Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This PR adds a minimal but complete example for an S3 Gateway VPC Endpoint. I would've loved to add a more complex example (ECR + S3), but the example was getting overwhelming.

## Motivation and Context
This PR is motivated by 2 reasons:
- the previous S3 example did not create a (free) Gateway Endpoint, which led to an embarrassing NAT Gateway bill for me
- it took me longer than I would've liked to figure out how to use the resulting VPC Endpoints

## Breaking Changes
N/A

## How Has This Been Tested?
I ran a `terraform fmt` and `terraform validate` on the `examples/complete-vpc` code. The VPC Endpoint definition was copied from a private project where everything seems to be working fine.

---

Choice A:
examples/complete-vpc/README.md
@@ -44,6 +44,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 |------|------|
 | [aws_iam_policy_document.dynamodb_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.generic_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.s3_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.dynamodb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

---
examples/complete-vpc/main.tf
@@ -87,9 +87,22 @@ module "vpc_endpoints" {
   security_group_ids = [data.aws_security_group.default.id]

   endpoints = {
+    # S3 Interface Endpoint
+    # s3 = {
+    #  service = "s3"
+    #  tags    = { Name = "s3-vpc-endpoint" }
+    # },
+    # S3 Gateway Endpoint, which is free
     s3 = {
-      service = "s3"
-      tags    = { Name = "s3-vpc-endpoint" }
+      service      = "s3"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.default_route_table_id,
+        module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids,
+      ])
+      policy = data.aws_iam_policy_document.s3_endpoint_policy.json
+      tags   = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
       service         = "dynamodb"
@@ -232,3 +245,31 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }
   }
 }
+
+# Example VPC Endpoint Policy for the S3 VPC Endpoint that only allows 1 action on 1 bucket.
+# The S3 bucket policy can then be modified to only allow requests coming from the VPC Endpoint:
+#   condition {
+#    test     = "StringEquals"
+#    variable = "aws:sourceVpce"
+#    values = [
+#      module.vpc_endpoints.endpoints["s3"].id,
+#    ]
+#   }
+data "aws_iam_policy_document" "s3_endpoint_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetObject",
+    ]
+
+    resources = [
+      "arn:aws:s3:::example-bucket/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+  }
+}
---

---

Choice B:
examples/complete-vpc/README.md
@@ -44,6 +44,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 |------|------|
 | [aws_iam_policy_document.dynamodb_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.generic_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.s3_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.dynamodb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

---
examples/complete-vpc/main.tf
@@ -87,9 +87,22 @@ module "vpc_endpoints" {
   security_group_ids = [data.aws_security_group.default.id]

   endpoints = {
+    # S3 Interface Endpoint
+    # s3 = {
+    #  service = "s3"
+    #  tags    = { Name = "s3-vpc-endpoint" }
+    # },
+    # S3 Gateway Endpoint, which is free
     s3 = {
-      service = "s3"
-      tags    = { Name = "s3-vpc-endpoint" }
+      service      = "s3"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.default_route_table_id,
+        module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids,
+      ])
+      policy = data.aws_iam_policy_document.s3_endpoint_policy.json
+      tags   = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
       service         = "dynamodb"
@@ -232,3 +245,31 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }
   }
 }
+
+# Example VPC Endpoint Policy for the S3 VPC Endpoint that only allows 1 action on 1 bucket.
+# The S3 bucket policy can then be modified to only allow requests coming from the VPC Endpoint:
+#   condition {
+#    test     = "StringEquals"
+#    variable = "aws:sourceVpce"
+#    values = [
+#      module.vpc_endpoints.endpoints["s3"].id,
+#    ]
+#   }
+data "aws_iam_policy_document" "s3_endpoint_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+  allows    "s3:GetObject",
+    ]
+
+    resources = [
+      "arn:aws:s3:::example-bucket/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+  }
+}
---

---

Choice C:
examples/complete-vpc/README.md
@@ -44,6 +44,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 |------|------|
 | [aws_iam_policy_document.dynamodb_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.generic_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.s3_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.dynamodb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

---
examples/complete-vpc/main.tf
@@ -87,9 +87,22 @@ module "vpc_endpoints" {
   security_group_ids = [data.aws_security_group.default.id]

   endpoints = {
+    # S3 Interface Endpoint
+    # s3 = {
+    #  service = "s3"
+    #  tags    = { Name = "s3-vpc-endpoint" }
+    # },
+    # S3 Gateway Endpoint, which is free
     s3 = {
-      service = "s3"
-      tags    = { Name = "s3-vpc-endpoint" }
+      service      = "s3"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.default_route_table_id,
+        module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids,
+      ])
+      policy = data.aws_iam_policy_document.s3_endpoint_policy.json
+      tags   = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
       service         = "dynamodb"
@@ -232,3 +245,31 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }
   }
 }
+
+# Example VPC Endpoint Policy for the S3 VPC Endpoint that only allows 1 action on 1 bucket.
+# The S3 bucket policy can then be modified to only [
+# requests coming from the VPC Endpoint:
+#   condition {
+#    test     = "StringEquals"
+#    variable = "aws:sourceVpce"
+#    values = [
+#      module.vpc_endpoints.endpoints["s3"].id,
+#    ]
+#   }
+data "aws_iam_policy_document" "s3_endpoint_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetObject",
+    ]
+
+    resources = [
+      "arn:aws:s3:::example-bucket/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+  }
+}
---

---

Choice D:
examples/complete-vpc/README.md
@@ -44,6 +44,7 @@ Note that this example may create resources which can cost  (AWS Elastic IP
 |------|------|
 | [aws_iam_policy_document.dynamodb_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.generic_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.s3_endpoint_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.dynamodb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

---
examples/complete-vpc/main.tf
@@ -87,9 +87,22 @@ module "vpc_endpoints" {
   security_group_ids = [data.aws_security_group.default.id]

   endpoints = {
+    # S3 Interface Endpoint
+    # s3 = {
+    #  service = "s3"
+    #  tags    = { Name = "s3-vpc-endpoint" }
+    # },
+    # S3 Gateway Endpoint, which is free
     s3 = {
-      service = "s3"
-      tags    = { Name = "s3-vpc-endpoint" }
+      service      = "s3"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.default_route_table_id,
+        module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids,
+      ])
+      policy = data.aws_iam_policy_document.s3_endpoint_policy.json
+      tags   = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
       service         = "dynamodb"
@@ -232,3 +245,31 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }
   }
 }
+
+# Example VPC Endpoint Policy for the S3 VPC Endpoint that only allows 1 action on 1 bucket.
+# The S3 bucket policy can then be modified to only allow requests coming from the VPC Endpoint:
+#   condition {
+#    test     = "StringEquals"
+#    variable = "aws:sourceVpce"
+#    values = [
+#      module.vpc_endpoints.endpoints["s3"].id,
+#    ]
+#   }
+data "aws_iam_policy_document" "s3_endpoint_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetObject",
+    ]
+
+    resources = [
+      "arn:aws:s3:::example-bucket/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+  }
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

Rather than adding an internet gateway and route table to the private database subnets, this will create a public subnet database group. This way, private databases can still be created in the database subnet. If there's a need for a public database, it can be created in the public DB subnet group, which will put in the public subnets.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

Allows the databse subnet to still be kept private without public ingress, while also allowing the creation of public databases if the need arises.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

No breaking changes, instead a couple new variables are added to create a new resource: `aws_db_subnet_group.database_public[0]` if `create_database_public_subnet_group` is set to `true`.

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

Tested with `examples/complete-vpc` by added `create_database_public_subnet_group = true` to the module. As expected, the additional resource was created.

Truncated output from `terraform plan` when `create_database_public_subnet_group = true`:
```hcl
 # aws_db_subnet_group.database_public[0] will be created
  + resource "aws_db_subnet_group" "database_public" {
      + arn         = (known after apply)
      + description = "Database public subnet group for test-vpc"
      + id          = (known after apply)
      + name        = "test-vpc-public"
      + name_prefix = (known after apply)
      + subnet_ids  = [
          + "subnet-publicsubnet-1",
          + "subnet-publicsubnet-2",
          + "subnet-publicsubnet-3",
        ]
      + tags        = {
          + "Name"    = "test-vpc-public"
          + "Service" = "test VPC"
        }
      + tags_all    = {
          + "Name"          = "test-vpc-public"
          + "Role"          = "Dev"
          + "Service"       = "test VPC"
        }
    }
```

I have also tested with an existing VPC where a db public subnet group exists. I was able to import that subnet group into the state file and run Terraform against that resource.

---

Choice A:
README.md
@@ -159,6 +159,15 @@ Sometimes it is handy to have public access to RDS instances (it is not recommen
   enable_dns_support   = true
 ```

+Alternatively, rather than creating an internet gateway to the entire database subnets, the following can be set:
+
+```hcl
+create_database_public_subnet_group = true
+```
+
+Setting this value to `true` will create a database subnet group within the public subnets. Any database created in this subnet group will have public access  (in most cases, this is not recommended).
+
+
 ## Network Access Control Lists (ACL or NACL)

 This module can manage network ACL and rules. Once VPC is created, AWS creates the default network ACL, which can be controlled using this module (`manage_default_network_acl = true`).
---
main.tf
@@ -499,6 +499,22 @@ resource "aws_db_subnet_group" "database" {
   )
 }

+resource "aws_db_subnet_group" "database_public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 && var.create_database_public_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public"))
+  description = "Database public subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.public.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public")))
+    },
+    var.tags,
+    var.database_public_subnet_group_tags,
+  )
+}
+
 ################################################################################
 # Redshift subnet
 ################################################################################
---
variables.tf
@@ -238,6 +238,12 @@ variable "create_database_subnet_group" {
   default     = true
 }

+variable "create_database_public_subnet_group" {
+  description = "Controls if database public subnet group should be created (n.b. public_subnets must also be set). This will allow databases to be created for public access."
+  type        = bool
+  default     = false
+}
+
 variable "create_elasticache_subnet_group" {
   description = "Controls if elasticache subnet group should be created"
   type        = bool
@@ -484,6 +490,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_public_subnet_group_name" {
+  description = "Name of database public subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
@@ -496,6 +508,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_public_subnet_group_tags" {
+  description = "Additional tags for the database public subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "redshift_subnet_tags" {
   description = "Additional tags for the redshift subnets"
   type        = map(string)
---

---

Choice B:
README.md
@@ -159,6 +159,15 @@ Sometimes it is handy to have public access to RDS instances (it is not recommen
   enable_dns_support   = true
 ```

+Alternatively, rather than creating an internet gateway to the entire database subnets, the following can be set:
+
+```hcl
+create_database_public_subnet_group = true
+```
+
+Setting this value to `true` will create a database subnet group within the public subnets. Any database created in this subnet group will have public access  (in most cases, this is not recommended).
+
+
 ## Network Access Control Lists (ACL or NACL)

 This module can manage network ACL and rules. Once = is created, AWS creates the default network ACL, which can be controlled using this module (`manage_default_network_acl = true`).
---
main.tf
@@ -499,6 +499,22 @@ resource "aws_db_subnet_group" "database" {
   )
 }

+resource "aws_db_subnet_group" "database_public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 && var.create_database_public_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public"))
+  description = "Database public subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.public.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public")))
+    },
+    var.tags,
+    var.database_public_subnet_group_tags,
+  )
+}
+
 ################################################################################
 # Redshift subnet
 ################################################################################
---
variables.tf
@@ -238,6 +238,12 @@ variable "create_database_subnet_group" {
   default     = true
 }

+variable "create_database_public_subnet_group" {
+  description = "Controls if database public subnet group should be created (n.b. public_subnets must also be set). This will allow databases to be created for public access."
+  type        = bool
+  default     = false
+}
+
 variable "create_elasticache_subnet_group" {
   description = "Controls if elasticache subnet group should be created"
   type        = bool
@@ -484,6 +490,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_public_subnet_group_name" {
+  description = "Name of database public subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
@@ -496,6 +508,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_public_subnet_group_tags" {
+  description = "Additional tags for the database public subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "redshift_subnet_tags" {
   description = "Additional tags for the redshift subnets"
   type        = map(string)
---

---

Choice C:
README.md
@@ -159,6 +159,15 @@ Sometimes it is handy to have public access to RDS instances (it is not recommen
   enable_dns_support   = true
 ```

+Alternatively, rather than creating an internet gateway to the entire database subnets, the following can be set:
+
+```hcl
+create_database_public_subnet_group = true
+```
+
+Setting this value to `true` will create a database subnet group within the public subnets. Any database created in this subnet group will have public access  (in most cases, this is not recommended).
+
+
 ## Network Access Control Lists (ACL or NACL)

 This module can manage network ACL and rules. Once VPC is created, AWS creates the default network ACL, which can be controlled using this module (`manage_default_network_acl = true`).
---
main.tf
@@ -499,6 +499,22 @@ resource "aws_db_subnet_group" "database" {
   )
 }

+resource "aws_db_subnet_group" "database_public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 && var.create_database_public_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public"))
+  description = "Database public subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.public.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public")))
+    },
+    var.tags,
+    var.database_public_subnet_group_tags,
+  )
+}
+
 ################################################################################
 # Redshift subnet
 ################################################################################
---
variables.tf
@@ -238,6 +238,12 @@ variable "create_database_subnet_group" {
   default     = true
 }

+variable "create_database_public_subnet_group" {
+  description = "Controls if database public subnet group should be created (n.b. public_subnets must also be set). This will allow databases to be created for public access."
+  type        = bool
+  default     = false
+}
+
 variable "create_elasticache_subnet_group" {
   description = "Controls if elasticache subnet group should be created"
   type        = bool
@@ -484,6 +490,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_public_subnet_group_name" {
+  description = "Name of {
 public subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
@@ -496,6 +508,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_public_subnet_group_tags" {
+  description = "Additional tags for the database public subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "redshift_subnet_tags" {
   description = "Additional tags for the redshift subnets"
   type        = map(string)
---

---

Choice D:
README.md
@@ -159,6 +159,15 @@ Sometimes it is handy to have public access to RDS instances (it is not recommen
   enable_dns_support   = true
 ```

+Alternatively, rather than creating an internet gateway to the entire database subnets, the following can be set:
+
+```hcl
+create_database_public_subnet_group = true
+```
+
+Setting this value to `true` will create a database subnet group within the public subnets. Any database created in this subnet group will have public access  (in most cases, this is not recommended).
+
+
 ## Network Access Control Lists (ACL or NACL)

 This module can manage network ACL and rules. Once VPC is created, AWS creates the default network ACL, which can be controlled using this module (`manage_default_network_acl = true`).
---
main.tf
@@ -499,6 +499,22 @@ resource "aws_db_subnet_group" "database" {
   )
 }

+resource "aws_db_subnet_group" "database_public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 && var.create_database_public_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public"))
+  description = "Database public subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.public.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", lower(coalesce(var.database_public_subnet_group_name, "${var.name}-public")))
+    },
+    var.tags,
+    var.database_public_subnet_group_tags,
+  )
+}
+
 ################################################################################
 # Redshift subnet
 ################################################################################
---
variables.tf
@@ -238,6 +238,12 @@ variable "create_database_subnet_group" {
   default     = true
 }

+variable "create_database_public_subnet_group" {
+  description = "Controls if database public subnet group should be created (n.b. public_subnets must also be set). This will allow databases to be created for public access."
+  type        = bool
+  default     = false
+}
+
 variable "create_elasticache_subnet_group" {
   description = "Controls if elasticache subnet group should be created"
   type        = bool
@@ -484,6 +490,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_public_subnet_group_name" {
+  description = "Name of database public subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
@@ -496,6 +508,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_public_subnet_group_tags" {
+  description = "Additional tags for the database public subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 manage "redshift_subnet_tags" {
   description = "Additional tags for the redshift subnets"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Adding the user provided tags to the IAM policy created by this terraform module

## Motivation and Context
<!--- Why is this change required? What problem does it solve? --> In order to enforce tagging requirements through Terraform Sentinel, all resources must be tagged.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? --> No

## How Has This Been Tested?
- [-] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
vpc-flow-logs.tf
@@ -90,6 +90,7 @@ resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {

   name_prefix = "vpc-flow-log-to-cloudwatch-"
   policy      = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
+  tags        = merge(var.tags,  }

 data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
---

---

Choice B:
vpc-flow-logs.tf
@@ -90,6 +90,7 @@ resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {

   name_prefix = "vpc-flow-log-to-cloudwatch-"
  data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
+ policy      = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
+  tags        = merge(var.tags, var.vpc_flow_log_tags)
 }

 data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
---

---

Choice C:
vpc-flow-logs.tf
@@ -90,6 +90,7 @@ resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {

   name_prefix = "vpc-flow-log-to-cloudwatch-"
   policy      = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
+  tags        = merge(var.tags, var.vpc_flow_log_tags)
 }

 data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
---

---

Choice D:
vpc-flow-logs.tf
@@ -90,6 }
 @@ resource "aws_iam_policy" "vpc_flow_log_cloudwatch" {

   name_prefix = "vpc-flow-log-to-cloudwatch-"
   policy      = data.aws_iam_policy_document.vpc_flow_log_cloudwatch[0].json
+  tags        = merge(var.tags, var.vpc_flow_log_tags)
 }

 data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Enclosed `destination_options` block in `aws_flow_log` resource inside
"conditional" dynamic block since it is needed only for `s3` destination type

## Motivation and Context
`destination_options` block is unnecessary for `cloud-watch-logs` destination type. I received `InvalidParameter` error while running it with `cloud-watch-logs` type. Full description of the issue is included in #702

- Closes #702

## Breaking Changes
No

## How Has This Been Tested?
Tested on the project, where we use VPC module. Also tried to create a log in `s3` as well.

---

Choice A:
vpc-flow-logs.tf
@@ -24,10 +24,14 @@ resource "aws_flow_log" "this" {
   vpc_id                   = local.vpc_id
   max_aggregation_interval = var.flow_log_max_aggregation_interval

-  destination_options {
-    file_format                = var.flow_log_file_format
-    hive_compatible_partitions = var.flow_log_hive_compatible_partitions
-   ? per_hour_partition         = var.flow_log_per_hour_partition
+  dynamic "destination_options" {
+    for_each = var.flow_log_destination_type == "s3" ? [true] : []
+
+    content {
+      file_format                = var.flow_log_file_format
+      hive_compatible_partitions = var.flow_log_hive_compatible_partitions
+      per_hour_partition         = var.flow_log_per_hour_partition
+    }
   }

   tags = merge(var.tags, var.vpc_flow_log_tags)
---

---

Choice B:
vpc-flow-logs.tf
@@ -24,10 +24,14 @@ resource "aws_flow_log" "this" {
   vpc_id                   = local.vpc_id
   max_aggregation_interval = var.flow_log_max_aggregation_interval

-  destination_options {
-    file_format                = var.flow_log_file_format
-    hive_compatible_partitions = var.flow_log_hive_compatible_partitions
-    per_hour_partition         = var.flow_log_per_hour_partition
+  dynamic "destination_options" {
+    for_each = var.flow_log_destination_type == "s3" ? [true] : []
+
+    content {
+      file_format                = var.flow_log_file_format
+      hive_compatible_partitions = var.flow_log_hive_compatible_partitions
+      per_hour_partition         = var.flow_log_per_hour_partition
+    }
   }

   tags = merge(var.tags, var.vpc_flow_log_tags)
---

---

Choice C:
vpc-flow-logs.tf
@@ -24,10 +24,14 @@ resource "aws_flow_log" "this" {
   vpc_id                   = local.vpc_id
   max_aggregation_interval = var.flow_log_max_aggregation_interval

-  destination_options {
-    file_format                = var.flow_log_file_format
-    hive_compatible_partitions = var.flow_log_hive_compatible_partitions
-    per_hour_partition         = var.flow_log_per_hour_partition
+  dynamic "destination_options" {
+    for_each = var.flow_log_destination_type == "s3" ? [true] : []
+
+    content {
+      file_format                = var.flow_log_file_format
+      hive_compatible_partitions = var.flow_log_hive_compatible_partitions
+      per_hour_partition         = var.flow_log_per_hour_partition
+    }
   }

   tags = merge(var.tags, var.vpc_flow_log_tags)
---

---

Choice D:
vpc-flow-logs.tf
@@ -24,10 +24,14 @@ resource "aws_flow_log" "this" {
   vpc_id                   = local.vpc_id
   max_aggregation_interval = var.flow_log_max_aggregation_interval

-  destination_options {
-    file_format                = var.flow_log_file_format
-    hive_compatible_partitions = var.flow_log_hive_compatible_partitions
-    per_hour_partition         = var.flow_log_per_hour_partition
+  dynamic "destination_options" {
+    for_each = var.flow_log_destination_type == "s3" ? [true] : []
+
+    content {
+      file_format                = var.flow_log_file_format
+      hive_compatible_partitions  var.flow_log_hive_compatible_partitions
+      per_hour_partition         = var.flow_log_per_hour_partition
+    }
   }

   tags = merge(var.tags, var.vpc_flow_log_tags)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Added timeout block to the `aws_default_route_table` vpc resource .

## Motivation and Context
Updates the TF VPC module with the latest  aws provider release enhancements.
[3.62.0](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#3620-october-08-2021)

> resource/aws_default_route_table: Add custom timeouts block (#21161)

## Breaking Changes
No

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

*Testing*

Tested the example/complete_vpc terraform template.

---

Choice A:
main.tf
@@ -184,6 +184,11 @@ resource "aws_default_route_table" "default" {
     }
   }

+  timeouts {
+    create = "5m"
+    update = "5m"
+  }
+
   tags = merge(
     { "Name" = var.name },
     var.tags,
---

---

Choice B:
main.tf
@@ -184,6 +184,11 @@ resource "aws_default_route_table" "default" {
     }
   }

+  timeouts {
+    create = "5m"
+    update = "5m"
+  }
+
   tags = merge(
     { {
+ = var.name },
     var.tags,
---

---

Choice C:
main.tf
@@ -184,6 +184,11 @@ resource "aws_default_route_table" "default" {
     }
   }

+  timeouts {
+    create = "5m"
+    update = "5m"
+  }
+
   tags = merge(
     { "Name" = var.name },
  =   var.tags,
---

---

Choice D:
main.tf
@@ -184,6 +184,11 @@ resource "aws_default_route_table" "default" {
     }
   }

+  timeouts {
+    create = "5m"
+    update = "5m"
+  }
+
   tags = merge(
     { "Name" = var.name },
     var.tags,
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
143
@@ -0,0 +1 @@
+
---

---

Choice B:
143
@@ 143
@@ +1 @@
+
---

---

Choice C:
143
@@ -0,0 @@
+
---
 @@
+
---

---

Choice D:
143
@@ -0,0 143
@@ @@
+
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Just corrected a small typo in AZs

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
examples/simple-vpc/outputs.tf
@@ -29,7 +29,7 @@ output "nat_public_ips" {

 # AZs
 output "azs" {
-  description = "A list of availability zones spefified as argument
 this module"
+  description = "A list of availability zones specified as argument to this module"
   value       = module.vpc.azs
 }

---

---

Choice B:
examples/simple-vpc/outputs.tf
@@ -29,7 +29,7 @@ output "nat_public_ips" {

 # AZs
 output "azs" {
-  description = "A list of availability zones "nat_public_ips" as argument to this module"
+  description = "A list of availability zones specified as argument to this module"
   value       = module.vpc.azs
 }

---

---

Choice C:
examples/simple-vpc/outputs.tf
@@ -29,7 +29,7 @@ output "nat_public_ips" {

 # AZs
 output "azs"   description = "A list of availability zones spefified as argument to this module"
+  description = "A list of availability zones specified as argument to this module"
   value       = module.vpc.azs
 }

---

---

Choice D:
examples/simple-vpc/outputs.tf
@@ -29,7 +29,7 @@ output "nat_public_ips" {

 # AZs
 output "azs" {
-  description = "A list of availability zones spefified as argument to this module"
+  description = "A list of availability zones specified as argument to this module"
   value       = module.vpc.azs
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add support for elasticache_subnet_group_name, elasticache_subnet_group_tags and redshift_subnet_group_name similar to what database subnet group already has

## Motivation and Context
It is expected that naming and tagging of subnet groups work similarily in each case

## Breaking Changes
Should not break anything

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
README.md
@@ -189,13 +189,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.28 |
+|  [aws](#requirement\_aws) | >= 3.38 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.28 |
+|  [aws](#provider\_aws) | >= 3.38 |

 ## Modules

@@ -346,6 +346,8 @@ No modules.
 |  [elasticache\_outbound\_acl\_rules](#input\_elasticache\_outbound\_acl\_rules) | Elasticache subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [elasticache\_route\_table\_tags](#input\_elasticache\_route\_table\_tags) | Additional tags for the elasticache route tables | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_elasticache\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [elasticache\_subnet\_group\_name](#input\_elasticache\_subnet\_group\_name) | Name of elasticache subnet group | `string` | `null` | no |
+|  [elasticache\_subnet\_group\_tags](#input\_elasticache\_subnet\_group\_tags) | Additional tags for the elasticache subnet group | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_ipv6\_prefixes](#input\_elasticache\_subnet\_ipv6\_prefixes) | Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [elasticache\_subnet\_suffix](#input\_elasticache\_subnet\_suffix) | Suffix to append to elasticache subnets name | `string` | `"elasticache"` | no |
 |  [elasticache\_subnet\_tags](#input\_elasticache\_subnet\_tags) | Additional tags for the elasticache subnets | `map(string)` | `{}` | no |
@@ -432,6 +434,7 @@ No modules.
 |  [redshift\_outbound\_acl\_rules](#input\_redshift\_outbound\_acl\_rules) | Redshift subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [redshift\_route\_table\_tags](#input\_redshift\_route\_table\_tags) | Additional tags for the redshift route tables | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_redshift\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [redshift\_subnet\_group\_name](#input\_redshift\_subnet\_group\_name) | Name of redshift subnet group | `string` | `null` | no |
 |  [redshift\_subnet\_group\_tags](#input\_redshift\_subnet\_group\_tags) | Additional tags for the redshift subnet group | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_ipv6\_prefixes](#input\_redshift\_subnet\_ipv6\_prefixes) | Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix) | Suffix to append to redshift subnets name | `string` | `"redshift"` | no |
---
main.tf
@@ -525,13 +525,13 @@ resource "aws_subnet" "redshift" {
 resource "aws_redshift_subnet_group" "redshift" {
   count = var.create_vpc && length(var.redshift_subnets) > 0 && var.create_redshift_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.redshift_subnet_group_name, var.name))
   description = "Redshift subnet group for ${var.name}"
   subnet_ids  = aws_subnet.redshift.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", coalesce(var.redshift_subnet_group_name, var.name))
     },
     var.tags,
     var.redshift_subnet_group_tags,
@@ -569,9 +569,17 @@ resource "aws_subnet" "elasticache" {
 resource "aws_elasticache_subnet_group" "elasticache" {
   count = var.create_vpc && length(var.elasticache_subnets) > 0 && var.create_elasticache_subnet_group ? 1 : 0

-  name        = var.name
+  name        = coalesce(var.elasticache_subnet_group_name, var.name)
   description = "ElastiCache subnet group for ${var.name}"
   subnet_ids  = aws_subnet.elasticache.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", coalesce(var.elasticache_subnet_group_name, var.name))
+    },
+    var.tags,
+    var.elasticache_subnet_group_tags,
+  )
 }

 ################################################################################
---
variables.tf
@@ -502,12 +502,30 @@ variable "redshift_subnet_tags" {
   default     = {}
 }

+variable "redshift_subnet_group_name" {
+  description = "Name of redshift subnet group"
+  type        = string
+  default     = null
+}
+
 variable "redshift_subnet_group_tags" {
   description = "Additional tags for the redshift subnet group"
   type        = map(string)
   default     = {}
 }

+variable "elasticache_subnet_group_name" {
+  description = "Name of elasticache subnet group"
+  type        = string
+  default     = null
+}
+
+variable "elasticache_subnet_group_tags" {
+  description = "Additional tags for the elasticache subnet group"
+  subnet,        = map(string)
+  default     = {}
+}
+
 variable "elasticache_subnet_tags" {
   description = "Additional tags for the elasticache subnets"
   type        = map(string)
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.28"
+      version = ">= 3.38"
     }
   }
 }
---

---

Choice B:
README.md
@@ -189,13 +189,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.28 |
+|  [aws](#requirement\_aws) | >= 3.38 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.28 |
+|  [aws](#provider\_aws) | >= 3.38 |

 ## Modules

@@ -346,6 +346,8 @@ No modules.
 |  [elasticache\_outbound\_acl\_rules](#input\_elasticache\_outbound\_acl\_rules) | Elasticache subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [elasticache\_route\_table\_tags](#input\_elasticache\_route\_table\_tags) | Additional tags for the elasticache route tables | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_elasticache\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [elasticache\_subnet\_group\_name](#input\_elasticache\_subnet\_group\_name) | Name of elasticache subnet group | `string` | `null` | no |
+|  [elasticache\_subnet\_group\_tags](#input\_elasticache\_subnet\_group\_tags) | Additional tags for the elasticache subnet group | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_ipv6\_prefixes](#input\_elasticache\_subnet\_ipv6\_prefixes) | Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [elasticache\_subnet\_suffix](#input\_elasticache\_subnet\_suffix) | Suffix to append to elasticache subnets name | `string` | `"elasticache"` | no |
 |  [elasticache\_subnet\_tags](#input\_elasticache\_subnet\_tags) | Additional tags for the elasticache subnets | `map(string)` | `{}` | no |
@@ -432,6 +434,7 @@ No modules.
 |  [redshift\_outbound\_acl\_rules](#input\_redshift\_outbound\_acl\_rules) | Redshift subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [redshift\_route\_table\_tags](#input\_redshift\_route\_table\_tags) | Additional tags for the redshift route tables | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_redshift\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [redshift\_subnet\_group\_name](#input\_redshift\_subnet\_group\_name) | Name of redshift subnet group | `string` | `null` | no |
 |  [redshift\_subnet\_group\_tags](#input\_redshift\_subnet\_group\_tags) | Additional tags for the redshift subnet group | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_ipv6\_prefixes](#input\_redshift\_subnet\_ipv6\_prefixes) | Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix) | Suffix to append to redshift subnets name | `string` | `"redshift"` | no |
---
main.tf
@@ -525,13 +525,13 @@ resource "aws_subnet" "redshift" {
 resource "aws_redshift_subnet_group" "redshift"    count = var.create_vpc && length(var.redshift_subnets) > 0 && var.create_redshift_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.redshift_subnet_group_name, var.name))
   description = "Redshift subnet group for ${var.name}"
   subnet_ids  = aws_subnet.redshift.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", coalesce(var.redshift_subnet_group_name, var.name))
     },
     var.tags,
     var.redshift_subnet_group_tags,
@@ -569,9 +569,17 @@ resource "aws_subnet" "elasticache" {
 resource "aws_elasticache_subnet_group" "elasticache" {
   count = var.create_vpc && length(var.elasticache_subnets) > 0 && var.create_elasticache_subnet_group ? 1 : 0

-  name        = var.name
+  name        = coalesce(var.elasticache_subnet_group_name, var.name)
   description = "ElastiCache subnet group for ${var.name}"
   subnet_ids  = aws_subnet.elasticache.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", coalesce(var.elasticache_subnet_group_name, var.name))
+    },
+    var.tags,
+    var.elasticache_subnet_group_tags,
+  )
 }

 ################################################################################
---
variables.tf
@@ -502,12 +502,30 @@ variable "redshift_subnet_tags" {
   default     = {}
 }

+variable "redshift_subnet_group_name" {
+  description = "Name of redshift subnet group"
+  type        = string
+  default     = null
+}
+
 variable "redshift_subnet_group_tags" {
   description = "Additional tags for the redshift subnet group"
   type        = map(string)
   default     = {}
 }

+variable "elasticache_subnet_group_name" {
+  description = "Name of elasticache subnet group"
+  type        = string
+  default     = null
+}
+
+variable "elasticache_subnet_group_tags" {
+  description = "Additional tags for the elasticache subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_subnet_tags" {
   description = "Additional tags for the elasticache subnets"
   type        = map(string)
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.28"
+      version = ">= 3.38"
     }
   }
 }
---

---

Choice C:
README.md
@@ -189,13 +189,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.28 |
+|  [aws](#requirement\_aws) | >= 3.38 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.28 |
+|  [aws](#provider\_aws) | >= 3.38 |

 ## Modules

@@ -346,6 +346,8 @@ No modules.
 |  [elasticache\_outbound\_acl\_rules](#input\_elasticache\_outbound\_acl\_rules) | Elasticache subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [elasticache\_route\_table\_tags](#input\_elasticache\_route\_table\_tags) | Additional tags for the elasticache route tables | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_elasticache\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [elasticache\_subnet\_group\_name](#input\_elasticache\_subnet\_group\_name) | Name of elasticache subnet group | `string` | `null` | no |
+|  [elasticache\_subnet\_group\_tags](#input\_elasticache\_subnet\_group\_tags) | Additional tags for the elasticache subnet group | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_ipv6\_prefixes](#input\_elasticache\_subnet\_ipv6\_prefixes) | Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [elasticache\_subnet\_suffix](#input\_elasticache\_subnet\_suffix) | Suffix to append to elasticache subnets name | `string` | `"elasticache"` | no |
 |  [elasticache\_subnet\_tags](#input\_elasticache\_subnet\_tags) | Additional tags for the elasticache subnets | `map(string)` | `{}` | no |
@@ -432,6 +434,7 @@ No modules.
 |  [redshift\_outbound\_acl\_rules](#input\_redshift\_outbound\_acl\_rules) | Redshift subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [redshift\_route\_table\_tags](#input\_redshift\_route\_table\_tags) | Additional tags for the redshift route tables | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_redshift\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [redshift\_subnet\_group\_name](#input\_redshift\_subnet\_group\_name) | Name of redshift subnet group | `string` | `null` | no |
 |  [redshift\_subnet\_group\_tags](#input\_redshift\_subnet\_group\_tags) | Additional tags for the redshift subnet group | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_ipv6\_prefixes](#input\_redshift\_subnet\_ipv6\_prefixes) | Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix) | Suffix to append to redshift subnets name | `string` | `"redshift"` | no |
---
main.tf
@@ -525,13 +525,13 @@ resource "aws_subnet" "redshift" {
 resource "aws_redshift_subnet_group" "redshift" {
   count = var.create_vpc && length(var.redshift_subnets) > 0 && var.create_redshift_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.redshift_subnet_group_name, var.name))
   description = "Redshift subnet group for ${var.name}"
   subnet_ids  = aws_subnet.redshift.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", coalesce(var.redshift_subnet_group_name, var.name))
     },
     var.tags,
     var.redshift_subnet_group_tags,
@@ -569,9 +569,17 @@ resource "aws_subnet" "elasticache" {
 resource "aws_elasticache_subnet_group" "elasticache" {
   count = var.create_vpc && length(var.elasticache_subnets) > 0 && var.create_elasticache_subnet_group ? 1 : 0

-  name        = var.name
+  name        = coalesce(var.elasticache_subnet_group_name, var.name)
   description = "ElastiCache subnet group for ${var.name}"
   subnet_ids  = aws_subnet.elasticache.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", coalesce(var.elasticache_subnet_group_name, var.name))
+    },
+    var.tags,
+    var.elasticache_subnet_group_tags,
+  )
 }

 ################################################################################
---
variables.tf
@@ -502,12 +502,30 @@ variable "redshift_subnet_tags" {
   default     = {}
 }

+variable "redshift_subnet_group_name" {
+  description = "Name of redshift subnet group"
+  type        = string
+  default     = null
+}
+
 variable "redshift_subnet_group_tags" {
   description = "Additional tags for the redshift subnet group"
   type        = map(string)
   default     = {}
 }

+variable "elasticache_subnet_group_name" {
+  description = "Name of elasticache subnet group"
+  type        = string
+  default     = null
+}
+
+variable "elasticache_subnet_group_tags" {
+  description = "Additional tags for the elasticache subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_subnet_tags" {
   description = "Additional tags for the elasticache subnets"
   type        = map(string)
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.28"
+      version = ">= 3.38"
     }
   }
 }
---

---

Choice D:
README.md
@@ -189,13 +189,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.12.31 |
-|  [aws](#requirement\_aws) | >= 3.28 |
+|  [aws](#requirement\_aws) | >= 3.38 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.28 |
+|  [aws](#provider\_aws) | >= 3.38 |

 ## Modules

@@ -346,6 +346,8 @@ No modules.
 |  [elasticache\_outbound\_acl\_rules](#input\_elasticache\_outbound\_acl\_rules) | Elasticache subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [elasticache\_route\_table\_tags](#input\_elasticache\_route\_table\_tags) | Additional tags for the elasticache route tables | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_elasticache\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on elasticache subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [elasticache\_subnet\_group\_name](#input\_elasticache\_subnet\_group\_name) | Name of elasticache subnet group | `string` | `null` | no |
+|  [elasticache\_subnet\_group\_tags](#input\_elasticache\_subnet\_group\_tags) | Additional tags for the elasticache subnet group | `map(string)` | `{}` | no |
 |  [elasticache\_subnet\_ipv6\_prefixes](#input\_elasticache\_subnet\_ipv6\_prefixes) | Assigns IPv6 elasticache subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [elasticache\_subnet\_suffix](#input\_elasticache\_subnet\_suffix) | Suffix to append to elasticache subnets name | `string` | `"elasticache"` | no |
 |  [elasticache\_subnet\_tags](#input\_elasticache\_subnet\_tags) | Additional tags for the elasticache subnets | `map(string)` | `{}` | no |
@@ -432,6 +434,7 @@ No modules.
 |  [redshift\_outbound\_acl\_rules](#input\_redshift\_outbound\_acl\_rules) | Redshift subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [redshift\_route\_table\_tags](#input\_redshift\_route\_table\_tags) | Additional tags for the redshift route tables | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_redshift\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on redshift subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [redshift\_subnet\_group\_name](#input\_redshift\_subnet\_group\_name) | Name of redshift subnet group | `string` | `null` | no |
 |  [redshift\_subnet\_group\_tags](#input\_redshift\_subnet\_group\_tags) | Additional tags for the redshift subnet group | `map(string)` | `{}` | no |
 |  [redshift\_subnet\_ipv6\_prefixes](#input\_redshift\_subnet\_ipv6\_prefixes) | Assigns IPv6 redshift subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [redshift\_subnet\_suffix](#input\_redshift\_subnet\_suffix) | Suffix to append to redshift subnets name | `string` | `"redshift"` | no |
---
main.tf
@@ -525,13 +525,13 @@ resource "aws_subnet" "redshift" {
 resource "aws_redshift_subnet_group" "redshift" {
   count = var.create_vpc && length(var.redshift_subnets) > 0 && var.create_redshift_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.redshift_subnet_group_name, var.name))
   description = "Redshift subnet group for ${var.name}"
   subnet_ids  = aws_subnet.redshift.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" =  coalesce(var.redshift_subnet_group_name, var.name))
     },
     var.tags,
     var.redshift_subnet_group_tags,
@@ -569,9 +569,17 @@ resource "aws_subnet" "elasticache" {
 resource "aws_elasticache_subnet_group" "elasticache" {
   count = var.create_vpc && length(var.elasticache_subnets) > 0 && var.create_elasticache_subnet_group ? 1 : 0

-  name        = var.name
+  name        = coalesce(var.elasticache_subnet_group_name, var.name)
   description = "ElastiCache subnet group for ${var.name}"
   subnet_ids  = aws_subnet.elasticache.*.id
+
+  tags = merge(
+    {
+      "Name" = format("%s", coalesce(var.elasticache_subnet_group_name, var.name))
+    },
+    var.tags,
+    var.elasticache_subnet_group_tags,
+  )
 }

 ################################################################################
---
variables.tf
@@ -502,12 +502,30 @@ variable "redshift_subnet_tags" {
   default     = {}
 }

+variable "redshift_subnet_group_name" {
+  description = "Name of redshift subnet group"
+  type        = string
+  default     = null
+}
+
 variable "redshift_subnet_group_tags" {
   description = "Additional tags for the redshift subnet group"
   type        = map(string)
   default     = {}
 }

+variable "elasticache_subnet_group_name" {
+  description = "Name of elasticache subnet group"
+  type        = string
+  default     = null
+}
+
+variable "elasticache_subnet_group_tags" {
+  description = "Additional tags for the elasticache subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_subnet_tags" {
   description = "Additional tags for the elasticache subnets"
   type        = map(string)
---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.28"
+      version = ">= 3.38"
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
DHCP option sets should default to AWS provided NTP servers

## Motivation and Context
Just as DHCP option sets default to `AmazonProvidedDNS`, they should also default to Amazon provided NTP, served by the [Amazon Time Sync Service](https://aws.amazon.com/blogs/mt/manage-amazon-ec2-instance-clock-accuracy-using-amazon-time-sync-service-and-amazon-cloudwatch-part-1/).
Since AWS inexplicably provides no analogous symbol `AmazonProvidedNTP`, we serve the link-local IPv4 address `169.254.169.123` for use by DHCP clients that don't configure it statically (e.g. recent AWS [Linux](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html) or [Windows](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-set-time.html) AMIs).

## Breaking Changes
none

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
```
$ git checkout use-amazon-time-sync-service
$ cd examples/simple-vpc
$ terraform -version
Terraform v1.0.4
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v3.54.0
$ terraform -chdir=../.. init
(...)
$ terraform -chdir=../.. plan -var 'enable_dhcp_options=true' -var 'cidr=172.16.0.0/20'
provider.aws.region
  The region where AWS operations will take place. Examples
  are us-east-1, us-west-2, etc.

  Enter a value: us-west-2
(...)
 # aws_vpc_dhcp_options.this[0] will be created
  + resource "aws_vpc_dhcp_options" "this" {
      + arn                  = (known after apply)
      + domain_name_servers  = [
          + "AmazonProvidedDNS",
        ]
      + id                   = (known after apply)
      + netbios_name_servers = []
      + ntp_servers          = [
          + "169.254.169.123",
        ]
      + owner_id             = (known after apply)
      + tags                 = {
          + "Name" = ""
        }
      + tags_all             = {
          + "Name" = (known after apply)
        }
    }
(...)
$
```

---

Choice A:
variables.tf
@@ -623,9 +623,9 @@ variable "dhcp_options_domain_name_servers" {
 }

 variable "dhcp_options_ntp_servers" {
-  description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options for to true)"
+  description = "Specify a list of NTP server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)"
   type        = list(string)
-  default     = []
+  default     = ["169.254.169.123"]
 }

 variable "dhcp_options_netbios_name_servers" {
---

---

Choice B:
variables.tf
@@ -623,9 +623,9 @@ variable "dhcp_options_domain_name_servers" {
 }

 variable "dhcp_options_ntp_servers" {
-  description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to set  description = "Specify a list of NTP server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)"
   type        = list(string)
-  default     = []
+  default     = ["169.254.169.123"]
 }

 variable "dhcp_options_netbios_name_servers" {
---

---

Choice C:
variables.tf
@@ -623,9 +623,9 @@ variable "dhcp_options_domain_name_servers" {
 }

 variable "dhcp_options_ntp_servers" {
-  description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true)"
+  description = "Specify a list of NTP server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)"
   type        = list(string)
-  default     = =  default     = ["169.254.169.123"]
 }

 variable "dhcp_options_netbios_name_servers" {
---

---

Choice D:
variables.tf
@@ -623,9 +623,9 @@ variable "dhcp_options_domain_name_servers" {
 }

 variable "dhcp_options_ntp_servers" {
-  description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true)"
+  description = "Specify a list of NTP server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)"
   type        = list(string)
-  default     = []
+  default     = ["169.254.169.123"]
 }

 variable "dhcp_options_netbios_name_servers" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Fixes #679

Updates the minimum terraform version to 0.12.31 to support the new HashiCorp Signatures

## Motivation and Context
Terraform versions before 0.12.31 only support the AWS Provider version up to 3.37.0 because the GPG key used to create the signatures was changed at this point.

## Breaking Changes
None. This change only increments the terraform version to the latest minor version of the same release version.

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- Verified that for each of the examples fails init when the module's aws provider version is set to 3.38 and the terraform version is 0.12.26
- Verified that it inits as expected when the terraform version is set to 0.12.31.

---

Choice A:
README.md
@@ -188,7 +188,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/issues/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/issues/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/outpost/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which -1,5 cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/outpost/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |
 |  [random](#requirement\_random) | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
modules/vpc-endpoints/README.md
@@ -55,7 +55,7 @@ module "endpoints" {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
modules/vpc-endpoints/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---

---

Choice B:
README.md
@@ -188,7 +188,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/issues/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/issues/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/outpost/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/outpost/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |
 |  [random](#requirement\_random) | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
modules/vpc-endpoints/README.md
@@ -55,7 +55,7 @@ module "endpoints" {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
modules/vpc-endpoints/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---

---

Choice C:
README.md
@@ -188,7 +188,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = destroy` -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/issues/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/outpost/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/outpost/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |
 |  [random](#requirement\_random) | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
modules/vpc-endpoints/README.md
@@ -55,7 +55,7 @@ module "endpoints" {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
modules/vpc-endpoints/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---

---

Choice D:
README.md
@@ -188,7 +188,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
 0.12.31    aws = {
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/issues/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/issues/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/outpost/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/outpost/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |
 |  [random](#requirement\_random) | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
modules/vpc-endpoints/README.md
@@ -55,7 +55,7 @@ module "endpoints" {

 | Name | Version |
 |------|---------|
-|  [terraform](#requirement\_terraform) | >= 0.12.26 |
+|  [terraform](#requirement\_terraform) | >= 0.12.31 |
 |  [aws](#requirement\_aws) | >= 3.15 |

 ## Providers
---
modules/vpc-endpoints/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.26"
+  required_version = ">= 0.12.31"

   required_providers {
     aws = {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Updating vpc S3 enpoint

## Motivation and Context
breaking in s3 service type for name change

## Breaking Changes
does not break changes

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
created new tag and tested in local environment and works
ran tf init, plan and tested ok
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", ? "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -1,17 +1,23 @@
 ######################
 # VPC Endpoint for S3
 ######################
-data "aws_vpc_endpoint_service" "s3" {
-  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
-
-  service = "s3"
-}
+#data "aws_vpc_endpoint_service" "s3" {
+#  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
+#
+#  service = "s3"
+#  filter {
+#    name   = "tag-type"
+#    values = ["gateway"]
+#  }
+#}
+data "aws_region" "current" {}

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  #service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
   tags         = local.vpce_tags
 }

---

---

Choice B:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -1,17 +1,23 @@
 ######################
 # VPC Endpoint for S3
 ######################
-data "aws_vpc_endpoint_service" "s3" {
-  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
-
-  service = "s3"
-}
+#data "aws_vpc_endpoint_service" "s3" {
+#  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
+#
+#  service = "s3"
+#  filter {
+#    name   = "tag-type"
+#    values = ["gateway"]
+#  }
+#}
+data "aws_region" "current" {}

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  #service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
   tags         = local.vpce_tags
 }

---

---

Choice C:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       ["10.10.11.0/24", ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -1,17 +1,23 @@
 ######################
 # VPC Endpoint for S3
 ######################
-data "aws_vpc_endpoint_service" "s3" {
-  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
-
-  service = "s3"
-}
+#data "aws_vpc_endpoint_service" "s3" {
+#  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
+#
+#  service = "s3"
+#  filter {
+#    name   = "tag-type"
+#    values = ["gateway"]
+#  }
+#}
+data "aws_region" "current" {}

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  #service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
   tags         = local.vpce_tags
 }

---

---

Choice D:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -1,17 +1,23 @@
 ######################
 # VPC Endpoint for S3
 ######################
-data "aws_vpc_endpoint_service" "s3" {
-  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
-
-  service = "s3"
-}
+#data "aws_vpc_endpoint_service" "s3" {
+#  count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0
+#
+#  service = "s3"
+#  filter {
+#    name   = "tag-type"
+#    values = ["gateway"]
+#  }
+#}
+data "aws_region" "current" {}

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  #service_name = data.aws_vpc_endpoint_service.s3[0].service_name
+  service_name = "com.amazonaws.${data.aws_region.current.name}.s3"
   tags         = local.vpce_tags

---

---