[BUG] OpenTofu VPC DNS support attribute does not persist

Summary

OpenTofu cannot persist enable_dns_support = false on an EC2 VPC. After tofu apply, DescribeVpcAttribute returns true instead of the requested false.

Reproduction

Use Floci at http://localhost:4566, OpenTofu 1.8, and AWS provider ~> 5.0.

Create main.tf:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

variable "endpoint" {
  default = "http://localhost:4566"
}

provider "aws" {
  region     = "us-east-1"
  access_key = "test"
  secret_key = "test"

  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true

  endpoints {
    ec2 = var.endpoint
  }
}

resource "aws_vpc" "repro" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = false
  enable_dns_hostnames = false
}

output "vpc_id" {
  value = aws_vpc.repro.id
}

Run:

tofu init
tofu apply -auto-approve
VPC_ID=$(tofu output -raw vpc_id)
aws --endpoint-url http://localhost:4566 ec2 describe-vpc-attribute \
  --vpc-id "$VPC_ID" --attribute enableDnsSupport

Expected output contains:

"Value": false

Observed output contains:

"Value": true

The same mismatch occurs in compatibility-tests/compat-opentofu/test/opentofu.bats, test OpenTofu: VPC enableDnsSupport persisted as false.

AWS behavior

AWS documents that ModifyVpcAttribute changes the DNS support setting and DescribeVpcAttribute returns the current value:

• ModifyVpcAttribute API
• DescribeVpcAttribute API
• AWS CLI modify-vpc-attribute

Context

PR #624 previously added VPC DNS attribute persistence and closed issue #468. This report covers the current regression observed in CI run 35258882581.

Scope

• Add a failing integration test through the EC2 Query API.
• Preserve enableDnsSupport through create, modify, and describe operations.
• Keep enableDnsHostnames behavior covered by its existing test.
• Do not change OpenTofu or Terraform compatibility expectations.