fix: allow to add subnets/-mappings to a Network LoadBalancer

[elchead]

Description

AWS allows to add subnets to an EC2 Network LoadBalancer (see https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#availability-zones), but the Terraform provider forces a recreation on subnet changes.

This PR loosens the condition to force a create only when subnets are deleted.
Specifically it allows appending updates of the subnet and subnet_mapping fields

Relations

Closes #17281.
Closes #33814.

References

Output from Acceptance Testing

% make testacc TESTS=TestAccXXX PKG=ec2

...

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @elchead 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[elchead]

I'm stuck with how to find out to distinguish between adding / deletion of dynamically created subnets.
I created test cases for adding and deleting subnets from a LB resource (see latest commit).
The problem is that the subnets are only known after apply, so the apply with an added subnet actually sees a deletion:

# aws_lb.test must be replaced
-/+ resource "aws_lb" "test" {
      ~ arn                              = "arn:aws:elasticloadbalancing:eu-west-1:795746500882:loadbalancer/net/test/4b555e1c6ace9dce" -> (known after apply)
      ~ arn_suffix                       = "net/test/4b555e1c6ace9dce" -> (known after apply)
      ~ dns_name                         = "test-4b555e1c6ace9dce.elb.eu-west-1.amazonaws.com" -> (known after apply)
      ~ id                               = "arn:aws:elasticloadbalancing:eu-west-1:795746500882:loadbalancer/net/test/4b555e1c6ace9dce" -> (known after apply)
      ~ ip_address_type                  = "ipv4" -> (known after apply)
        name                             = "test"
      ~ security_groups                  = [] -> (known after apply)
      ~ subnets                          = [ # forces replacement
          - "subnet-03db0ed6e37668460",
          - "subnet-060e6ef824d6d1224",
        ] -> (known after apply) # forces replacement

Do you have an idea to circumvent this issue?
Is there a way to check if a subnet was added for dynamic resources?

A solution could be to add a new optional, boolean field add_subnets to the resource, which would disable the force new check. When a user would set the field and would try to delete a subnet, the terraform apply would just fail (timeout).
There should also be no backward compatibility issue. The field would only enable to update the resource when adding a subnet.
What do you think?

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccELBV2LoadBalancer_' PKG=elbv2 ACCTEST_PARALLELISM=3
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/elbv2/... -v -count 1 -parallel 3  -run=TestAccELBV2LoadBalancer_ -timeout 360m
=== RUN   TestAccELBV2LoadBalancer_ALB_basic
=== PAUSE TestAccELBV2LoadBalancer_ALB_basic
=== RUN   TestAccELBV2LoadBalancer_NLB_basic
=== PAUSE TestAccELBV2LoadBalancer_NLB_basic
=== RUN   TestAccELBV2LoadBalancer_LoadBalancerType_gateway
=== PAUSE TestAccELBV2LoadBalancer_LoadBalancerType_gateway
=== RUN   TestAccELBV2LoadBalancer_disappears
=== PAUSE TestAccELBV2LoadBalancer_disappears
=== RUN   TestAccELBV2LoadBalancer_nameGenerated
=== PAUSE TestAccELBV2LoadBalancer_nameGenerated
=== RUN   TestAccELBV2LoadBalancer_nameGeneratedForZeroValue
=== PAUSE TestAccELBV2LoadBalancer_nameGeneratedForZeroValue
=== RUN   TestAccELBV2LoadBalancer_namePrefix
=== PAUSE TestAccELBV2LoadBalancer_namePrefix
=== RUN   TestAccELBV2LoadBalancer_duplicateName
=== PAUSE TestAccELBV2LoadBalancer_duplicateName
=== RUN   TestAccELBV2LoadBalancer_tags
=== PAUSE TestAccELBV2LoadBalancer_tags
=== RUN   TestAccELBV2LoadBalancer_ipv6SubnetMapping
=== PAUSE TestAccELBV2LoadBalancer_ipv6SubnetMapping
=== RUN   TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing
=== PAUSE TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing
=== RUN   TestAccELBV2LoadBalancer_ALB_outpost
=== PAUSE TestAccELBV2LoadBalancer_ALB_outpost
=== RUN   TestAccELBV2LoadBalancer_networkLoadBalancerEIP
=== PAUSE TestAccELBV2LoadBalancer_networkLoadBalancerEIP
=== RUN   TestAccELBV2LoadBalancer_NLB_privateIPv4Address
=== PAUSE TestAccELBV2LoadBalancer_NLB_privateIPv4Address
=== RUN   TestAccELBV2LoadBalancer_backwardsCompatibility
=== PAUSE TestAccELBV2LoadBalancer_backwardsCompatibility
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDropInvalidHeaderFields
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDropInvalidHeaderFields
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatePreserveHostHeader
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatePreserveHostHeader
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen
=== RUN   TestAccELBV2LoadBalancer_updateIPAddressType
=== PAUSE TestAccELBV2LoadBalancer_updateIPAddressType
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnet
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnet
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnet
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnet
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnetMapping
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnetMapping
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnetMapping
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnetMapping
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_noSecurityGroup
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_noSecurityGroup
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogs
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogs
=== RUN   TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogsPrefix
=== PAUSE TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogsPrefix
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogs
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogs
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogsPrefix
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogsPrefix
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateDNSRecordClientRoutingPolicy
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateDNSRecordClientRoutingPolicy
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_enforcePrivateLink
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_enforcePrivateLink
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnet
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnet
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnet
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnet
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnetMapping
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnetMapping
=== RUN   TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnetMapping
=== PAUSE TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnetMapping
=== RUN   TestAccELBV2LoadBalancer_updateDesyncMitigationMode
=== PAUSE TestAccELBV2LoadBalancer_updateDesyncMitigationMode
=== RUN   TestAccELBV2LoadBalancer_ALB_updateTLSVersionAndCipherSuite
=== PAUSE TestAccELBV2LoadBalancer_ALB_updateTLSVersionAndCipherSuite
=== RUN   TestAccELBV2LoadBalancer_ALB_updateXffHeaderProcessingMode
=== PAUSE TestAccELBV2LoadBalancer_ALB_updateXffHeaderProcessingMode
=== RUN   TestAccELBV2LoadBalancer_ALB_updateXffClientPort
=== PAUSE TestAccELBV2LoadBalancer_ALB_updateXffClientPort
=== CONT  TestAccELBV2LoadBalancer_ALB_basic
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups
--- PASS: TestAccELBV2LoadBalancer_ALB_basic (233.72s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnetMapping
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups (283.41s)
=== CONT  TestAccELBV2LoadBalancer_ALB_updateXffClientPort
--- PASS: TestAccELBV2LoadBalancer_ALB_updateXffClientPort (296.26s)
=== CONT  TestAccELBV2LoadBalancer_ALB_updateXffHeaderProcessingMode
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnetMapping (461.82s)
=== CONT  TestAccELBV2LoadBalancer_ALB_updateTLSVersionAndCipherSuite
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups (748.87s)
=== CONT  TestAccELBV2LoadBalancer_updateDesyncMitigationMode
--- PASS: TestAccELBV2LoadBalancer_ALB_updateXffHeaderProcessingMode (310.65s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogs
--- PASS: TestAccELBV2LoadBalancer_ALB_updateTLSVersionAndCipherSuite (300.31s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateDNSRecordClientRoutingPolicy
--- PASS: TestAccELBV2LoadBalancer_updateDesyncMitigationMode (303.36s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogsPrefix
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogs (354.35s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogs
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateDNSRecordClientRoutingPolicy (342.23s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogsPrefix
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogsPrefix (347.68s)
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnetMapping (267.06s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_noSecurityGroup
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogs (370.69s)
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnetMapping (256.04s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnet
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_noSecurityGroup (226.63s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_enforcePrivateLink
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogsPrefix (314.81s)
=== CONT  TestAccELBV2LoadBalancer_ALB_outpost
    acctest.go:1155: skipping since no Outposts found
--- SKIP: TestAccELBV2LoadBalancer_ALB_outpost (0.49s)
=== CONT  TestAccELBV2LoadBalancer_updateIPAddressType
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnet (309.06s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen
--- PASS: TestAccELBV2LoadBalancer_updateIPAddressType (280.48s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_enforcePrivateLink (366.28s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnet
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen (289.12s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnetMapping
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection (303.38s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatePreserveHostHeader
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_deleteSubnet (448.55s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDropInvalidHeaderFields
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_addSubnetMapping (319.41s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatePreserveHostHeader (306.42s)
=== CONT  TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDropInvalidHeaderFields (284.88s)
=== CONT  TestAccELBV2LoadBalancer_backwardsCompatibility
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2 (298.86s)
=== CONT  TestAccELBV2LoadBalancer_NLB_privateIPv4Address
--- PASS: TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone (313.93s)
=== CONT  TestAccELBV2LoadBalancer_networkLoadBalancerEIP
--- PASS: TestAccELBV2LoadBalancer_backwardsCompatibility (216.20s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnet
--- PASS: TestAccELBV2LoadBalancer_NLB_privateIPv4Address (224.71s)
=== CONT  TestAccELBV2LoadBalancer_namePrefix
--- PASS: TestAccELBV2LoadBalancer_networkLoadBalancerEIP (231.93s)
=== CONT  TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_addSubnet (243.91s)
=== CONT  TestAccELBV2LoadBalancer_ipv6SubnetMapping
--- PASS: TestAccELBV2LoadBalancer_namePrefix (200.82s)
=== CONT  TestAccELBV2LoadBalancer_tags
--- PASS: TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing (240.93s)
=== CONT  TestAccELBV2LoadBalancer_duplicateName
--- PASS: TestAccELBV2LoadBalancer_ipv6SubnetMapping (246.32s)
=== CONT  TestAccELBV2LoadBalancer_disappears
--- PASS: TestAccELBV2LoadBalancer_duplicateName (214.03s)
=== CONT  TestAccELBV2LoadBalancer_nameGeneratedForZeroValue
--- PASS: TestAccELBV2LoadBalancer_tags (298.73s)
=== CONT  TestAccELBV2LoadBalancer_nameGenerated
--- PASS: TestAccELBV2LoadBalancer_disappears (189.46s)
=== CONT  TestAccELBV2LoadBalancer_LoadBalancerType_gateway
--- PASS: TestAccELBV2LoadBalancer_nameGeneratedForZeroValue (216.89s)
=== CONT  TestAccELBV2LoadBalancer_NLB_basic
--- PASS: TestAccELBV2LoadBalancer_nameGenerated (212.83s)
=== CONT  TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnet
--- PASS: TestAccELBV2LoadBalancer_LoadBalancerType_gateway (211.05s)
--- PASS: TestAccELBV2LoadBalancer_NLB_basic (231.49s)
--- PASS: TestAccELBV2LoadBalancer_ApplicationLoadBalancer_deleteSubnet (263.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/elbv2	4039.206s

[ewbankkit]

@elchead @jphelton Thanks for the contribution 🎉 👏.

[github-actions]

This functionality has been released in v5.31.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.