[Enhancement] Add support for Site-to-Site VPN Concentrator

[ddericco]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

n/a

Description

Adds support for VPN Concentrator in AWS Site-to-Site VPN.

• New resource aws_vpn_concentrator
• Add attribute vpn_concentrator_id to resource aws_vpn_connection

Notes:

• The API lists transitGatewayId as optional, but not including it results in an API error “MissingParameter: The request must contain the parameter transitGatewayId”. Additionally, the documentation points out this is only supported on TGW today. I’m checking to see if this needs to be fixed in the API docs.
• On create, the aws_vpn_concentrator resource creates a separate TGW attachment resource. It’s possible to delete the aws_vpn_concentrator resource before it moves from “Pending” to “Available”, which then decouples it from the TGW attachment still in “Pending”. This was noticeable in testing where the aws_vpn_concentrator resource was deleted, but not the TGW attachment. As a result, the TGW could not be deleted and would be considered a dangling resource. To address this, the Delete waiter function checks both the VPN concentrator resource state and the TGW attachment state and ensures both are deleted before considering the resource “deleted”. If there’s a better/more preferred way to manage this, let me know.

Relations

Closes #45158

References

• Go SDKv2: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ec2#Client.CreateVpnConcentrator
• API: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConcentrator.html
• Docs: https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-concentrator.html

Output from Acceptance Testing

% make testacc TESTS='TestAccEC2VPNConcentrator_*' PKG=ec2 ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_vpn_concentrator 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 4 -run='TestAccEC2VPNConcentrator_*'  -timeout 360m -vet=off
2025/11/20 20:29:27 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/20 20:29:27 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccEC2VPNConcentrator_basic
=== PAUSE TestAccEC2VPNConcentrator_basic
=== RUN   TestAccEC2VPNConcentrator_tags
=== PAUSE TestAccEC2VPNConcentrator_tags
=== CONT  TestAccEC2VPNConcentrator_basic
=== CONT  TestAccEC2VPNConcentrator_tags
--- PASS: TestAccEC2VPNConcentrator_tags (485.96s)
--- PASS: TestAccEC2VPNConcentrator_basic (523.49s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2  523.640s

% make testacc TESTS='TestAccSiteVPNConnection_vpnConcentratorID' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_vpn_concentrator 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccSiteVPNConnection_vpnConcentratorID'  -timeout 360m -vet=off
2025/11/20 20:41:31 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/20 20:41:31 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccSiteVPNConnection_vpnConcentratorID
=== PAUSE TestAccSiteVPNConnection_vpnConcentratorID
=== CONT  TestAccSiteVPNConnection_vpnConcentratorID
--- PASS: TestAccSiteVPNConnection_vpnConcentratorID (1307.44s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2  1307.589s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.