fix(elbv2): prevent duplicate listener creation on same port/protocol

[Aeolun]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls. This change adds defensive validation to prevent duplicate resource creation but does not modify access controls, encryption, or logging.

Description

Adds defensive validation to prevent duplicate listener creation on AWS load balancers when the AWS API fails to raise a DuplicateListener error.

Problem: The AWS CreateListener API sometimes silently returns an existing listener instead of raising an error when attempting to create a listener with the same port and protocol combination. This causes Terraform/Pulumi to incorrectly treat the operation as successful, leading to state inconsistencies where multiple listener resources point to the same ARN. When one listener is subsequently deleted, all resources referencing that ARN are affected.

Solution: Before attempting to create a listener, query existing listeners on the load balancer and explicitly check for port/protocol conflicts. If a duplicate is detected, return an error immediately. This follows the same defensive pattern already implemented in load_balancer.go and target_group.go.

Tradeoff: Adds one DescribeListeners API call before each listener creation (~50-200ms additional latency), but prevents silent data corruption and state inconsistencies.

Relations

Closes #35121

References

• Original issue discussion:
  [Bug]: Implicit import of aws_lb_listener instead of error "A listener already exists on this port for this load balancer" #35121
• Similar defensive patterns in codebase:
  • internal/service/elbv2/load_balancer.go:385-395
  • internal/service/elbv2/target_group.go:424-432

Output from Acceptance Testing

Note: Acceptance tests require AWS IAM permissions not available in contributor's account. Tests will need to be run by maintainers with appropriate access.

Expected Test Results:

The following tests should pass when run with proper AWS credentials:

% make testacc TESTS=TestAccELBV2Listener_duplicate PKG=elbv2
% make testacc TESTS=TestAccELBV2Listener_duplicate_ALB_protocolDefaulting_HTTP PKG=elbv2
% make testacc TESTS=TestAccELBV2Listener_duplicate_ALB_protocolDefaulting_HTTPS PKG=elbv2
% make testacc TESTS=TestAccELBV2Listener_duplicate_NLB_TCP PKG=elbv2
% make testacc TESTS=TestAccELBV2Listener_duplicate_NLB_TLS PKG=elbv2

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.