feat: Cloud WAN VPC attachment options (parity with v4.9.0)

Adds routing_policy_label, dns_support and security_group_referencing
to core_network_options, wired to aws_networkmanager_vpc_attachment.
Defaults are null so the AWS service defaults apply and existing
attachments see no diff on upgrade. Ports the remaining v4.9.0 scope
(PR aws-ia#187) to v5; enable_dns64 and the NAT64 route were already present.

Co-authored-by: Pablo Sanchez Carmona <pablo19sc@users.noreply.github.com>

Author: Cristobal

attachments.tf

@@ -229,9 +229,14 @@ resource "aws_networkmanager_vpc_attachment" "this" {
     for az in local.azs : local.subnet_arns["${each.value.group}/${az}"]
   ]
 
+  routing_policy_label = each.value.options.routing_policy_label
+
   options {
     appliance_mode_support = each.value.options.appliance_mode
     ipv6_support           = each.value.ipv6
+    # null defers to the AWS service defaults so existing attachments see no diff
+    dns_support                        = each.value.options.dns_support
+    security_group_referencing_support = each.value.options.security_group_referencing
   }
 
   tags = merge(var.tags, each.value.tags, {

docs/attachments.md

@@ -71,6 +71,8 @@ subnets = {
 
 Create mode owns the Network Manager VPC attachment; inject mode uses `create = false` plus `attachment_id`. `core_network` and `core_network_ipv6` route lists on other subnet groups target the effective attachment.
 
+Optional attachment arguments: `routing_policy_label` applies a routing policy label for traffic routing decisions, and `dns_support` / `security_group_referencing` map to the attachment options block. All three default to `null`, deferring to the AWS service defaults so existing attachments see no diff.
+
 ## Cloud WAN acceptance ownership
 
 Acceptance is an explicit lifecycle boundary:

tests/core_network_attachment_options.tftest.hcl

@@ -0,0 +1,87 @@
+# Cloud WAN VPC attachment options: routing_policy_label, dns_support,
+# security_group_referencing (ported from v4.9.0). Defaults must be null so the
+# AWS service defaults apply and existing attachments see no diff.
+
+mock_provider "aws" {
+  override_during = plan
+
+  mock_data "aws_partition" { defaults = { partition = "aws" } }
+  mock_data "aws_region" { defaults = { region = "us-east-1" } }
+  mock_data "aws_caller_identity" { defaults = { account_id = "123456789012" } }
+
+  mock_resource "aws_vpc" {
+    defaults = {
+      id         = "vpc-mock"
+      arn        = "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-mock"
+      cidr_block = "10.99.0.0/16"
+    }
+  }
+  mock_resource "aws_subnet" {
+    defaults = {
+      id  = "subnet-mock"
+      arn = "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-mock"
+    }
+  }
+  mock_resource "aws_networkmanager_vpc_attachment" {
+    defaults = { id = "attachment-created" }
+  }
+}
+
+run "options_propagate_to_attachment" {
+  command = plan
+  variables {
+    vpc                = { name = "cwan-options-set" }
+    addressing         = { primary = { cidr_block = "10.99.0.0/16" } }
+    availability_zones = { names = ["us-east-1a"] }
+    subnets = {
+      cwan = {
+        role = "core_network"
+        ipv4 = { cidrs_by_az = { us-east-1a = "10.99.0.0/28" } }
+        core_network_options = {
+          id                         = "cnet-0123456789abcdef0"
+          routing_policy_label       = "prod-attachments"
+          dns_support                = true
+          security_group_referencing = false
+        }
+      }
+    }
+  }
+
+  assert {
+    condition     = aws_networkmanager_vpc_attachment.this["vpc"].routing_policy_label == "prod-attachments"
+    error_message = "routing_policy_label was not propagated to the Cloud WAN VPC attachment"
+  }
+
+  assert {
+    condition     = [for o in aws_networkmanager_vpc_attachment.this["vpc"].options : o.dns_support][0] == true
+    error_message = "dns_support was not propagated to the Cloud WAN VPC attachment options"
+  }
+
+  assert {
+    condition     = [for o in aws_networkmanager_vpc_attachment.this["vpc"].options : o.security_group_referencing_support][0] == false
+    error_message = "security_group_referencing was not propagated to the Cloud WAN VPC attachment options"
+  }
+}
+
+run "options_default_to_null" {
+  command = plan
+  variables {
+    vpc                = { name = "cwan-options-default" }
+    addressing         = { primary = { cidr_block = "10.99.0.0/16" } }
+    availability_zones = { names = ["us-east-1a"] }
+    subnets = {
+      cwan = {
+        role = "core_network"
+        ipv4 = { cidrs_by_az = { us-east-1a = "10.99.0.0/28" } }
+        core_network_options = {
+          id = "cnet-0123456789abcdef0"
+        }
+      }
+    }
+  }
+
+  assert {
+    condition     = aws_networkmanager_vpc_attachment.this["vpc"].routing_policy_label == null
+    error_message = "routing_policy_label must default to null (AWS default preserved)"
+  }
+}

variables.tf

@@ -612,6 +612,10 @@ variable "subnets" {
       accept_attachment  = optional(bool, false)
       create_accepter    = optional(bool, true)
       accepter_id        = optional(string)
+      # null defers to the AWS service defaults so existing attachments see no diff
+      dns_support                = optional(bool)
+      security_group_referencing = optional(bool)
+      routing_policy_label       = optional(string)
     }))
   }))