ec2: networkAcl update fails if ruleAction field has camelcase Allow/Deny

[nnbu]

Steps to reproduce
Repro steps:

1. Create CR (Make sure ruleAction field has camelcase Allow/Deny)

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: netacl1
  namespace: default
spec:
  associations:
  - subnetID: subnet-xxxxx1
  - subnetID: subnet-xxxxx2
  entries:
  - cidrBlock: 0.0.0.0/0
    egress: false
    protocol: "-1"
    ruleAction: Allow
    ruleNumber: 100
  vpcID: vpc-xxxx

2. Update the CR with following

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: netacl1
  namespace: default
spec:
  associations:
  - subnetID: subnet-xxxxx1
  - subnetID: subnet-xxxxx2
  entries:
  - cidrBlock: 0.0.0.0/0
    egress: false
    protocol: "-1"
    ruleAction: Allow
    ruleNumber: 100
  - cidrBlock: 0.0.0.0/0
    egress: true
    protocol: "-1"
    ruleAction: Allow
    ruleNumber: 100
  vpcID: vpc-0xxxx

3. CR update cause the entry present in first steps to get deleted and ec2 logs show following error

reason: "InvalidNetworkAclEntry.NotFound: no ingress entry with number 100 in
      network ACL acl-xxxx\n\tstatus code: 400, request id: xxxxxxx"

Expected outcome
Update should be successful and we should see both entries (egress and ingress) in aws console

Environment

• Kubernetes version
• Using EKS (yes/no), if so version? No
• AWS service targeted (S3, RDS, etc.)

[nnbu]

RCA:
In the step 2 of repro, when update is happening for the CR, entries are compared between desired (CR) and latest (AWS) objects.

latest has ruleAction as lowercase allow because aws always returns lowercase allow. desired has ruleAction as Allow.

delete of the entry with ruleaction allow is triggered first.
Since ruleNumber and egress uniquely determine the entry, in the code, it determines update is also needed because of the change from allow (in latest) to Allow (in desired).

Since the delete gets triggered first, entry is no longer present. Then update is triggered. and we see the error that entry is not present. Hence, update fails

[ack-bot]

Issues go stale after 180d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 60d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/lifecycle stale