that:
  • Creates a dual-stack VPC with IPv6 enabled
  • Creates a SecurityGroup with an IPv6 CIDR ingress rule using vpc.vpcIpv6CidrBlocks
  • Adds dependency on vpc.ipv6CidrBlockCreated to prevent the race condition
  • Deployed successfully to AWS and verified the DependsOn is correctly set in CloudFormation

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates