I know this works but it feels weird. I did a search and there's custom validation you can do on input variables. Would that work here? Something like:

variable "availability_zones" {
  type    = list(string)
  default = null
  
  validation {
    condition = (
      (var.availability_zones == null) != 
      (var.availability_zone_configurations == null)
    )
    error_message = "Exactly one of availability_zones or availability_zone_configurations must be specified."
  }
}

I think I tried this first, but I don't think you can reference another variable in a variable definition. I'll double-check this though.

Aye, disnae work.

The other option is combining the types into the var.availability_zones var. Unfortunately terraform doesn't support type unions, so I think to do this you'd make the type of var.availability_zones an any and then add validation to check that it's either a list of strings or a list of objects. But then you lose the typing and resulting type hints, which seemed a shame to me.

Or given it's already somewhat of a breaking change, could lean harder into that by just supporting the new list-of-objects type, with the subnet CIDRs being optional.

Does this mean that if users upgrade, their subnets will change? Or is this accounted for in the move blocks?

Yeah it does if they relied on the default value of private_subnets_offset before. They can avoid this by setting private_subnets_offset to 0 explicitly, albeit they'll still need to do the move blocks to avoid stuff being destroyed. I'll add some additional documentation to this effect.