Add encryption-in-transit-supported attribute to aws_ec2_instance_type

[lachlancooper]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

This is a request to add an encryption_in_transit_supported attribute to the aws_ec2_instance_type data source.

The encryptionInTransitSupported field was added to the SDK recently in https://github.com/aws/aws-sdk-go/releases/tag/v1.40.27.

I'm requesting this feature because we want to ensure our engineers always select instance types that support automatic in-transit encryption, to align with our security policies.

Until recently the list of types supporting automatic in-transit encryption was only available on this documentation page. Our current solution is therefore a custom validation rule on each instance type input variable, using a manually-maintained regex of acceptable instance types.

Now that the information is available directly via the EC2 API, we would like to avoid the need for the manually-maintained regex.

New or Affected Resource(s)

• aws_ec2_instance_type

Potential Terraform Configuration

variable "example_instance_type" {
  default = "t2.micro"
}

data "aws_ec2_instance_type" "example" {
  instance_type = var.example_instance_type
}

locals {
  example_instance_type_validated = data.aws_ec2_instance_type.example.encryption_in_transit_supported ? var.example_instance_type : ""
}

resource "aws_ec2_host" "example" {
  # this will be empty if the specified instance type does not support automatic in-transit encryption
  instance_type = local.example_instance_type_validated
}

References

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit
• https://docs.aws.amazon.com/sdk-for-go/api/service/ec2/#NetworkInfo

[rrangith]

I created a PR for this: #21837

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.