add retry to handle VpcEndpoint modify operation in progress error

[bgaechter]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.
No

Description

This PR adds retry logic for creating and deleting VPC Endpoint Security Group Associations. Currently, if someone creates multiple associations in parallel, as shown in the example below, the VPC Endpoint will throw a VpcEndpoint modify operation in progress error.

resource "aws_vpc_endpoint_security_group_association" "vpc_sg_association" {
  for_each = toset([
    aws_security_group.sg1.id,
    aws_security_group.sg2.id,
    aws_security_group.sg3.id
  ])
  security_group_id = each.value
  vpc_endpoint_id   = aws_vpc_endpoint.example.id
}

Relations

References

Output from Acceptance Testing

make testacc TESTS=TestAccVPCEndpointSecurityGroupAssociation_ PKG=ec2                                                                                                                 
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.9 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccVPCEndpointSecurityGroupAssociation_'  -timeout 360m -vet=off
2025/05/21 13:21:37 Initializing Terraform AWS Provider...
=== RUN   TestAccVPCEndpointSecurityGroupAssociation_basic
=== PAUSE TestAccVPCEndpointSecurityGroupAssociation_basic
=== RUN   TestAccVPCEndpointSecurityGroupAssociation_disappears
=== PAUSE TestAccVPCEndpointSecurityGroupAssociation_disappears
=== RUN   TestAccVPCEndpointSecurityGroupAssociation_multiple
=== PAUSE TestAccVPCEndpointSecurityGroupAssociation_multiple
=== RUN   TestAccVPCEndpointSecurityGroupAssociation_replaceDefaultAssociation
=== PAUSE TestAccVPCEndpointSecurityGroupAssociation_replaceDefaultAssociation
=== CONT  TestAccVPCEndpointSecurityGroupAssociation_basic
=== CONT  TestAccVPCEndpointSecurityGroupAssociation_multiple
=== CONT  TestAccVPCEndpointSecurityGroupAssociation_replaceDefaultAssociation
=== CONT  TestAccVPCEndpointSecurityGroupAssociation_disappears
--- PASS: TestAccVPCEndpointSecurityGroupAssociation_multiple (107.89s)
--- PASS: TestAccVPCEndpointSecurityGroupAssociation_disappears (111.15s)
--- PASS: TestAccVPCEndpointSecurityGroupAssociation_replaceDefaultAssociation (117.69s)
--- PASS: TestAccVPCEndpointSecurityGroupAssociation_basic (118.78s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        124.018s
...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.