fix: preflight AWS Elastic IP quota before network creation

[alongubkin]

Background

Every managed AWS network creates one public NAT gateway and therefore needs one Amazon-owned EC2-VPC Elastic IP. Alien previously discovered an exhausted regional quota only after creating the VPC, subnets, gateway, route tables, and security group.

Closes ALIEN-887.

Reproduce

1. Exhaust the regional EC2-VPC EIP quota.
2. Deploy a stack with an implicit or explicit managed network.
3. Observe partial network creation followed by AddressLimitExceeded during EIP allocation.

UseDefault and ByoVpcAws do not allocate this EIP.

Root cause

The controller knew the future EIP requirement but had no early usage/quota observation. The initial implementation counted every domain=vpc address, including addresses allocated from a customer-owned BYOIP pool. AWS explicitly exempts BYOIP allocations from the EC2-VPC EIP quota, so that produced false exhaustion.

Fix

• Add EC2 DescribeAddresses and Service Quotas GetServiceQuota support.
• Model publicIpv4Pool; count only Amazon-owned VPC EIPs and exclude BYOIP pool addresses.
• Treat incomplete address-domain provenance or unavailable quota reads as uncertain best-effort observations, not proven exhaustion.
• Check applied quota ec2/L-0263D0A3 in mutation-free CreateStart and fail with actionable guidance before VPC creation.
• Keep the eventual allocation authoritative because quota observations can race.
• Keep default/BYO networks, resumed states, and non-AWS flows unchanged.

Verification

• EC2 XML parser test includes both Amazon-owned and BYOIP allocations.
• Unit coverage proves mixed usage counts only Amazon-owned addresses and missing domain becomes unknown.
• A connected SingleControllerExecutor test supplies one Amazon EIP plus one BYOIP EIP against quota 2 and proves CreateStart advances to CreatingVpc instead of falsely rejecting it; no VPC mutation occurs in that step.
• Local focused parser and controller tests pass. CI Rust is running; all other required checks pass.

AWS references: EIP quota exemption, Address publicIpv4Pool.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fully addressed and no new actionable issue was identified.

Summary

This PR adds a best-effort AWS Elastic IP quota preflight before managed-network creation.

• Reads regional EIP usage and the applied EC2-VPC EIP quota before creating network resources.
• Counts Amazon-owned VPC addresses, including explicit publicIpv4Pool = "amazon", while excluding BYOIP addresses.
• Continues provisioning when quota observations are unavailable and leaves eventual allocation authoritative.
• Adds the required Service Quotas client support, permissions, and focused tests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[CreateStart] --> B{Managed AWS network?}
    B -- No --> C[Existing network flow]
    B -- Yes --> D[Read EIP usage and applied quota]
    D --> E{Observation conclusive?}
    E -- No --> F[Continue to CreatingVpc]
    E -- Yes --> G{One EIP available?}
    G -- Yes --> F
    G -- No --> H[Fail before creating network resources]

Loading

_{Reviews (4) · Last reviewed commit: "fix(aws): count explicit Amazon EIP pool..."}

[alongubkin]

@greptileai review

[alongubkin]

@greptileai please re-review the latest head, focusing on BYOIP quota accounting and the connected CreateStart regression.

[alongubkin]

@greptileai please re-review the latest head; explicit publicIpv4Pool = "amazon" is now counted and covered.