[Enhancement] aws_ec2_transit_gateway: Add encryption_support argument

[tabito-hara]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

This PR adds the encryption_support argument/attribute to the aws_ec2_transit_gateway resource and data source.

AWS API behavior and Provider implementation

• Encryption support can only be enabled using the ModifyTransitGateway API after the resource has been created.

  • AWS Documentation

    You can only add encryption support to an existing transit gateway and not while you're creating one.

  • Therefore, in the Create function, the provider calls ModifyTransitGateway if encryption_support is set to enable.

• Enabling encryption support can take a very long time, and the transit gateway remains available while the change is in progress.

  • AWS Documentation

    This process can take up to 14 days to complete.

  • Due to the long duration, no waiter is implemented for this operation.
  • In the flattener, if the status is enabled or enabling, the encryption_support attribute is set to enable; otherwise, it is set to disable.

Data source

• encyption_support attribute is also implemented to the data source.

Relations

Closes #45305

References

https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGatewayOptions.html
https://docs.aws.amazon.com/vpc/latest/tgw/tgw-encryption-support.html

Output from Acceptance Testing

Resource

$ make testacc TESTS='TestAccTransitGateway_serial/Gateway_(basic|encryptionSupport)' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_ec2_transit_gateway-add_encryption_support 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccTransitGateway_serial/Gateway_(basic|encryptionSupport)'  -timeout 360m -vet=off
2025/11/29 00:26:20 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/29 00:26:20 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccTransitGateway_serial
=== PAUSE TestAccTransitGateway_serial
=== CONT  TestAccTransitGateway_serial
=== RUN   TestAccTransitGateway_serial/Gateway_encryptionSupportWhenUpdated
=== PAUSE TestAccTransitGateway_serial/Gateway_encryptionSupportWhenUpdated
=== RUN   TestAccTransitGateway_serial/Gateway_basic
=== PAUSE TestAccTransitGateway_serial/Gateway_basic
=== RUN   TestAccTransitGateway_serial/Gateway_encryptionSupportWhenCreated
=== PAUSE TestAccTransitGateway_serial/Gateway_encryptionSupportWhenCreated
=== CONT  TestAccTransitGateway_serial/Gateway_encryptionSupportWhenUpdated
=== CONT  TestAccTransitGateway_serial/Gateway_encryptionSupportWhenCreated
=== CONT  TestAccTransitGateway_serial/Gateway_basic
--- PASS: TestAccTransitGateway_serial (0.00s)
    --- PASS: TestAccTransitGateway_serial/Gateway_basic (201.33s)
    --- PASS: TestAccTransitGateway_serial/Gateway_encryptionSupportWhenCreated (201.33s)
    --- PASS: TestAccTransitGateway_serial/Gateway_encryptionSupportWhenUpdated (211.58s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        216.195s

Data Source

$ make testacc TESTS='TestAccTransitGatewayDataSource_serial/Gateway_' PKG=ec2 
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-aws_ec2_transit_gateway-add_encryption_support 🌿...
TF_ACC=1 go1.24.10 test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccTransitGatewayDataSource_serial/Gateway_'  -timeout 360m -vet=off
2025/11/29 00:09:50 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/29 00:09:50 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccTransitGatewayDataSource_serial
=== PAUSE TestAccTransitGatewayDataSource_serial
=== CONT  TestAccTransitGatewayDataSource_serial
=== RUN   TestAccTransitGatewayDataSource_serial/Gateway_Filter
=== PAUSE TestAccTransitGatewayDataSource_serial/Gateway_Filter
=== RUN   TestAccTransitGatewayDataSource_serial/Gateway_ID
=== PAUSE TestAccTransitGatewayDataSource_serial/Gateway_ID
=== CONT  TestAccTransitGatewayDataSource_serial/Gateway_Filter
=== CONT  TestAccTransitGatewayDataSource_serial/Gateway_ID
--- PASS: TestAccTransitGatewayDataSource_serial (0.00s)
    --- PASS: TestAccTransitGatewayDataSource_serial/Gateway_Filter (208.48s)
    --- PASS: TestAccTransitGatewayDataSource_serial/Gateway_ID (208.60s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        212.919s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.