r/aws_ec2_transit_gateway: fix crash setting encryption_support

Fixes a regression introduced in `v6.25.0` of the Terraform AWS provider.

```console
% make testacc TESTARGS='-run=TestAccTransitGateway_serial/Gateway_\(basic\|encryptionSupport\)' PKG=ec2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-transitgateway-crash 🌿...
TF_ACC=1 go1.24.11 test ./internal/service/ec2/... -v -count 1 -parallel 20  -run=TestAccTransitGateway_serial/Gateway_\(basic\|encryptionSupport\) -timeout 360m -vet=off
2025/12/05 14:44:31 Creating Terraform AWS Provider (SDKv2-style)...
2025/12/05 14:44:31 Initializing Terraform AWS Provider (SDKv2-style)...

--- PASS: TestAccTransitGateway_serial (0.00s)
    --- PASS: TestAccTransitGateway_serial/Gateway_basic (191.96s)
    --- PASS: TestAccTransitGateway_serial/Gateway_encryptionSupportWhenCreated (191.97s)
    --- PASS: TestAccTransitGateway_serial/Gateway_encryptionSupportWhenUpdated (200.48s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/ec2        207.173s
```

Author: jar-b

.changelog/45462.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_transit_gateway: Fix potential crash when setting `encryption_support`. This addresses a regression introduced in [v6.25.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#6250-december-4-2025).
+```

internal/service/ec2/transitgateway_.go

@@ -235,14 +235,18 @@ func resourceTransitGatewayRead(ctx context.Context, d *schema.ResourceData, met
 	d.Set("default_route_table_propagation", transitGateway.Options.DefaultRouteTablePropagation)
 	d.Set(names.AttrDescription, transitGateway.Description)
 	d.Set("dns_support", transitGateway.Options.DnsSupport)
-	var encryptionSupport string
-	encryptionState := transitGateway.Options.EncryptionSupport.EncryptionState
-	if encryptionState == awstypes.EncryptionStateValueEnabled || encryptionState == awstypes.EncryptionStateValueEnabling {
-		encryptionSupport = string(awstypes.EncryptionSupportOptionValueEnable)
-	} else {
-		encryptionSupport = string(awstypes.EncryptionSupportOptionValueDisable)
+
+	if transitGateway.Options.EncryptionSupport != nil {
+		var encryptionSupport string
+		encryptionState := transitGateway.Options.EncryptionSupport.EncryptionState
+		if encryptionState == awstypes.EncryptionStateValueEnabled || encryptionState == awstypes.EncryptionStateValueEnabling {
+			encryptionSupport = string(awstypes.EncryptionSupportOptionValueEnable)
+		} else {
+			encryptionSupport = string(awstypes.EncryptionSupportOptionValueDisable)
+		}
+		d.Set("encryption_support", encryptionSupport)
 	}
-	d.Set("encryption_support", encryptionSupport)
+
 	d.Set("multicast_support", transitGateway.Options.MulticastSupport)
 	d.Set(names.AttrOwnerID, transitGateway.OwnerId)
 	d.Set("propagation_default_route_table_id", transitGateway.Options.PropagationDefaultRouteTableId)