fix: ignore security group drift on existing AWS instances (#175)

Pre-existing workspaces failed to start after the coder-workspace-egress
change. Terraform saw the instance's security group differ from the template
and planned an in-place swap, which needs a permission the provisioner role
does not have:

  Error: updating EC2 Instance (i-015f7199b07d72549): modifying network
  interface: UnauthorizedOperation: not authorized to perform
  ec2:ModifyNetworkInterfaceAttribute on security-group/sg-04e29c7df56b05c4f

The role is create-and-describe only. subnet_id and
associate_public_ip_address were already ignored because they force a
replacement; vpc_security_group_ids was the one network attribute left able to
drift, so add it.

New instances still get the current subnet, public IP, and security group,
since ignore_changes only affects updates. Existing workspaces keep what they
were built with and must be recreated to pick up the fix, which they need
anyway: their instances have no public IP and so no egress.

The security group lookup itself works; it resolved sg-04e29c7df56b05c4f.

Co-authored-by: Noah Boyers <noah@coder.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

deployments/ai.coder.com/demo/devcontainers/workspace.tf

@@ -100,11 +100,16 @@ resource "aws_instance" "dev" {
 
   # Prevent sudden replacements due to AMI updates. subnet_id is ignored for the
   # same reason: re-pointing the template shouldn't force-replace (and wipe)
-  # workspaces already running in another subnet.
+  # workspaces already running in another subnet. vpc_security_group_ids is
+  # ignored because swapping it on a live instance needs
+  # ec2:ModifyNetworkInterfaceAttribute, which the provisioner role does not
+  # have. New instances still get the current values; existing ones must be
+  # recreated to pick up changes.
   lifecycle {
     ignore_changes = [
       ami,
-      subnet_id
+      subnet_id,
+      vpc_security_group_ids
     ]
 
     precondition {

deployments/ai.coder.com/demo/ec2-win-vm/workspace.tf

@@ -124,12 +124,23 @@ resource "aws_instance" "this" {
   }
 
   lifecycle {
-    # subnet_id is ignored so re-pointing the template doesn't force-replace
-    # (and wipe) workspaces already running in another subnet.
+    # All three network attributes are create-time only for existing instances.
+    # subnet_id and associate_public_ip_address would force a replacement, which
+    # wipes the workspace. vpc_security_group_ids would be an in-place update
+    # requiring ec2:ModifyNetworkInterfaceAttribute, which the provisioner role
+    # does not have, so a pre-existing workspace fails to start:
+    #
+    #   UnauthorizedOperation: not authorized to perform
+    #   ec2:ModifyNetworkInterfaceAttribute on security-group/sg-...
+    #
+    # New instances still get the current subnet, public IP, and security group,
+    # since ignore_changes only applies to updates. Existing workspaces keep what
+    # they were built with and must be recreated to pick up changes.
     ignore_changes = [
       ami,
       associate_public_ip_address,
-      subnet_id
+      subnet_id,
+      vpc_security_group_ids
     ]
 
     precondition {