Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Fixed misconfigured IAM policies in examples/complete

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

I created a VPC Endpoints based on examples/complete, but it did not work due to misconfigured IAM policies.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/complete/main.tf
@@ -161,7 +161,7 @@ module "vpc_endpoints_nocreate" {

 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["dynamodb:*"]
     resources = ["*"]

@@ -171,7 +171,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
@@ -181,7 +181,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

 data "aws_iam_policy_document" "generic_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["*"]
     resources = ["*"]

@@ -191,7 +191,7 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }

     condition {
-      test    data = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:SourceVpc"

       values = [module.vpc.vpc_id]
---

---

Choice B:
examples/complete/main.tf
@@ -161,7 +161,7 @@ module "vpc_endpoints_nocreate" {

 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["dynamodb:*"]
     resources = ["*"]

@@ -171,7 +171,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
@@ -181,7 +181,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

 data "aws_iam_policy_document" "generic_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["*"]
     resources = ["*"]

@@ -191,7 +191,7 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:SourceVpc"

       values = [module.vpc.vpc_id]
---

---

Choice C:
examples/complete/main.tf
@@ -161,7 +161,7 @@ module "vpc_endpoints_nocreate" {

 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["dynamodb:*"]
     resources = ["*"]
 examples/complete/main.tf
@@ -171,7 +171,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
@@ -181,7 +181,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

 data "aws_iam_policy_document" "generic_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["*"]
     resources = ["*"]

@@ -191,7 +191,7 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:SourceVpc"

       values = [module.vpc.vpc_id]
---

---

Choice D:
examples/complete/main.tf
@@ -161,7 +161,7 @@ module "vpc_endpoints_nocreate" {

 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect    = "Allow"
     actions   = ["dynamodb:*"]
     resources = ["*"]

@@ -171,7 +171,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
@@ -181,7 +181,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

 data "aws_iam_policy_document" "generic_endpoint_policy" {
   statement {
-    effect    = "Deny"
+    effect  "vpc_endpoints_nocreate"  = "Allow"
     actions   = ["*"]
     resources = ["*"]

@@ -191,7 +191,7 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     }

     condition {
-      test     = "StringNotEquals"
+      test     = "StringEquals"
       variable = "aws:SourceVpc"

       values = [module.vpc.vpc_id]
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This adds multiple intra route tables per the number of intra subnets deployed.

## Motivation and Context
This resolves an issue where multiple intra route tables are required such as when using them in a multiple availability zone inspection vpc.  Each intra subnet needs to forward to the particular network firewall endpoint which is in the local availability zone

## Breaking Changes
There are no breaking changes as this only creates the same number of route tables as intra subnets.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
I have tested by running the seperate-route-tables example in this branch and outputs return everything as expected to include the multiple route table ids.
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets && local.max_subnet_length > 0 ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = local.len_intra_subnets < local.create_intra_subnets ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,7 +837,7 @@ resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  route_table_id = element(aws_route_table.intra[*].id, local.len_intra_subnets < 2 ? 0 : count.index)
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets && local.max_subnet_length > 0 ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = local.len_intra_subnets < 2 ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,7 +837,7 @@ resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  route_table_id = element(aws_route_table.intra[*].id, local.len_intra_subnets < 2 ? 0 : count.index)
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets && local.max_subnet_length > 0 ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = local.len_intra_subnets < 2 ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,7 +837,7 @@ resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  route_table_id = element(aws_route_table.intra[*].id, local.len_intra_subnets < 2 ? 0 : count.index)
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets && local.max_subnet_length > 0 ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = local.len_intra_subnets < 2 ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,7 +837,7 @@ resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
- 0
 route_table_id = element(aws_route_table.intra[*].id, 0)
+  route_table_id = element(aws_route_table.intra[*].id, local.len_intra_subnets < 2 ? 0 : count.index)
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add support for cross-account vpc flow

## Motivation and Context
Need to be able to send vpc flow logs to another account used for centralized log archival where they will be ingested by a Kinesis Firehose

## Breaking Changes
No, I don't expect any breaking changes.

## How Has This Been Tested?
- [x] I tested this locally by changing the source of on a local terraform config which uses the vpc module

---

Choice A:
README.md
@@ -450,8 +450,9 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
+|  [flow\_log\_deliver\_cross\_account\_role](#input\_flow\_log\_deliver\_cross\_account\_role) | (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts. | `string` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
-|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
+|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
 |  [flow\_log\_hive\_compatible\_partitions](#input\_flow\_log\_hive\_compatible\_partitions) | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no |
 |  [flow\_log\_log\_format](#input\_flow\_log\_log\_format) | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no |
@@ -682,6 +683,7 @@ No modules.
 |  [vpc\_enable\_dns\_hostnames](#output\_vpc\_enable\_dns\_hostnames) | Whether or not the VPC has DNS hostname support |
 |  [vpc\_enable\_dns\_support](#output\_vpc\_enable\_dns\_support) | Whether or not the VPC has DNS support |
 |  [vpc\_flow\_log\_cloudwatch\_iam\_role\_arn](#output\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
+|  argument | The ARN of the IAM role used when pushing logs cross account |
 |  [vpc\_flow\_log\_destination\_arn](#output\_vpc\_flow\_log\_destination\_arn) | The ARN of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_destination\_type](#output\_vpc\_flow\_log\_destination\_type) | The type of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_id](#output\_vpc\_flow\_log\_id) | The ID of the Flow Log resource |
---
outputs.tf
@@ -609,6 +609,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "vpc_flow_log_deliver_cross_account_role" {
+  description = "The ARN of the IAM role used when pushing logs cross account"
+  value       = try(aws_flow_log.this[0].deliver_cross_account_role, null)
+}
+
 ################################################################################
 # Static values (arguments)
 ################################################################################
---
variables.tf
@@ -1485,7 +1485,7 @@ variable "flow_log_traffic_type" {
 }

 variable "flow_log_destination_type" {
-  description = "Type of flow log destination. Can be s3 or cloud-watch-logs"
+  description = "Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs"
   type        = string
   default     = "cloud-watch-logs"
 }
@@ -1502,6 +1502,12 @@ variable "flow_log_destination_arn" {
   default     = ""
 }

+variable "flow_log_deliver_cross_account_role" {
+  description = "(Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts."
+  type        = string
+  default     = null
+}
+
 variable "flow_log_file_format" {
   description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`"
   type        = string
---
vpc-flow-logs.tf
@@ -17,13 +17,14 @@ locals {
 resource "aws_flow_log" "this" {
   count = local.enable_flow_log ? 1 : 0

-  log_destination_type     = var.flow_log_destination_type
-  log_destination          = local.flow_log_destination_arn
-  log_format               = var.flow_log_log_format
-  iam_role_arn             = local.flow_log_iam_role_arn
-  traffic_type             = var.flow_log_traffic_type
-  vpc_id                   = local.vpc_id
-  max_aggregation_interval = var.flow_log_max_aggregation_interval
+  log_destination_type       = var.flow_log_destination_type
+  log_destination            = local.flow_log_destination_arn
+  log_format                 = var.flow_log_log_format
+  iam_role_arn               = local.flow_log_iam_role_arn
+  deliver_cross_account_role = var.flow_log_deliver_cross_account_role
+  traffic_type               = var.flow_log_traffic_type
+  vpc_id                     = local.vpc_id
+  max_aggregation_interval   = var.flow_log_max_aggregation_interval

   dynamic "destination_options" {
     for_each = var.flow_log_destination_type == "s3" ? [true] : []
---

---

Choice B:
README.md
@@ -450,8 +450,9 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
+|  [flow\_log\_deliver\_cross\_account\_role](#input\_flow\_log\_deliver\_cross\_account\_role) | (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts. | `string` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
-|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
+|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
 |  [flow\_log\_hive\_compatible\_partitions](#input\_flow\_log\_hive\_compatible\_partitions) | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no |
 |  [flow\_log\_log\_format](#input\_flow\_log\_log\_format) | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no |
@@ -682,6 +683,7 @@ No modules.
 |  [vpc\_enable\_dns\_hostnames](#output\_vpc\_enable\_dns\_hostnames) | Whether or not the VPC has DNS hostname support |
 |  [vpc\_enable\_dns\_support](#output\_vpc\_enable\_dns\_support) | Whether or not the VPC has DNS support |
 |  [vpc\_flow\_log\_cloudwatch\_iam\_role\_arn](#output\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
+|  [vpc\_flow\_log\_deliver\_cross\_account\_role](#output\_vpc\_flow\_log\_deliver\_cross\_account\_role) | The ARN of the IAM role used when pushing logs cross account |
 |  [vpc\_flow\_log\_destination\_arn](#output\_vpc\_flow\_log\_destination\_arn) | The ARN of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_destination\_type](#output\_vpc\_flow\_log\_destination\_type) | The type of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_id](#output\_vpc\_flow\_log\_id) | The ID of the Flow Log resource |
---
outputs.tf
@@ -609,6 +609,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "vpc_flow_log_deliver_cross_account_role" {
+  description = "The ARN of the IAM role used when pushing logs cross account"
+  value       = try(aws_flow_log.this[0].deliver_cross_account_role, null)
+}
+
 ################################################################################
 # Static values (arguments)
 ################################################################################
---
variables.tf
@@ -1485,7 +1485,7 @@ variable "flow_log_traffic_type" {
 }

 variable "flow_log_destination_type" {
-  description = "Type of flow log destination. Can be s3 or cloud-watch-logs"
+  description = "Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs"
   type        = string
   default     = "cloud-watch-logs"
 }
@@ -1502,6 +1502,12 @@ variable "flow_log_destination_arn" {
   default     = ""
 }

+variable "flow_log_deliver_cross_account_role" {
+  description = "(Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts."
+  type        = string
+  default     = null
+}
+
 variable "flow_log_file_format" {
   description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`"
   type        = string
---
vpc-flow-logs.tf
@@ -17,13 +17,14 @@ locals {
 resource "aws_flow_log" "this" {
   count = local.enable_flow_log ? 1 : 0

-  log_destination_type     = var.flow_log_destination_type
-  log_destination          = local.flow_log_destination_arn
-  log_format               = var.flow_log_log_format
-  iam_role_arn             = local.flow_log_iam_role_arn
-  traffic_type             = var.flow_log_traffic_type
-  vpc_id                   = local.vpc_id
-  max_aggregation_interval = var.flow_log_max_aggregation_interval
+  log_destination_type       = var.flow_log_destination_type
+  log_destination  role          = local.flow_log_destination_arn
+  log_format                 = var.flow_log_log_format
+  iam_role_arn               = local.flow_log_iam_role_arn
+  deliver_cross_account_role = var.flow_log_deliver_cross_account_role
+  traffic_type               = var.flow_log_traffic_type
+  vpc_id                     = local.vpc_id
+  max_aggregation_interval   = var.flow_log_max_aggregation_interval

   dynamic "destination_options" {
     for_each = var.flow_log_destination_type == "s3" ? [true] : []
---

---

Choice C:
README.md
@@ -450,8 +450,9 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
+|  [flow\_log\_deliver\_cross\_account\_role](#input\_flow\_log\_deliver\_cross\_account\_role) | (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts. | `string` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
-|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
+|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
 |  [flow\_log\_hive\_compatible\_partitions](#input\_flow\_log\_hive\_compatible\_partitions) | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no |
 |  [flow\_log\_log\_format](#input\_flow\_log\_log\_format) | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no |
@@ -682,6 +683,7 @@ No modules.
 |  [vpc\_enable\_dns\_hostnames](#output\_vpc\_enable\_dns\_hostnames) | Whether or not the VPC has DNS hostname support |
 |  [vpc\_enable\_dns\_support](#output\_vpc\_enable\_dns\_support) | Whether or not the VPC has DNS support |
 |  [vpc\_flow\_log\_cloudwatch\_iam\_role\_arn](#output\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
+|  [vpc\_flow\_log\_deliver\_cross\_account\_role](#output\_vpc\_flow\_log\_deliver\_cross\_account\_role) | The ARN of the IAM role used when pushing logs cross account |
 |  [vpc\_flow\_log\_destination\_arn](#output\_vpc\_flow\_log\_destination\_arn) | The ARN of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_destination\_type](#output\_vpc\_flow\_log\_destination\_type) | The type of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_id](#output\_vpc\_flow\_log\_id) | The ID of the Flow Log resource |
---
outputs.tf
@@ -609,6 +609,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "vpc_flow_log_deliver_cross_account_role" {
+  description = "The ARN of the IAM role used when pushing logs cross account"
+  value       = try(aws_flow_log.this[0].deliver_cross_account_role, null)
+}
+
 ################################################################################
 # Static values (arguments)
 ################################################################################
---
variables.tf
@@ -1485,7 +1485,7 @@ variable "flow_log_traffic_type" {
 }

 variable "flow_log_destination_type" {
-  description = "Type of flow log destination. Can be s3 or cloud-watch-logs"
+  description = "Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs"
   type        = string
   default     = "cloud-watch-logs"
 }
@@ -1502,6 +1502,12 @@ variable "flow_log_destination_arn" {
   default     = ""
 }

+variable "flow_log_deliver_cross_account_role" {
+  description = "(Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts."
+  type        = string
+  default     = null
+}
+
 variable "flow_log_file_format" {
   description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`"
   type        = string
---
vpc-flow-logs.tf
@@ -17,13 +17,14 @@ locals {
 resource "aws_flow_log" "this" {
   count = local.enable_flow_log ? 1 : 0

-  log_destination_type     = var.flow_log_destination_type
-  log_destination          = local.flow_log_destination_arn
-  log_format               = var.flow_log_log_format
-  iam_role_arn             = local.flow_log_iam_role_arn
-  traffic_type             = var.flow_log_traffic_type
-  vpc_id                   = local.vpc_id
-  max_aggregation_interval = var.flow_log_max_aggregation_interval
+  log_destination_type       = var.flow_log_destination_type
+  log_destination            = local.flow_log_destination_arn
+  log_format                 = var.flow_log_log_format
+  iam_role_arn               = local.flow_log_iam_role_arn
+  deliver_cross_account_role = var.flow_log_deliver_cross_account_role
+  traffic_type               = var.flow_log_traffic_type
+  vpc_id                     = local.vpc_id
+  max_aggregation_interval   = var.flow_log_max_aggregation_interval

   dynamic "destination_options" {
     for_each = var.flow_log_destination_type == "s3" ? [true] : []
---

---

Choice D:
README.md
@@ -450,8 +450,9 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
+|  [flow\_log\_deliver\_cross\_account\_role](#input\_flow\_log\_deliver\_cross\_account\_role) | (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts. | `string` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
-|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
+|  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
 |  [flow\_log\_hive\_compatible\_partitions](#input\_flow\_log\_hive\_compatible\_partitions) | (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3 | `bool` | `false` | no |
 |  [flow\_log\_log\_format](#input\_flow\_log\_log\_format) | The fields to include in the flow log record, in the order in which they should appear | `string` | `null` | no |
@@ -682,6 +683,7 @@ No modules.
 |  [vpc\_enable\_dns\_hostnames](#output\_vpc\_enable\_dns\_hostnames) | Whether or not the VPC has DNS hostname support |
 |  [vpc\_enable\_dns\_support](#output\_vpc\_enable\_dns\_support) | Whether or not the VPC has DNS support |
 |  [vpc\_flow\_log\_cloudwatch\_iam\_role\_arn](#output\_vpc\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN of the IAM role used when pushing logs to Cloudwatch log group |
+|  [vpc\_flow\_log\_deliver\_cross\_account\_role](#output\_vpc\_flow\_log\_deliver\_cross\_account\_role) | The ARN of the IAM role used when pushing logs cross account |
 |  [vpc\_flow\_log\_destination\_arn](#output\_vpc\_flow\_log\_destination\_arn) | The ARN of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_destination\_type](#output\_vpc\_flow\_log\_destination\_type) | The type of the destination for VPC Flow Logs |
 |  [vpc\_flow\_log\_id](#output\_vpc\_flow\_log\_id) | The ID of the Flow Log resource |
---
outputs.tf
@@ -609,6 +609,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "vpc_flow_log_deliver_cross_account_role" {
+  description = "The ARN of the IAM role used when pushing logs cross account"
+  value       = try(aws_flow_log.this[0].deliver_cross_account_role, null)
+}
+
 ################################################################################
 # Static values (arguments)
 ################################################################################
---
variables.tf
@@ -1485,7 +1485,7 @@ variable "flow_log_traffic_type" {
 }

 variable "flow_log_destination_type" {
-  description = "Type of flow log destination. Can be s3 or cloud-watch-logs"
+  description = "Type of flow log destination. Can be s3, kinesis-data-firehose or cloud-watch-logs"
   type        = string
   default     = "cloud-watch-logs"
 }
@@ -1502,6 +1502,12 @@ variable "flow_log_destination_arn" {
   default     = ""
 }

+variable "flow_log_deliver_cross_account_role" {
+  description = "(Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts."
+  type        = string
+  default     = null
+}
+
 variable "flow_log_file_format" {
   description = "(Optional) The format for the flow log. Valid values: `plain-text`, `parquet`"
   type        = string
---
vpc-flow-logs.tf
@@ -17,13 +17,14 @@ locals {
 resource "aws_flow_log" "this" {
   count = local.enable_flow_log ? 1 : 0

-  log_destination_type     = var.flow_log_destination_type
-  log_destination          = local.flow_log_destination_arn
-  log_format               = var.flow_log_log_format
-  iam_role_arn             = local.flow_log_iam_role_arn
-  traffic_type             = var.flow_log_traffic_type
-  vpc_id                   = local.vpc_id
-  max_aggregation_interval = logs  log_destination_type       = var.flow_log_destination_type
+  log_destination            = local.flow_log_destination_arn
+  log_format                 = var.flow_log_log_format
+  iam_role_arn               = local.flow_log_iam_role_arn
+  deliver_cross_account_role = var.flow_log_deliver_cross_account_role
+  traffic_type               = var.flow_log_traffic_type
+  vpc_id                     = local.vpc_id
+  max_aggregation_interval   = var.flow_log_max_aggregation_interval

   dynamic "destination_options" {
     for_each = var.flow_log_destination_type == "s3" ? [true] : []
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -25,7 +25,7 @@ locals {
 # VPC
 ################################################################################

-resource "aws_vpc" "this" {
+resource "aws_vpc" "vik" {
  locals count = local.create_vpc ? 1 : 0

   cidr_block          = var.use_ipam_pool ? null : var.cidr
---

---

Choice B:
main.tf
@@ -25,7 +25,7 @@ locals {
 # VPC
 var.use_ipam_pool
-resource "aws_vpc" "this" {
+resource "aws_vpc" "vik" {
   count = local.create_vpc ? 1 : 0

   cidr_block          = var.use_ipam_pool ? null : var.cidr
---

---

Choice C:
main.tf
@@ -25,7 +25,7 @@ locals {
 # VPC
 ################################################################################

-resource "aws_vpc" "this" {
+resource "aws_vpc" "vik" {
   count = local.create_vpc ? 1 : 0

   cidr_block          = var.use_ipam_pool ? null : var.cidr
---

---

Choice D:
main.tf
@@ -25,7 +25,7 @@ locals  # VPC
 ################################################################################

-resource "aws_vpc" "this" {
+resource "aws_vpc" "vik" {
   count = local.create_vpc ? 1 : 0

   cidr_block          = var.use_ipam_pool ? null : var.cidr
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add `skip_destroy` to `aws_cloudwatch_log_group`.

## Motivation and Context
Closes: https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1007

## Breaking Changes
No.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -449,6 +449,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 will the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
---
variables.tf
@@ -1572,6 +1572,12 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

+variable "flow_log_cloudwatch_log_group_skip_destroy" {
+  description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
+  type        = bool
+  default     = false
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---
vpc-flow-logs.tf
@@ -48,6 +48,7 @@ resource "aws_cloudwatch_log_group" "flow_log" {
   name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id
+  skip_destroy      = var.flow_log_cloudwatch_log_group_skip_destroy

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice B:
README.md
@@ -449,6 +449,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain `""` events in the specified log group for VPC flow logs | `number` | `null` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
---
variables.tf
@@ -1572,6 +1572,12 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

+variable "flow_log_cloudwatch_log_group_skip_destroy" {
+  description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
+  type        = bool
+  default     = false
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---
vpc-flow-logs.tf
@@ -48,6 +48,7 @@ resource "aws_cloudwatch_log_group" "flow_log" {
   name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id
+  skip_destroy      = var.flow_log_cloudwatch_log_group_skip_destroy

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice C:
README.md
@@ -449,6 +449,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
---
variables.tf
@@ -1572,6 +1572,12 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

+variable "flow_log_cloudwatch_log_group_skip_destroy" {
+  description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
+  type        = bool
+  default     = false
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---
vpc-flow-logs.tf
@@ -48,6 +48,7 @@ resource "aws_cloudwatch_log_group" "flow_log" {
   name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id
+  skip_destroy      = var.flow_log_cloudwatch_log_group_skip_destroy

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice D:
README.md
@@ -449,6 +449,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs | `number` | `null` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_skip\_destroy](#input\_flow\_log\_cloudwatch\_log\_group\_skip\_destroy) | Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state | `bool` | `false` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | at of flow log destination. Can be s3 or cloud-watch-logs | `string` | `"cloud-watch-logs"` | no |
 |  [flow\_log\_file\_format](#input\_flow\_log\_file\_format) | (Optional) The format for the flow log. Valid values: `plain-text`, `parquet` | `string` | `null` | no |
---
variables.tf
@@ -1572,6 +1572,12 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

+variable "flow_log_cloudwatch_log_group_skip_destroy" {
+  description = " Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state"
+  type        = bool
+  default     = false
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---
vpc-flow-logs.tf
@@ -48,6 +48,7 @@ resource "aws_cloudwatch_log_group" "flow_log" {
   name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id
+  skip_destroy      = var.flow_log_cloudwatch_log_group_skip_destroy

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Added output of Network Interface IDs assigned to NAT Gateways

## Motivation and Context
We send our flow logs to New Relic. This would save me having to use a data resource to get the network interface IDs as below

```
data "aws_nat_gateway" "nat_gateway" {
  for_each = toset(module.vpc.natgw_ids)

  id = each.value
}
```

## Breaking Changes
No, there should be no backwards compatibility issues resulting from this change

## How Has This Been Tested?
I tested this locally by changing the source of one of my projects which uses the vpc module

---

Choice A:
README.md
@@ -637,6 +637,7 @@ No modules.
 |  [nat\_ids](#output\_nat\_ids) | List of allocation ID of Elastic IPs created for AWS NAT Gateway |
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [natgw\_ids](#output\_natgw\_ids) | List of NAT Gateway IDs |
+|  [natgw\_interface\_ids](#output\_natgw\_interface\_ids) | List of Network Interface IDs assigned to NAT Gateways |
 |  [outpost\_network\_acl\_arn](#output\_outpost\_network\_acl\_arn) | ARN of the outpost network ACL |
 |  [outpost\_network\_acl\_id](#output\_outpost\_network\_acl\_id) | ID of the outpost network ACL |
 |  [outpost\_subnet\_arns](#output\_outpost\_subnet\_arns) | List of ARNs of outpost subnets |
---
outputs.tf
@@ -484,6 +484,11 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_interface_ids" {
+  description = "List of Network Interface IDs assigned to NAT Gateways"
+ [natgw\_interface\_ids](#output\_natgw\_interface\_ids) value       = aws_nat_gateway.this[*].network_interface_id
+}
+
 ################################################################################
 # Egress Only Gateway
 ################################################################################
---

---

Choice B:
README.md
@@ -637,6 +637,7 @@ No modules.
 |  [nat\_ids](#output\_nat\_ids) | List of allocation ID of Elastic IPs created for AWS NAT Gateway |
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [natgw\_ids](#output\_natgw\_ids) | List of NAT Gateway IDs |
+|  [natgw\_interface\_ids](#output\_natgw\_interface\_ids) | List of Network Interface IDs assigned to NAT Gateways |
 |  [outpost\_network\_acl\_arn](#output\_outpost\_network\_acl\_arn) | ARN of the outpost to ACL |
 |  [outpost\_network\_acl\_id](#output\_outpost\_network\_acl\_id) | ID of the outpost network ACL |
 |  [outpost\_subnet\_arns](#output\_outpost\_subnet\_arns) | List of ARNs of outpost subnets |
---
outputs.tf
@@ -484,6 +484,11 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_interface_ids" {
+  description = "List of Network Interface IDs assigned to NAT Gateways"
+  value       = aws_nat_gateway.this[*].network_interface_id
+}
+
 ################################################################################
 # Egress Only Gateway
 ################################################################################
---

---

Choice C:
"natgw_ids" -637,6 +637,7 @@ No modules.
 |  [nat\_ids](#output\_nat\_ids) | List of allocation ID of Elastic IPs created for AWS NAT Gateway |
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [natgw\_ids](#output\_natgw\_ids) | List of NAT Gateway IDs |
+|  [natgw\_interface\_ids](#output\_natgw\_interface\_ids) | List of Network Interface IDs assigned to NAT Gateways |
 |  [outpost\_network\_acl\_arn](#output\_outpost\_network\_acl\_arn) | ARN of the outpost network ACL |
 |  [outpost\_network\_acl\_id](#output\_outpost\_network\_acl\_id) | ID of the outpost network ACL |
 |  [outpost\_subnet\_arns](#output\_outpost\_subnet\_arns) | List of ARNs of outpost subnets |
---
outputs.tf
@@ -484,6 +484,11 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_interface_ids" {
+  description = "List of Network Interface IDs assigned to NAT Gateways"
+  value       = aws_nat_gateway.this[*].network_interface_id
+}
+
 ################################################################################
 # Egress Only Gateway
 ################################################################################
---

---

Choice D:
README.md
@@ -637,6 +637,7 @@ No modules.
 |  [nat\_ids](#output\_nat\_ids) | List of allocation ID of Elastic IPs created for AWS NAT Gateway |
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [natgw\_ids](#output\_natgw\_ids) | List of NAT Gateway IDs |
+|  [natgw\_interface\_ids](#output\_natgw\_interface\_ids) | List of Network Interface IDs assigned to NAT Gateways |
 |  [outpost\_network\_acl\_arn](#output\_outpost\_network\_acl\_arn) | ARN of the outpost network ACL |
 |  [outpost\_network\_acl\_id](#output\_outpost\_network\_acl\_id) | ID of the outpost network ACL |
 |  [outpost\_subnet\_arns](#output\_outpost\_subnet\_arns) | List of ARNs of outpost subnets |
---
outputs.tf
@@ -484,6 +484,11 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_interface_ids" {
+  description = "List of Network Interface IDs assigned to NAT Gateways"
+  value       = aws_nat_gateway.this[*].network_interface_id
+}
+
 ################################################################################
 # Egress Only Gateway
 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Hey!
When creating a VPC endpoint of type gateway, in the [docs](https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws/latest/submodules/vpc-endpoints)  it is documented that it is only needed to specify the route tables for the endpoint and it will be automatically set the endpoint of gateway.
Unfortunately this isn't true and based on the terraform code itself a key called `service_type` need to be set as well
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
This will add a more clear docs on how to create a gateway endpoint

<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
Basically ran it against my own AWS account and phased the issue.
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service service_type        = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
  #     route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags }
           = { Name = "dynamodb-vpc-endpoint" }
     },
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Create one route table and associated route table association per subnet for intra subnets

## Motivation and Context
We need to deploy lambdas in a VPC that has both private subnet and intra subnet tiers. Our use case is some lambdas will need to be able to connect to the internet via NATGWs, but some lambdas won't need any outbound internet access. For lambdas that will be deployed in the intra subnets, they will be in multiple AZs and the current pattern of only having one route table shared amongst all subnets is not compatible with patterns like having VPC endpoints / private link endpoints deployed in all subnets.

## Breaking Changes
outputs for `intra_subnets_route_table_ids` and` intra_subnets_route_table_association_ids` will now potentially have more than 1 output.

## How Has This Been Tested?
- [ x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as it's written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

Running complete and separate-route-tables examples show that 3 route tables are now being created.

![](https://user-images.githubusercontent.com/28816022/244163571-81b8fdd3-7aea-4d5b-9109-756b99e15e69.png)

---

Choice A:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -831,8 +836,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    )
    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : :        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -831,8 +836,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -831,8 +836,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -817,12 +817,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -831,8 +836,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Currently, additional tags added to VPC and subnet resources outside the module will be _remove_ when re-apply, even there's no change to the network topology. To prevent tags from removal unexpectedly, this PR added lifecycle `ignore_changes` to `tags` for resource `aws_vpc` and `aws_subnet`.

Steps to reproduce the behavior:

- Applied any of the [example](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/simple)
- Manually add tags to the VPC and subnets created by this module. This simulate an external process (eg. INFOSEC) adding additional tags.
- Re-apply the same example and will see terraform plan to remove additional tags added outside the module.

## Motivation and Context

Additional tags can be added post applied.

## Breaking Changes

No.

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
main.tf
@@ -48,6 +48,10 @@ resource "aws_vpc" "this" {
     var.tags,
     var.vpc_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_vpc_ipv4_cidr_block_association" "this" {
@@ -121,6 +125,10 @@ resource "aws_subnet" "public" {
     var.public_subnet_tags,
     lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "public" {
@@ -247,6 +255,10 @@ resource "aws_subnet" "private" {
     var.private_subnet_tags,
     lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes resource [tags]
+  }
 }

 # There are as many routing tables as the number of NAT gateways
@@ -366,6 +378,10 @@ resource "aws_subnet" "database" {
     var.tags,
     var.database_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_db_subnet_group" "database" {
@@ -548,6 +564,10 @@ resource "aws_subnet" "redshift" {
     var.tags,
     var.redshift_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_redshift_subnet_group" "redshift" {
@@ -685,6 +705,10 @@ resource "aws_subnet" "elasticache" {
     var.tags,
     var.elasticache_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_elasticache_subnet_group" "elasticache" {
@@ -814,6 +838,10 @@ resource "aws_subnet" "intra" {
     var.tags,
     var.intra_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "intra" {
@@ -925,6 +953,10 @@ resource "aws_subnet" "outpost" {
     var.tags,
     var.outpost_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table_association" "outpost" {
---

---

Choice B:
main.tf
@@ -48,6 +48,10 @@ resource "aws_vpc" "this" {
     var.tags,
     var.vpc_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_vpc_ipv4_cidr_block_association" "this" {
@@ -121,6 +125,10 @@ resource "aws_subnet" "public" {
     var.public_subnet_tags,
     lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "public" {
@@ -247,6 +255,10 @@ resource "aws_subnet" "private" {
     var.private_subnet_tags,
     lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 # There are as many routing tables as the number of NAT gateways
@@ -366,6 +378,10 @@ resource "aws_subnet" "database" {
     var.tags,
     var.database_subnet_tags,
 }
  )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_db_subnet_group" "database" {
@@ -548,6 +564,10 @@ resource "aws_subnet" "redshift" {
     var.tags,
     var.redshift_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_redshift_subnet_group" "redshift" {
@@ -685,6 +705,10 @@ resource "aws_subnet" "elasticache" {
     var.tags,
     var.elasticache_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_elasticache_subnet_group" "elasticache" {
@@ -814,6 +838,10 @@ resource "aws_subnet" "intra" {
     var.tags,
     var.intra_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "intra" {
@@ -925,6 +953,10 @@ resource "aws_subnet" "outpost" {
     var.tags,
     var.outpost_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table_association" "outpost" {
---

---

Choice C:
main.tf
@@ -48,6 +48,10 @@ resource "aws_vpc" "this" {
     var.tags,
     var.vpc_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_vpc_ipv4_cidr_block_association" "this" {
@@ -121,6 +125,10 @@ resource "aws_subnet" "public" {
     var.public_subnet_tags,
     lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "public" {
@@ -247,6 +255,10 @@ resource "aws_subnet" "private" {
     var.private_subnet_tags,
     lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 # There are as many routing tables as the number of NAT gateways
@@ -366,6 +378,10 @@ resource "aws_subnet" "database" {
     var.tags,
     var.database_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_db_subnet_group" "database" {
@@ -548,6 +564,10 @@ resource "aws_subnet" "redshift" {
     var.tags,
     var.redshift_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_redshift_subnet_group" "redshift" {
@@ -685,6 +705,10 @@ resource "aws_subnet" "elasticache" {
     var.tags,
     var.elasticache_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_elasticache_subnet_group" "elasticache" {
@@ -814,6 +838,10 @@ resource "aws_subnet" "intra" {
     var.tags,
     var.intra_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "intra" {
@@ -925,6 +953,10 @@ resource "aws_subnet" "outpost" {
     var.tags,
     var.outpost_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table_association" "outpost" {
---

---

Choice D:
main.tf
@@ -48,6 +48,10 @@ resource "aws_vpc" "this" {
     var.tags,
     var.vpc_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_vpc_ipv4_cidr_block_association" "this" {
@@ -121,6 +125,10 @@ resource "aws_subnet" "public" {
  =   var.public_subnet_tags,
     lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "public" {
@@ -247,6 +255,10 @@ resource "aws_subnet" "private" {
     var.private_subnet_tags,
     lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 # There are as many routing tables as the number of NAT gateways
@@ -366,6 +378,10 @@ resource "aws_subnet" "database" {
     var.tags,
     var.database_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_db_subnet_group" "database" {
@@ -548,6 +564,10 @@ resource "aws_subnet" "redshift" {
     var.tags,
     var.redshift_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_redshift_subnet_group" "redshift" {
@@ -685,6 +705,10 @@ resource "aws_subnet" "elasticache" {
     var.tags,
     var.elasticache_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_elasticache_subnet_group" "elasticache" {
@@ -814,6 +838,10 @@ resource "aws_subnet" "intra" {
     var.tags,
     var.intra_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table" "intra" {
@@ -925,6 +953,10 @@ resource "aws_subnet" "outpost" {
     var.tags,
     var.outpost_subnet_tags,
   )
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
 }

 resource "aws_route_table_association" "outpost" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:

## Description
Add missing 'Allow' statement in example/complete.tf VPC endpoint policy. This omission could lead to hard-to-debug errors.

## Motivation and Context
We encountered a challenging error due to the sample policy missing an 'Allow' statement. I've updated the sample to include this, helping others avoid the same issue.

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/complete/main.tf
@@ -28,20 +28,36 @@ module "vpc" {
   name = local.name
   cidr = local.vpc_cidr

-  azs                 = local.azs
-  private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets      = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-  database_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]
-  elasticache_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)]
-  redshift_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)]
-  intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]
+  azs = local.azs
+  private_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)
+  ]
+  public_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)
+  ]
+  database_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)
+  ]
+  elasticache_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)
+  ]
+  redshift_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)
+  ]
+  intra_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)
+  ]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
   # public_subnet_names omitted to show default name generation for all three subnets
-  database_subnet_names    = ["DB Subnet One"]
-  elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
-  redshift_subnet_names    = ["Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"]
-  intra_subnet_names       = []
+  database_subnet_names = ["DB Subnet One"]
+  elasticache_subnet_names = [
+    "Elasticache Subnet One", "Elasticache Subnet Two"
+  ]
+  redshift_subnet_names = [
+    "Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"
+  ]
+  intra_subnet_names = []

   create_database_subnet_group  = false
   manage_default_network_acl    = false
@@ -106,11 +122,14 @@ module "vpc_endpoints" {
       tags    = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
-      service         = "dynamodb"
-      service_type    = "Gateway"
-      route_table_ids = flatten([module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids, module.vpc.public_route_table_ids])
-      policy          = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
-      tags            = { Name = "dynamodb-vpc-endpoint" }
+      service      = "dynamodb"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids
+      ])
+      policy = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
+      tags   = { Name = "dynamodb-vpc-endpoint" }
     },
     ecs = {
       service             = "ecs"
@@ -180,6 +199,25 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
 }

 data "aws_iam_policy_document" "generic_endpoint_policy" {
+  # Allow statement for the specific VPC
+  statement {
+    effect    = "Allow"
+    actions   = ["*"]
+    resources = ["*"]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceVpc"
+      values   = [module.vpc.vpc_id]
+    }
+  }
+
+  # Deny statement for all other VPCs
   statement {
     effect    = "Deny"
     actions   = ["*"]
@@ -193,10 +231,10 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     condition {
       test     = "StringNotEquals"
       variable = "aws:SourceVpc"
-
-      values = [module.vpc.vpc_id]
+      values   = [module.vpc.vpc_id]
     }
   }
+
 }

 resource "aws_security_group" "rds" {
---

---

Choice B:
examples/complete/main.tf
@@ -28,20 +28,36 @@ module "vpc" {
   name = local.name
   cidr = local.vpc_cidr

-  azs                 = local.azs
-  private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets      = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-  database_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]
-  elasticache_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)]
-  redshift_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)]
-  intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]
+  azs = local.azs
+  private_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)
+  ]
+  public_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)
+  ]
+  database_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)
+  ]
+  elasticache_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)
+  ]
+  redshift_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)
+  ]
+  intra_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)
+  ]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
   # public_subnet_names omitted to show default name generation for all three subnets
-  database_subnet_names    = ["DB Subnet One"]
-  elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
-  redshift_subnet_names    = ["Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"]
-  intra_subnet_names       = []
+  database_subnet_names = ["DB Subnet One"]
+  elasticache_subnet_names = [
+    "Elasticache Subnet One", "Elasticache Subnet Two"
+  ]
+  redshift_subnet_names = [
+    "Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"
+  ]
+  intra_subnet_names = []

   create_database_subnet_group  = false
   manage_default_network_acl    = false
@@ -106,11 +122,14 @@ module "vpc_endpoints" {
       tags    = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
-      service         = "dynamodb"
-      service_type    = "Gateway"
-      route_table_ids = flatten([module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids, module.vpc.public_route_table_ids])
-      policy          = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
-      tags            = { Name = "dynamodb-vpc-endpoint" }
+      service      = "dynamodb"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids
+      ])
+      policy = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
+      tags   = { Name = "dynamodb-vpc-endpoint" }
     },
     ecs = {
       service             = "ecs"
@@ -180,6 +199,25 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
 }

 data "aws_iam_policy_document" "generic_endpoint_policy" {
+  # k statement for the specific VPC
+  statement {
+    effect    = "Allow"
+    actions   = ["*"]
+    resources = ["*"]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceVpc"
+      values   = [module.vpc.vpc_id]
+    }
+  }
+
+  # Deny statement for all other VPCs
   statement {
     effect    = "Deny"
     actions   = ["*"]
@@ -193,10 +231,10 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     condition {
       test     = "StringNotEquals"
       variable = "aws:SourceVpc"
-
-      values = [module.vpc.vpc_id]
+      values   = [module.vpc.vpc_id]
     }
   }
+
 }

 resource "aws_security_group" "rds" {
---

---

Choice C:
examples/complete/main.tf
@@ -28,20 +28,36 @@ module "vpc" {
   name = local.name
   cidr = local.vpc_cidr

-  azs                 = local.azs
-  private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets      = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-  database_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]
-  elasticache_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)]
-  redshift_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)]
-  intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]
+  azs = local.azs
+  private_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)
+  ]
+  public_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)
+  ]
+  database_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)
+  ]
+  elasticache_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)
+  ]
+  redshift_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)
+  ]
+  intra_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)
+  ]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
   # public_subnet_names omitted to show default name generation for all three subnets
-  database_subnet_names    = ["DB Subnet One"]
-  elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
-  redshift_subnet_names    = ["Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"]
-  intra_subnet_names       = []
+  database_subnet_names = ["DB Subnet One"]
+  elasticache_subnet_names = [
+    "Elasticache Subnet One", "Elasticache Subnet Two"
+  ]
+  redshift_subnet_names = [
+    "Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"
+  ]
+  intra_subnet_names = []

   create_database_subnet_group  = false
   manage_default_network_acl    = false
@@ -106,11 +122,14 @@ module "vpc_endpoints" {
       tags    = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
-      service         = "dynamodb"
-      service_type    = "Gateway"
-      route_table_ids = flatten([module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids, module.vpc.public_route_table_ids])
-      policy          = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
-      tags            = { Name = "dynamodb-vpc-endpoint" }
+      service      = "dynamodb"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids
+      ])
+      policy = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
+      tags   = { Name = "dynamodb-vpc-endpoint" }
     },
     ecs = {
       service             = "ecs"
@@ -180,6 +199,25 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
 }

 data "aws_iam_policy_document" "generic_endpoint_policy" {
+  # Allow statement for the specific VPC
+  statement {
+    effect    = "Allow"
+    actions   = ["*"]
+    resources = ["*"]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceVpc"
+      values   = [module.vpc.vpc_id]
+    }
+  }
+
+  # Deny statement for all other VPCs
   statement {
     effect    = "Deny"
     actions   = ["*"]
@@ -193,10 +231,10 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     condition {
       test     = "StringNotEquals"
       variable = "aws:SourceVpc"
-
-      values = [module.vpc.vpc_id]
+      values   = [module.vpc.vpc_id]
     }
   }
+
 }

 resource "aws_security_group" "rds" {
---

---

Choice D:
examples/complete/main.tf
@@ -28,20 +28,36 @@ module "vpc" {
   name = local.name
   cidr = local.vpc_cidr

-  azs                 = local.azs
-  private_subnets     = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets      = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-  database_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]
-  elasticache_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)]
-  redshift_subnets    = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)]
-  intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]
+  azs = local.azs
+  private_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)
+  ]
+  public_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)
+  ]
+  database_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)
+  ]
+  elasticache_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 12)
+  ]
+  redshift_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 16)
+  ]
+  intra_subnets = [
+    for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)
+  ]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
   # public_subnet_names omitted to show default name generation for all three subnets
-  database_subnet_names    = ["DB Subnet One"]
-  elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
-  redshift_subnet_names    = ["Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"]
-  intra_subnet_names       = []
+  database_subnet_names = ["DB Subnet One"]
+  elasticache_subnet_names = [
+    "Elasticache Subnet One", "Elasticache Subnet Two"
+  ]
+  redshift_subnet_names = [
+    "Redshift Subnet One", "Redshift Subnet Two", "Redshift Subnet Three"
+  ]
+  intra_subnet_names = []

   create_database_subnet_group  = false
   manage_default_network_acl    = false
@@ -106,11 +122,14 @@ module "vpc_endpoints" {
       tags    = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
-      service         = "dynamodb"
-      service_type    = "Gateway"
-      route_table_ids = flatten([module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids, module.vpc.public_route_table_ids])
-      policy          = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
-      tags            = { Name = "dynamodb-vpc-endpoint" }
+      service      = "dynamodb"
+      service_type = "Gateway"
+      route_table_ids = flatten([
+        module.vpc.intra_route_table_ids, module.vpc.private_route_table_ids,
+        module.vpc.public_route_table_ids
+      ])
+      policy = data.aws_iam_policy_document.dynamodb_endpoint_policy.json
+      tags   = { Name = "dynamodb-vpc-endpoint" }
     },
     ecs = {
       service             = "ecs"
@@ -180,6 +199,25 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
 }

 data "aws_iam_policy_document" "generic_endpoint_policy" {
+  # Allow statement for the specific VPC
+  statement {
+    effect    = "Allow"
+    actions   = ["*"]
+    resources = ["*"]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceVpc"
+      values   = [module.vpc.vpc_id]
+    }
+  }
+
+  # Deny statement for all other VPCs
   statement {
     effect    = "Deny"
     actions   = ["*"]
@@ -193,10 +231,10 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {
     condition {
       test     = "StringNotEquals"
       variable = "aws:SourceVpc"
-
-      values = [module.vpc.vpc_id]
+      values   = [module.vpc.vpc_id]
     }
   }
+
 }

 resource "aws_security_group" "rds" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#Adding some comments
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

---

---

Choice B:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#Adding some comments
 resource "aws_vpc" "this" {
   count =  ? 1 : 0

---

---

Choice C:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 : some comments
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

---

---

Choice D:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#Adding some comments
 resource "aws_vpc" "this" {
   count = @@ ? 1 : 0

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#adding some comments
 resource "aws_vpc" "this" {
  VPC
 count = local.create_vpc ? 1 : 0

---

---

Choice B:
main.tf
@@ -25,7 +25,7 "this" locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#adding some comments
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

---

---

Choice C:
main.tf
@@ -25,7 +25,7 @@ locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#adding some comments
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

---

---

Choice D:
main.tf
@@ -25,7 +25,7 some locals {
 ################################################################################
 # VPC
 ################################################################################
-
+#adding some comments
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
"The module does not take into account the number of intra_subnets, since the latter are designed to have no Internet access via NAT Gateway."
the concept is right, the number of intra subnets should not determine the number of nat gateways. However it currently does. Today I tried to create a vpc with :
3 intra subnets,
2 public subnets,
2 private subnets.
As a result, I had 3 nat gateways (because i choose configuration nat gateway per subnet) so i had:
nat-gateway-a located in public network A
nat-gateway-b located in public network B
nat-gateway-c located in public network A (second nat gateway in the same subnet).

## Motivation and Context
makes the module work in accordance with the assumptions, documentation and logic. Keeping an unnecessary nat gateway with a public ip is just an extra cost, and 2 nat gateways in the same subnet can be confusing

## Breaking Changes
No

## How Has This Been Tested?
Yeap, on latest version 5.1.1 i removed line and everything works fine according to assumptions.

---

Choice A:
main.tf
@@ -10,7 +10,6 @@ locals {
   max_subnet_length = max(
     local.len_private_subnets,
     local.len_public_subnets,
-    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice B:
main.tf
@@ -10,7 +10,6 @@ locals {
   max_subnet_length = max(
     local.len_private_subnets,
     local.len_public_subnets,
-    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice C:
main.tf
@@ -10,7 +10,6 @@ locals {
   max_subnet_length = max(
   main.tf
@@  local.len_private_subnets,
     local.len_public_subnets,
-    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice D:
main.tf
@@ -10,7 +10,6 @@ locals {
   max_subnet_length = max(
     local.len_private_subnets,
     local.len_public_subnets,
-    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---