fix(ec2): default-VPC region coherence + CreateDefault idempotency + delete protection

[vieiralucas]

Summary

Bug-hunt 2026-06-18 findings 1.1, 1.2, 1.3, + delete-protection.

• 1.1 (HIGH) — default-resource ids were seeded on (account, region, role), but read handlers build a throwaway Ec2State::new(account, req.region) for accounts that don't exist yet, where req.region is the caller's SigV4 scope, not the server's region. When they differed (server us-east-1, client eu-west-1), a no-subnet RunInstances stamped the instance with subnet/VPC ids absent from its own persisted account. Fix: deterministic_id is now region-independent (fakecloud pins one region per server), so read-path and persisted ids always agree.
• 1.3 (MED) — CreateDefaultVpc now returns the seeded default VPC instead of minting a second isDefault=true VPC.
• 1.2 (HIGH) — CreateDefaultSubnet now attaches to the account's real default VPC (was the literal vpc-default, which matched no VPC and orphaned the subnet) and returns the existing per-AZ default subnet when one exists.
• delete-protection — DeleteSecurityGroup on the default group → CannotDelete; DeleteNetworkAcl on a default NACL → CannotDeleteDefaultNetworkAcl (matches AWS). Prevents a VPC ending up with no default SG.

Test plan

• cargo test -p fakecloud-ec2 — unit tests for region-independent ids (incl. read-vs-persist agreement across regions).
• cargo test -p fakecloud-e2e --test ec2_instance_control_plane — idempotent CreateDefaultVpc, CreateDefaultSubnet attaches to the real default VPC, default SG/NACL delete rejection (20/20).
• cargo test -p fakecloud-conformance --test ec2 — 769/769.
• clippy + fmt clean.

---

Summary by cubic

Fixes EC2 default network behavior: default resource IDs are now region-independent, CreateDefaultVpc/Subnet are idempotent and attach correctly, and default SG/NACL delete protection matches AWS. This prevents mismatched IDs on cross-region reads and avoids orphaned subnets or missing default groups.

• Bug Fixes
  • Made deterministic_id region-independent so read paths and persisted state agree; no-subnet RunInstances now lands in the real default VPC/subnet.
  • CreateDefaultVpc returns the existing seeded default VPC (recreates if missing) instead of creating a second default VPC.
  • CreateDefaultSubnet attaches to the account’s actual default VPC and returns the existing per-AZ default subnet when present.
  • Block deletion of the default security group (CannotDelete) and default NACL (CannotDeleteDefaultNetworkAcl) to prevent invalid states.

^{Written for commit cf23a74. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 52 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-ec2/src/service/sg.rs	0.00%	17 Missing ⚠️
crates/fakecloud-ec2/src/service/subnet.rs	0.00%	15 Missing ⚠️
crates/fakecloud-ec2/src/service/vpc.rs	0.00%	11 Missing ⚠️
crates/fakecloud-ec2/src/service/nacl.rs	0.00%	7 Missing ⚠️
crates/fakecloud-ec2/src/service/instance.rs	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!