An equivalent HCL program to demonstrate that a replace is caused when changing `secondary_allocation_ids`.

aws-2971-repro.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5"
    }
  }

  required_version = ">= 1.2.0"
}


# provider "google" {
#   project = "pulumi-development"
# }

# resource "random_password" "db" {
#   length = 10
# }
provider "aws" {
  # Configure the AWS Provider
  region = "us-east-1"
}

# Default VPC
data "aws_vpc" "default" {
  default = true
}

# Default VPC Subnets
data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

# Two EIPs
resource "aws_eip" "one" {
  domain = "vpc"
}

resource "aws_eip" "two" {
  domain = "vpc"
}

# NAT Gateway
resource "aws_nat_gateway" "ng" {
  allocation_id = aws_eip.one.id

  // after a first run to create the NAT Gateway, uncomment the following line to
  // reproduce the replace:

  // secondary_allocation_ids = [aws_eip.two.id]

  subnet_id = tolist(data.aws_subnets.default.ids)[0]
}