[Enhancement] Add support for Site-to-Site VPN Concentrator

[ddericco]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

n/a

Description

Adds support for VPN Concentrator in AWS Site-to-Site VPN.

• New resource aws_vpn_concentrator
• Add attribute vpn_concentrator_id to resource aws_vpn_connection

Notes:

• The API lists transitGatewayId as optional, but not including it results in an API error “MissingParameter: The request must contain the parameter transitGatewayId”. Additionally, the documentation points out this is only supported on TGW today. I’m checking to see if this needs to be fixed in the API docs.
• On create, the aws_vpn_concentrator resource creates a separate TGW attachment resource. It’s possible to delete the aws_vpn_concentrator resource before it moves from “Pending” to “Available”, which then decouples it from the TGW attachment still in “Pending”. This was noticeable in testing where the aws_vpn_concentrator resource was deleted, but not the TGW attachment. As a result, the TGW could not be deleted and would be considered a dangling resource. To address this, the Delete waiter function checks both the VPN concentrator resource state and the TGW attachment state and ensures both are deleted before considering the resource “deleted”. If there’s a better/more preferred way to manage this, let me know.

Relations

Closes #45158

References

• Go SDKv2: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ec2#Client.CreateVpnConcentrator
• API: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConcentrator.html
• Docs: https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-concentrator.html

Output from Acceptance Testing

% make testacc TESTS='TestAccEC2VPNConcentrator_*' PKG=ec2 ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_vpn_concentrator 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 4 -run='TestAccEC2VPNConcentrator_*'  -timeout 360m -vet=off
2025/11/20 20:29:27 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/20 20:29:27 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccEC2VPNConcentrator_basic
=== PAUSE TestAccEC2VPNConcentrator_basic
=== RUN   TestAccEC2VPNConcentrator_tags
=== PAUSE TestAccEC2VPNConcentrator_tags
=== CONT  TestAccEC2VPNConcentrator_basic
=== CONT  TestAccEC2VPNConcentrator_tags
--- PASS: TestAccEC2VPNConcentrator_tags (485.96s)
--- PASS: TestAccEC2VPNConcentrator_basic (523.49s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2  523.640s

% make testacc TESTS='TestAccSiteVPNConnection_vpnConcentratorID' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_vpn_concentrator 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccSiteVPNConnection_vpnConcentratorID'  -timeout 360m -vet=off
2025/11/20 20:41:31 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/20 20:41:31 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccSiteVPNConnection_vpnConcentratorID
=== PAUSE TestAccSiteVPNConnection_vpnConcentratorID
=== CONT  TestAccSiteVPNConnection_vpnConcentratorID
--- PASS: TestAccSiteVPNConnection_vpnConcentratorID (1307.44s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2  1307.589s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccSiteVPNConcentrator_\|TestAccSiteVPNConnection_vpnConcentratorID\|TestAccSiteVPNConnection_basic' PKG=ec2 ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 HEAD 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 3  -run=TestAccSiteVPNConcentrator_\|TestAccSiteVPNConnection_vpnConcentratorID\|TestAccSiteVPNConnection_basic -timeout 360m -vet=off
2025/11/23 16:53:38 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/23 16:53:38 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccSiteVPNConcentrator_basic
=== PAUSE TestAccSiteVPNConcentrator_basic
=== RUN   TestAccSiteVPNConcentrator_disappears
=== PAUSE TestAccSiteVPNConcentrator_disappears
=== RUN   TestAccSiteVPNConcentrator_tags
=== PAUSE TestAccSiteVPNConcentrator_tags
=== RUN   TestAccSiteVPNConnection_basic
=== PAUSE TestAccSiteVPNConnection_basic
=== RUN   TestAccSiteVPNConnection_vpnConcentratorID
=== PAUSE TestAccSiteVPNConnection_vpnConcentratorID
=== CONT  TestAccSiteVPNConcentrator_basic
=== CONT  TestAccSiteVPNConnection_basic
=== CONT  TestAccSiteVPNConcentrator_tags
--- PASS: TestAccSiteVPNConnection_basic (244.19s)
=== CONT  TestAccSiteVPNConnection_vpnConcentratorID
--- PASS: TestAccSiteVPNConcentrator_tags (499.00s)
=== CONT  TestAccSiteVPNConcentrator_disappears
--- PASS: TestAccSiteVPNConcentrator_basic (499.96s)
--- PASS: TestAccSiteVPNConcentrator_disappears (467.22s)
--- PASS: TestAccSiteVPNConnection_vpnConcentratorID (764.15s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	1013.912s

[ewbankkit]

% make testacc TESTARGS='-run=TestAccSiteVPNConnectionDataSource_' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 HEAD 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 20  -run=TestAccSiteVPNConnectionDataSource_ -timeout 360m -vet=off
2025/11/24 11:32:15 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/24 11:32:15 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccSiteVPNConnectionDataSource_basic
=== PAUSE TestAccSiteVPNConnectionDataSource_basic
=== RUN   TestAccSiteVPNConnectionDataSource_byFilter
=== PAUSE TestAccSiteVPNConnectionDataSource_byFilter
=== RUN   TestAccSiteVPNConnectionDataSource_nonExistentId
=== PAUSE TestAccSiteVPNConnectionDataSource_nonExistentId
=== RUN   TestAccSiteVPNConnectionDataSource_noInput
=== PAUSE TestAccSiteVPNConnectionDataSource_noInput
=== CONT  TestAccSiteVPNConnectionDataSource_basic
=== CONT  TestAccSiteVPNConnectionDataSource_nonExistentId
=== CONT  TestAccSiteVPNConnectionDataSource_byFilter
=== CONT  TestAccSiteVPNConnectionDataSource_noInput
--- PASS: TestAccSiteVPNConnectionDataSource_noInput (1.74s)
--- PASS: TestAccSiteVPNConnectionDataSource_nonExistentId (2.68s)
--- PASS: TestAccSiteVPNConnectionDataSource_basic (259.70s)
--- PASS: TestAccSiteVPNConnectionDataSource_byFilter (290.45s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/ec2	297.267s

[jar-b]

LGTM 🚀

[ewbankkit]

@ddericco Thanks for the contribution 🎉 👏.

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v6.23.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!