aws.ec2.Subnet: updating resource option triggers spurious DisassociateSubnetCidrBlock -> InvalidCidrBlock.InUse when ipv6CidrBlock is not in config

[MeganYTan]

Describe what happened

Overview

Updating any resource option on an existing subnet that has:

• assignIpv6AddressOnCreation: true
• an IPv6 CIDR block that was not explicitly set in the Pulumi program (e.g. the subnet was imported, IPAM-allocated, or the IPv6 CIDR is in ignoreChanges rather than in props)

causes pulumi up to fail with:

sdk-v2/provider2.go:572: sdk.helper_schema: disassociating EC2 Subnet IPv6 CIDR block: operation error EC2: DisassociateSubnetCidrBlock, https response error StatusCode: 400, api error InvalidCidrBlock.InUse: The subnet IPv6 CIDR block with association ID <id> may not be disassociated, because its subnet has assign-ipv6-address-on-creation set to true.

The same change succeeds in the AWS console.

Root cause

This is a bug in terraform-provider-aws resourceSubnetUpdate. The update path contains:

if currentIPv6, ipv6InConfig := d.Get("ipv6_cidr_block").(string),
    !rawConfig.GetAttr("ipv6_cidr_block").IsNull();
    d.HasChange("ipv6_cidr_block") || (currentIPv6 != "" && !ipv6InConfig) {

The second branch, currentIPv6 != "" && !ipv6InConfig, fires whenever the subnet has an
IPv6 CIDR in state but ipv6_cidr_block was not explicitly set in the user's config. When
that condition is true on any update, the provider calls modifySubnetIPv6CIDRBlockAssociation
with an empty target, disassociating the existing CIDR.

• Upstream issue: hashicorp/terraform-provider-aws#46795 — aws_subnet: IPv6 CIDR Block disassociation issue (open)

Current workaround

Add all IPv6-related fields (plus any attribute you need to change) to ignoreChanges and set them out-of-band.
This works but requires out-of-band management and a pulumi refresh to sync state.

Sample program

Step 1
Create the subnet with ipv6CidrBlock explicitly in props (establishes the IPv6
CIDR in state):

const vpc = new aws.ec2.Vpc("vpc", {
    cidrBlock: "10.0.0.0/16",
    assignGeneratedIpv6CidrBlock: true,
});

const subnet = new aws.ec2.Subnet("subnet", {
    vpcId:    vpc.id,
    cidrBlock: "10.0.1.0/24",
    assignIpv6AddressOnCreation: true,
    ipv6CidrBlock: vpc.ipv6CidrBlock.apply(c => `${c.split("::")[0]}::/64`),
});

Run pulumi up.

Step 2
Switch to a pattern where ipv6CidrBlock is no longer in props (e.g. an imported
subnet, or IPAM-allocated), and add an unrelated change (enableDns64: true):

const subnet = new aws.ec2.Subnet("subnet", {
    vpcId:    vpc.id,
    cidrBlock: "10.0.1.0/24",
    assignIpv6AddressOnCreation: true,
    enableDns64: true,  // the only intended change
    // ipv6CidrBlock removed from props — now in ignoreChanges
}, {
    ignoreChanges: ["ipv6CidrBlock", "ipv6CidrBlockAssociationId"],
});

Run pulumi up again. It fails with the error above.

Log output

No response

Affected Resource(s)

No response

Output of pulumi about

CLI
Version 3.234.0
Go Version go1.26.2
Go Compiler gc

Plugins
KIND NAME VERSION
resource aws 7.34.0
language nodejs 3.234.0

Host
OS darwin
Version 15.5
Arch arm64

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).