Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This pull request updates the AWS VPC terraform module to use log group ARNs instead of wildcard ("*") as the resource in the flow log policy. This change restricts the flow log policy to specific log groups, improving security and ensuring that only authorized log groups can receive flow log data.

## Motivation and Context
The previous implementation allowed logging to any log group in AWS CloudWatch Logs, which could potentially lead to unauthorized access to log data. The updated implementation ensures that flow log data is only sent to designated log groups specified by their ARNs.

## Breaking Changes
This change does not break backwards compatibility with the current major version.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request to ensure that all relevant pre-commit checks have passed.

Thank you.

---

Choice A:
README.md
@@ -349,8 +349,10 @@ No modules.
 | [aws_vpn_gateway_route_propagation.intra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs

---
vpc-flow-logs.tf
@@ -1,3 +1,13 @@
+data "aws_region" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
+data "aws_caller_identity" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -8,6 +18,10 @@ locals {
   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" |
 local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
+  flow_log_group_arns = [
+    for log_group in aws_cloudwatch_log_group.flow_log :
+    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+  ]
 }

 ################################################################################
@@ -115,6 +129,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
       "logs:DescribeLogStreams",
     ]

-    resources = ["*"]
+    resources = local.flow_log_group_arns
   }
 }
---

---

Choice B:
README.md
@@ -349,8 +349,10 @@ No modules.
 | [aws_vpn_gateway_route_propagation.intra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs

---
vpc-flow-logs.tf
@@ -1,3 +1,13 @@
+data "aws_region" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
+data "aws_caller_identity" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a "s3" as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -8,6 +18,10 @@ locals {
   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
+  flow_log_group_arns = [
+    for log_group in aws_cloudwatch_log_group.flow_log :
+    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+  ]
 }

 ################################################################################
@@ -115,6 +129,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
       "logs:DescribeLogStreams",
     ]

-    resources = ["*"]
+    resources = local.flow_log_group_arns
   }
 }
---

---

Choice C:
README.md
@@ -349,8 +349,10 @@ No modules.
 | [aws_vpn_gateway_route_propagation.intra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs

---
vpc-flow-logs.tf
@@ -1,3 +1,13 @@
+data "aws_region" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
+data "aws_caller_identity" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -8,6 +18,10 @@ locals {
   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
+  flow_log_group_arns = [
+    for log_group in aws_cloudwatch_log_group.flow_log :
+    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+  ]
 }

 ################################################################################
@@ -115,6 +129,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
       "logs:DescribeLogStreams",
     ]

-    resources = ["*"]
+    resources = local.flow_log_group_arns
   }
 }
---

---

Choice D:
README.md
@@ -349,8 +349,10 @@ No modules.
 | [aws_vpn_gateway_route_propagation.intra](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
 | [aws_vpn_gateway_route_propagation.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource source | [aws_vpn_gateway_route_propagation.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_gateway_route_propagation) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs

---
vpc-flow-logs.tf
@@ -1,3 +1,13 @@
+data "aws_region" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
+data "aws_caller_identity" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -8,6 +18,10 @@ locals {
   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
+  flow_log_group_arns = [
+    for log_group in aws_cloudwatch_log_group.flow_log :
+    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+  ]
 }

 ################################################################################
@@ -115,6 +129,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
       "logs:DescribeLogStreams",
     ]

-    resources = ["*"]
+    resources = local.flow_log_group_arns
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

 make use of the main route table for the intra subnet implicit association by adding a variable `var.create_intra_subnet_route_table`.

## Motivation and Context

I would like to use the main route table for the intra subnet implicit association.
By specifying the var.create_intra_subnet_route_table with false,
users can choose implicit association to the main route table for intra subnet.

## Breaking Changes

There is no breaking changes.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -369,6 +369,7 @@ No modules.
 |  [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+|  [create\_intra\_subnet\_route\_table](#input\_create\_intra\_subnet\_route\_table) | Controls if separate route table for intra should be created | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
---
main.tf
@@ -795,7 +795,8 @@ resource "aws_network_acl_rule" "elasticache_outbound" {
 ################################################################################

 locals {
-  create_intra_subnets = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_subnets     = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_route_table = local.create_intra_subnets && var.create_intra_subnet_route_table
 }

 resource "aws_subnet" "intra" {
@@ -830,7 +831,7 @@ locals {
 }

 resource "aws_route_table" "intra" {
-  count var.create_multiple_intra_route_tables local.create_intra_subnets ? local.num_intra_route_tables : 0
+  count = local.create_intra_route_table ? local.num_intra_route_tables : 0

   vpc_id = local.vpc_id

@@ -847,7 +848,7 @@ resource "aws_route_table" "intra" {
 }

 resource "aws_route_table_association" "intra" {
-  count = local.create_intra_subnets ? local.len_intra_subnets : 0
+  count = local.create_intra_subnets && local.create_intra_route_table ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
   route_table_id = element(aws_route_table.intra[*].id, var.create_multiple_intra_route_tables ? count.index : 0)
---
variables.tf
@@ -920,6 +920,12 @@ variable "intra_subnet_enable_resource_name_dns_a_record_on_launch" {
   default     = false
 }

+variable "create_intra_subnet_route_table" {
+  description = "Controls if separate route table for intra should be created"
+  type        = bool
+  default     = true
+}
+
 variable "create_multiple_intra_route_tables" {
   description = "Indicates whether to create a separate route table for each intra subnet. Default: `false`"
   type        = bool
---

---

Choice B:
README.md
@@ -369,6 +369,7 @@ No modules.
 |  [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+|  [create\_intra\_subnet\_route\_table](#input\_create\_intra\_subnet\_route\_table) | Controls if separate route table for intra should be created | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
---
main.tf
@@ -795,7 +795,8 @@ resource "aws_network_acl_rule" "elasticache_outbound" {
 ################################################################################

 locals {
-  create_intra_subnets = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_subnets     = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_route_table = local.create_intra_subnets && var.create_intra_subnet_route_table
 }

 resource "aws_subnet" "intra" {
@@ -830,7 +831,7 @@ locals {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? local.num_intra_route_tables : 0
+  count = local.create_intra_route_table ? local.num_intra_route_tables : 0

   vpc_id = local.vpc_id

@@ -847,7 +848,7 @@ resource "aws_route_table" "intra" {
 }

 resource "aws_route_table_association" "intra" {
-  count = local.create_intra_subnets ? local.len_intra_subnets : 0
+  count = local.create_intra_subnets && local.create_intra_route_table ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
   route_table_id = element(aws_route_table.intra[*].id, var.create_multiple_intra_route_tables ? count.index : 0)
---
variables.tf
@@ -920,6 +920,12 @@ variable "intra_subnet_enable_resource_name_dns_a_record_on_launch" {
   default     = false
 }

+variable "create_intra_subnet_route_table" {
+  description = "Controls if separate route table for intra should be created"
+  type        = bool
+  default     = true
+}
+
 variable "create_multiple_intra_route_tables" {
   description = "Indicates whether to create a separate route table for each intra subnet. Default: `false`"
   type        = bool
---

---

Choice C:
README.md
@@ -369,6 +369,7 @@ No modules.
 |  [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to -830,7 IAM role for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+|  [create\_intra\_subnet\_route\_table](#input\_create\_intra\_subnet\_route\_table) | Controls if separate route table for intra should be created | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
---
main.tf
@@ -795,7 +795,8 @@ resource "aws_network_acl_rule" "elasticache_outbound" {
 ################################################################################

 locals {
-  create_intra_subnets = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_subnets     = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_route_table = local.create_intra_subnets && var.create_intra_subnet_route_table
 }

 resource "aws_subnet" "intra" {
@@ -830,7 +831,7 @@ locals {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? local.num_intra_route_tables : 0
+  count = local.create_intra_route_table ? local.num_intra_route_tables : 0

   vpc_id = local.vpc_id

@@ -847,7 +848,7 @@ resource "aws_route_table" "intra" {
 }

 resource "aws_route_table_association" "intra" {
-  count = local.create_intra_subnets ? local.len_intra_subnets : 0
+  count = local.create_intra_subnets && local.create_intra_route_table ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
   route_table_id = element(aws_route_table.intra[*].id, var.create_multiple_intra_route_tables ? count.index : 0)
---
variables.tf
@@ -920,6 +920,12 @@ variable "intra_subnet_enable_resource_name_dns_a_record_on_launch" {
   default     = false
 }

+variable "create_intra_subnet_route_table" {
+  description = "Controls if separate route table for intra should be created"
+  type        = bool
+  default     = true
+}
+
 variable "create_multiple_intra_route_tables" {
   description = "Indicates whether to create a separate route table for each intra subnet. Default: `false`"
   type        = bool
---

---

Choice D:
README.md
@@ -369,6 +369,7 @@ No modules.
 |  [create\_flow\_log\_cloudwatch\_iam\_role](#input\_create\_flow\_log\_cloudwatch\_iam\_role) | Whether to create IAM role for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_flow\_log\_cloudwatch\_log\_group](#input\_create\_flow\_log\_cloudwatch\_log\_group) | Whether to create CloudWatch log group for VPC Flow Logs | `bool` | `false` | no |
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
+|  [create\_intra\_subnet\_route\_table](#input\_create\_intra\_subnet\_route\_table) | Controls if separate route table for intra should be created | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
---
main.tf
@@ -795,7 +795,8 @@ resource "aws_network_acl_rule" "elasticache_outbound" {
 ################################################################################

 locals {
-  create_intra_subnets = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_subnets     = local.create_vpc && local.len_intra_subnets > 0
+  create_intra_route_table = local.create_intra_subnets && var.create_intra_subnet_route_table
 }

 resource "aws_subnet" "intra" {
@@ -830,7 +831,7 @@ locals {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? local.num_intra_route_tables : 0
+  count = local.create_intra_route_table ? local.num_intra_route_tables : 0

   vpc_id = local.vpc_id

@@ -847,7 +848,7 @@ resource "aws_route_table" "intra" {
 }

 resource "aws_route_table_association" "intra" {
-  count = local.create_intra_subnets ? local.len_intra_subnets : 0
+  count = local.create_intra_subnets && local.create_intra_route_table ? local.len_intra_subnets : 0

   subnet_id      = element(aws_subnet.intra[*].id, count.index)
   route_table_id = element(aws_route_table.intra[*].id, var.create_multiple_intra_route_tables ? count.index : 0)
---
variables.tf
@@ -920,6 +920,12 @@ variable "intra_subnet_enable_resource_name_dns_a_record_on_launch" {
   default    separate = false
 }

+variable "create_intra_subnet_route_table" {
+  description = "Controls if separate route table for intra should be created"
+  type        = bool
+  default     = true
+}
+
 variable "create_multiple_intra_route_tables" {
   description = "Indicates whether to create a separate route table for each intra subnet. Default: `false`"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
add code owners

---

Choice A:
.github/CODEOWNERS
@@ @Sa2
+* +1,2 @@
+* @Sa2
+* @ynary
---

---

Choice B:
.github/CODEOWNERS
@@ @@
+* +1,2 @@
+* @Sa2
+* @ynary
---

---

Choice C:
.github/CODEOWNERS
@@ -0,0 +1,2 +1,2 @Sa2
+* @ynary
---

---

Choice D:
.github/CODEOWNERS
@@ -0,0 +1,2 @@
+* @Sa2
+* @ynary
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:

## Description
Changed relative links to absolute links, otherwise they don't work when displayed on registry.terraform.io

## Motivation and Context
It fixes broken links on the terraform registry

## Breaking Changes
No

## How Has This Been Tested?
Not

---

Choice A:
modules/vpc-endpoints/README.md
@@ -4,7 +4,7 @@ Terraform sub-module which creates VPC endpoint resources on AWS.

 ## Usage

-See [`examples`](../../examples) directory for working examples to reference:
+See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples) directory for working examples to reference:

 ```hcl
 module "endpoints" {
@@ -48,7 +48,7 @@ module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete) with VPC Endpoints.
+- [Complete-VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ "endpoints" +4,7 @@ Terraform sub-module which creates VPC endpoint resources on AWS.

 ## Usage

-See [`examples`](../../examples) directory for working examples to reference:
+See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples) directory for working examples to reference:

 ```hcl
 module "endpoints" {
@@ -48,7 +48,7 @@ module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete) with VPC Endpoints.
+- [Complete-VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -4,7 +4,7 @@ Terraform sub-module which creates VPC endpoint resources on AWS.
 examples ## Usage

-See [`examples`](../../examples) directory for working examples to reference:
+See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples) directory for working examples to reference:

 ```hcl
 module "endpoints" {
@@ -48,7 +48,7 @@ module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete) with VPC Endpoints.
+- [Complete-VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -4,7 +4,7 @@ Terraform sub-module which creates VPC endpoint resources on AWS.

 ## Usage

-See [`examples`](../../examples) directory for working examples to reference:
+See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples) directory for working examples to reference:

 ```hcl
 module "endpoints" {
@@ -48,7 +48,7 @@ -->
 "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete) with VPC Endpoints.
+- [Complete-VPC](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
[![workerB](https://img.shields.io/endpoint?url=https%3A%2F%2Fworkerb.linearb.io%2Fv2%2Fbadge%2Fprivate%2FU2FsdGVkX1iSrZIVuY7sz5uqF4rYvPLyDQjEzY5Q%2Fcollaboration.svg%3FcacheSeconds%3D60)](https://workerb.linearb.io/v2/badge/collaboration-page?magicLinkId=18FxihP)

## Description
This pull request updates the `customer_gateways` variable to use an object type instead of `any`, as outlined in Terraform's best practices. By providing an object structure for `map`, the configuration becomes clearer and easier to validate, leading to more predictable outcomes.

Official : https://developer.hashicorp.com/terraform/language/expressions/type-constraints#dynamic-types-the-any-constraint

## Motivation and Context
- Simplifies and standardizes the expected structure of customer gateways.
- Ensures that important attributes like `bgp_asn` and `ip_address` are consistently provided.
- Replaces the `any` type, which is discouraged due to the absence of specific typing.

## Breaking Changes
- Existing configurations must ensure that all required attributes are specified according to the new object structure.
- If users haven't explicitly provided the required data (`bgp_asn` and `ip_address`), they will encounter validation errors during deployment.
- Additionally, any optional attributes that are left out will default to `null` or another specified default value, which should be accounted for in downstream logic.
- Users should review their existing `customer_gateways` definitions and update them to match the new object structure to ensure successful deployment.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` projects to verify this change.
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects:
  - **Example 1:** examples/complete

- [ ] I have executed `pre-commit run -a` on this pull request to ensure compliance.
- [ ] I have verified these changes do not introduce breaking errors in deployment.

<!--
Users should update at least one of the existing example projects, deploy it, and compare their changes against the initial state.
This will help highlight any breaking/disruptive changes. Once changes are reviewed, they should be tested for verification.
Please refer to the pre-commit instructions here: https://github.com/antonbabenko/pre-commit-terraform#how-to-install
-->

---

Choice A:
main.tf
@@ -1131,8 +1131,8 @@ resource "aws_route" "private_dns64_nat_gateway" {
 resource "aws_customer_gateway" "this" {
   for_each = var.customer_gateways

-  bgp_asn     = each.value["bgp_asn"]
-  ip_address  = each.value["ip_address"]
+  bgp_asn     = each.value.bgp_asn
+  ip_address  = each.value.ip_address
   device_name = lookup(each.value, "device_name", null)
   type        = "ipsec.1"

---
variables.tf
@@ -1240,8 +1240,12 @@ variable "nat_eip_tags" {

 variable "customer_gateways" {
   description = "Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)"
-  type        = map(map(any))
-  default     = {}
+  type = map(object({
+    bgp_asn     = number           # Required
+    ip_address  = string           # Required
+    device_name = optional(string) # Optional
+  }))
+  default = {}
 }

 variable "customer_gateway_tags" {
---

---

Choice B:
main.tf
@@ -1131,8 +1131,8 @@ resource "aws_route" "private_dns64_nat_gateway" {
 resource "aws_customer_gateway" "this" {
   for_each = var.customer_gateways

-  bgp_asn     = each.value["bgp_asn"]
-  ip_address  = each.value["ip_address"]
+  bgp_asn     = each.value.bgp_asn
+  ip_address  = each.value.ip_address
   device_name = lookup(each.value, "device_name", null)
   type        = "ipsec.1"

---
variables.tf
@@ -1240,8 +1240,12 @@ variable "nat_eip_tags" {

 variable "customer_gateways" {
   description = "Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)"
-  type        = map(map(any))
-  default     = {}
+  type = map(object({
+    bgp_asn     = number           # Required
+    ip_address  = string           # Required
+    device_name = optional(string) # Optional
+  }))
+  default = {}
 }

 variable "customer_gateway_tags" {
---

---

Choice C:
main.tf
@@ -1131,8 +1131,8 @@ resource "aws_route" "private_dns64_nat_gateway" {
 resource "aws_customer_gateway" "this" {
   for_each = var.customer_gateways

-  bgp_asn     = each.value["bgp_asn"]
-  ip_address  = each.value["ip_address"]
+  bgp_asn     = each.value.bgp_asn
+  ip_address  = each.value.ip_address
   device_name = lookup(each.value, "device_name", null)
   type        = "ipsec.1"

---
variables.tf
@@ -1240,8 +1240,12 @@ variable "nat_eip_tags" {

 variable "customer_gateways" {
   description = "Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)"
-  type        = map(map(any))
-  default     = {}
+  type = map(object({
+    bgp_asn     = number           # Required
+    ip_address  = string           # Required
+    device_name = optional(string) # Optional
+  }))
+  default =  }

 variable "customer_gateway_tags" {
---

---

Choice D:
main.tf
@@ -1131,8 +1131,8 @@ resource "aws_route" "private_dns64_nat_gateway" {
 resource "aws_customer_gateway" "this" {
   for_each = var.customer_gateways

-  bgp_asn     = each.value["bgp_asn"]
-  ip_address  = each.value["ip_address"]
+  bgp_asn     = each.value.bgp_asn
+  ip_address  = each.value.ip_address
   device_name = resource "device_name", null)
   type        = "ipsec.1"

---
variables.tf
@@ -1240,8 +1240,12 @@ variable "nat_eip_tags" {

 variable "customer_gateways" {
   description = "Maps of Customer Gateway's attributes (BGP ASN and Gateway's Internet-routable external IP address)"
-  type        = map(map(any))
-  default     = {}
+  type = map(object({
+    bgp_asn     = number           # Required
+    ip_address  = string           # Required
+    device_name = optional(string) # Optional
+  }))
+  default = {}
 }

 variable "customer_gateway_tags" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
**Shortcut Story:** _https://app.shortcut.com/slicelife/story/512522/update-node-js-16-actions-are-deprecated_

## Issue / Motivation

Node.js 16 actions are deprecated, needs to be updated

## Changes

This PR is implementing the following changes:

1. update hashicorp/setup-terraform@v1 to v3.0.0
2. update actions/setup-python@v2 to v5.1.0
3. actions/checkout@v2 to v4

---

Choice A:
.github/workflows/pre-commit.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Build matrix
         id: matrix
         run: |
@@ -33,16 +33,16 @@ jobs:
         directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
         with:
           directory: ${{ matrix.directory }}
       - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ steps.minMax.outputs.minVersion }}
       - name: Install pre-commit dependencies
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
@@ -81,11 +81,11 @@ jobs:
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Install Terraform v${{ matrix.version }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ matrix.version }}
       - name: Install pre-commit dependencies
---

---

Choice B:
.github/workflows/pre-commit.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Build matrix
         id: matrix
         run: |
@@ -33,16 +33,16 @@ jobs:
         directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
         with:
           directory: ${{ matrix.directory }}
       - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ steps.minMax.outputs.minVersion }}
       - name: Install pre-commit dependencies
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
@@ -81,11 +81,11 @@ jobs:
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Install Terraform v${{ matrix.version }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ matrix.version }}
       - name: Install pre-commit dependencies
---

---

Choice C:
.github/workflows/pre-commit.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Build matrix
         id: matrix
         run: |
@@ -33,16 +33,16 @@ jobs:
         directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
         with:
           directory: ${{ matrix.directory }}
       - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ steps.minMax.outputs.minVersion }}
       - name: Install pre-commit dependencies
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
@@ -81,11 +81,11 @@ jobs:
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Install Terraform v${{ matrix.version }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ matrix.version }}
       - name: Install pre-commit dependencies
---

---

Choice D:
.github/workflows/pre-commit.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Build matrix
         id: matrix
         run: |
@@ -33,16 +33,16 @@ jobs:
         directory: ${{ fromJson(needs.getDirectories.outputs.directories) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
         with:
           directory: ${{ matrix.directory }}
       - name: Install Terraform v${{ steps.minMax.outputs.minVersion }}
-        uses: steps:
        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ steps.minMax.outputs.minVersion }}
       - name: Install pre-commit dependencies
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Terraform min/max versions
         id: minMax
         uses: clowdhaus/terraform-min-max@v1.0.2
@@ -81,11 +81,11 @@ jobs:
           - ${{ needs.getBaseVersion.outputs.maxVersion }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.1.0
       - name: Install Terraform v${{ matrix.version }}
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3.0.0
         with:
           terraform_version: ${{ matrix.version }}
       - name: Install pre-commit dependencies
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
fixes #1060

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -118,6 +118,10 @@ Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to

 You can add additional tags with `intra_subnet_tags` as with other subnet types.

+## private NAT solution to address IP exhaustion
+
+If you need to setup overlapping CIDR ranges in your VPCs to prevent IP exhaustion and need internet access inside your private subnets. You will need to define fully private NAT gateways. Please refer to the AWS page defining the solution [here](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/private-nat-gateway.html) for more details. You can enable this by defining private subnets inside the non routable IP address range while setuping the NAT gateways in the routable IP address range and enabling the private mode by defining the connectivity type to `private`.
+
 ## VPC Flow Log

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
---
main.tf
@@ -1068,6 +1068,11 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  connectivity_type                  = var.nat_gateway_connectivity_type
+  private_ip                         = var.use_nat_gateway_private_ips ? var.nat_gateway_private_ips[count.index] : null
+  secondary_private_ip_address_count = var.use_nat_gateway_secondary_private_ip_addresses ? length(var.nat_gateway_secondary_private_ip_addresses) : null
+  secondary_private_ip_addresses     = var.use_nat_gateway_secondary_private_ip_addresses ? var.nat_gateway_secondary_private_ip_addresses[count.index] : null
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1210,6 +1210,36 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_connectivity_type" {
+  description = "Connectivity type for the NAT Gateway"
+  type        = string
+  default     = "public"
+}
+
+variable "use_nat_gateway_private_ips" {
+  description = "Should be true if you want to assign specific IPv4 addresses to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_private_ips" list(list(string))
+  description = "The private IPv4 address to assign to the NAT Gateways"
+  type        = list(string)
+  default     = []
+}
+
+variable "use_nat_gateway_secondary_private_ip_addresses" {
+  description = "Should be true if you want to assign private secondary IPv4 lists to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_secondary_private_ip_addresses" {
+  description = "List of secondary IPv4 address lists to assign to the NAT gateways"
+  type        = list(list(string))
+  default     = []
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice B:
README.md
@@ -118,6 +118,10 @@ Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to

 You can add additional tags with `intra_subnet_tags` as with other subnet types.

+## private NAT solution to address IP exhaustion
+
+If you need to setup overlapping CIDR ranges in your VPCs to prevent IP exhaustion and need internet access inside your private subnets. You will need to define fully private NAT gateways. Please refer to the AWS page defining the solution [here](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/private-nat-gateway.html) for more details. You can enable this by defining private subnets inside the non routable IP address range while setuping the NAT gateways in the routable IP address range and enabling the private mode by defining the connectivity type to `private`.
+
 ## VPC Flow Log

 VPC Flow Log allows to capture IP traffic for Elastic specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
---
main.tf
@@ -1068,6 +1068,11 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  connectivity_type                  = var.nat_gateway_connectivity_type
+  private_ip                         = var.use_nat_gateway_private_ips ? var.nat_gateway_private_ips[count.index] : null
+  secondary_private_ip_address_count = var.use_nat_gateway_secondary_private_ip_addresses ? length(var.nat_gateway_secondary_private_ip_addresses) : null
+  secondary_private_ip_addresses     = var.use_nat_gateway_secondary_private_ip_addresses ? var.nat_gateway_secondary_private_ip_addresses[count.index] : null
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1210,6 +1210,36 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_connectivity_type" {
+  description = "Connectivity type for the NAT Gateway"
+  type        = string
+  default     = "public"
+}
+
+variable "use_nat_gateway_private_ips" {
+  description = "Should be true if you want to assign specific IPv4 addresses to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_private_ips" {
+  description = "The private IPv4 address to assign to the NAT Gateways"
+  type        = list(string)
+  default     = []
+}
+
+variable "use_nat_gateway_secondary_private_ip_addresses" {
+  description = "Should be true if you want to assign private secondary IPv4 lists to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_secondary_private_ip_addresses" {
+  description = "List of secondary IPv4 address lists to assign to the NAT gateways"
+  type        = list(list(string))
+  default     = []
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice C:
README.md
@@ -118,6 +118,10 @@ Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to

 You can add additional tags with `intra_subnet_tags` as with other subnet types.

+## private NAT solution to address IP exhaustion
+
+If you need to setup overlapping CIDR ranges in your VPCs to prevent IP exhaustion and need internet access inside your private subnets. You will need to define fully private NAT gateways. Please refer to the AWS page defining the solution [here](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/private-nat-gateway.html) for more details. You can enable this by defining private subnets inside the non routable IP address range while setuping the NAT gateways in the routable IP address range and enabling the private mode by defining the connectivity type to `private`.
+
 ## VPC Flow Log

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
---
main.tf
@@ -1068,6 +1068,11 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  connectivity_type                  = var.nat_gateway_connectivity_type
+  private_ip                         = var.use_nat_gateway_private_ips ? var.nat_gateway_private_ips[count.index] : null
+  secondary_private_ip_address_count = var.use_nat_gateway_secondary_private_ip_addresses ? length(var.nat_gateway_secondary_private_ip_addresses) : null
+  secondary_private_ip_addresses     = var.use_nat_gateway_secondary_private_ip_addresses ? var.nat_gateway_secondary_private_ip_addresses[count.index] : null
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1210,6 +1210,36 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_connectivity_type" {
+  description = "Connectivity type for the NAT Gateway"
+  type        = string
+  default     = "public"
+}
+
+variable "use_nat_gateway_private_ips" {
+  description = "Should be true if you want to assign specific IPv4 addresses to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_private_ips" {
+  description = "The private IPv4 address to assign to the NAT Gateways"
+  type        = list(string)
+  default     = []
+}
+
+variable "use_nat_gateway_secondary_private_ip_addresses" {
+  description = "Should be true if you want to assign private secondary IPv4 lists to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_secondary_private_ip_addresses" {
+  description = "List of secondary IPv4 address lists to assign to the NAT gateways"
+  type        = list(list(string))
+  default     = []
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice D:
README.md
@@ -118,6 +118,10 @@ Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to

 You can add additional tags with `intra_subnet_tags` as with other subnet types.

+## private NAT solution to address IP exhaustion
+
+If you need to setup overlapping CIDR ranges in your VPCs to prevent IP exhaustion and need internet access inside your private subnets. You will need to define fully private NAT gateways. Please refer to the AWS page defining the solution [here](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/private-nat-gateway.html) for more details. You can enable this by defining private subnets inside the non routable IP address range while setuping the NAT gateways in the routable IP address range and enabling the private mode by defining the connectivity type to `private`.
+
 ## VPC Flow Log

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).
---
main.tf
@@ -1068,6 +1068,11 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  connectivity_type                  = var.nat_gateway_connectivity_type
+  private_ip                         = var.use_nat_gateway_private_ips ? var.nat_gateway_private_ips[count.index] : null
+  secondary_private_ip_address_count = var.use_nat_gateway_secondary_private_ip_addresses ? length(var.nat_gateway_secondary_private_ip_addresses) : null
+  secondary_private_ip_addresses     = var.use_nat_gateway_secondary_private_ip_addresses ? var.nat_gateway_secondary_private_ip_addresses[count.index] : null
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1210,6 +1210,36 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_connectivity_type" {
+  description = "Connectivity type for the NAT Gateway"
+  type        = string
+  default     = "public"
+}
+
+variable "use_nat_gateway_private_ips" {
+  description = "Should be true if you want to assign specific IPv4 addresses to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_private_ips" {
+  description = "The private IPv4 address to assign to the NAT Gateways"
+  type        = list(string)
+  default     = []
+}
+
+variable "use_nat_gateway_secondary_private_ip_addresses" {
+  description = "Should be true if you want to assign private secondary IPv4 lists to the NAT gateways"
+  type        = bool
+  default     = false
+}
+
+variable "nat_gateway_secondary_private_ip_addresses" {
+  description = "List of secondary IPv4 address lists to assign to the NAT gateways"
+  type        = list(list(string))
+  default     = []
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Enable the feature described in https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1065

## Motivation and Context
[Issue: https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1065](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1065)

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -66,7 +66,7 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 ## NAT Gateway Scenarios

-This module supports three scenarios for `null` NAT gateways. Each will be explained in further detail in the corresponding sections.
+This module supports four scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

 - One NAT Gateway per subnet (default behavior)
   - `enable_nat_gateway = true`
@@ -80,8 +80,13 @@ This module supports three scenarios for creating NAT gateways. Each will be exp
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+- Custom amount of NAT Gateways
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - `nat_gateways = 3`

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence. Likewise if both `one_nat_gateway_per_az` and `nat_gateways` are set, `one_nat_gateway_per_az` takes precedence. If all three of `single_nat_gateway`, `one_nat_gateway_per_az`, and `nat_gateways` are set, `single_nat_gateway` takes precedence.

 ### One NAT Gateway per subnet (default)

@@ -494,6 +499,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateways](#input\_nat\_gateways) | Pass the amount of public NAT gateways you would like to create. | `number` | `1` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -52,7 +52,8 @@ module "vpc" {
   enable_dns_support   = true

   enable_nat_gateway = true
-  single_nat_gateway = true
+  single_nat_gateway = false
+  nat_gateways       = 3

   customer_gateways = {
     IP1 = {
---
main.tf
@@ -1033,7 +1033,7 @@ resource "aws_route" "private_ipv6_egress" {
 ################################################################################

 locals {
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : var.nat_gateways
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
 }

---
variables.tf
@@ -1192,6 +1192,17 @@ variable "one_nat_gateway_per_az" {
   default     = false
 }

+variable "nat_gateways" {
+  description = "Pass the amount of public NAT gateways you would like to create."
+  type        = number
+  default     = 1
+
+  validation {
+    condition     = var.nat_gateways > 0
+    error_message = "Must be greater than 0."
+  }
+}
+
 variable "reuse_nat_ips" {
   description = "Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable"
   type        = bool
---

---

Choice B:
README.md
@@ -66,7 +66,7 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 ## NAT Gateway Scenarios

-This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.
+This module supports four scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

 - One NAT Gateway per subnet (default behavior)
   - `enable_nat_gateway = true`
@@ -80,8 +80,13 @@ This module supports three scenarios for creating NAT gateways. Each will be exp
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+- Custom amount of NAT Gateways
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - `nat_gateways = 3`

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence. Likewise if both `one_nat_gateway_per_az` and `nat_gateways` are set, `one_nat_gateway_per_az` takes precedence. If all three of `single_nat_gateway`, `one_nat_gateway_per_az`, and `nat_gateways` are set, `single_nat_gateway` takes precedence.

 ### One NAT Gateway per subnet (default)

@@ -494,6 +499,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateways](#input\_nat\_gateways) | Pass the amount of public NAT gateways you would like to create. | `number` | `1` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -52,7 +52,8 @@ module "vpc" {
   enable_dns_support   = true

   enable_nat_gateway = true
-  single_nat_gateway = true
+  single_nat_gateway = false
+  nat_gateways       = 3

   customer_gateways = {
     IP1 = {
---
main.tf
@@ -1033,7 +1033,7 @@ resource "aws_route" "private_ipv6_egress" {
 ################################################################################

 locals {
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : var.nat_gateways
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
 }

---
variables.tf
@@ -1192,6 +1192,17 @@ variable "one_nat_gateway_per_az" {
   default     = false
 }

+variable "nat_gateways" {
+  description = "Pass the amount of public NAT gateways you would like to create."
+  type        = number
+  default     = 1
+
+  validation {
+    condition     = var.nat_gateways > 0
+    error_message = "Must be greater than 0."
+  }
+}
+
 variable "reuse_nat_ips" {
   description = "Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable"
   type        = bool
---

---

Choice C:
README.md
@@ -66,7 +66,7 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 ## NAT Gateway Scenarios

-This be supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.
+This module supports four scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

 - One NAT Gateway per subnet (default behavior)
   - `enable_nat_gateway = true`
@@ -80,8 +80,13 @@ This module supports three scenarios for creating NAT gateways. Each will be exp
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+- Custom amount of NAT Gateways
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - `nat_gateways = 3`

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence. Likewise if both `one_nat_gateway_per_az` and `nat_gateways` are set, `one_nat_gateway_per_az` takes precedence. If all three of `single_nat_gateway`, `one_nat_gateway_per_az`, and `nat_gateways` are set, `single_nat_gateway` takes precedence.

 ### One NAT Gateway per subnet (default)

@@ -494,6 +499,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateways](#input\_nat\_gateways) | Pass the amount of public NAT gateways you would like to create. | `number` | `1` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -52,7 +52,8 @@ module "vpc" {
   enable_dns_support   = true

   enable_nat_gateway = true
-  single_nat_gateway = true
+  single_nat_gateway = false
+  nat_gateways       = 3

   customer_gateways = {
     IP1 = {
---
main.tf
@@ -1033,7 +1033,7 @@ resource "aws_route" "private_ipv6_egress" {
 ################################################################################

 locals {
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : var.nat_gateways
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
 }

---
variables.tf
@@ -1192,6 +1192,17 @@ variable "one_nat_gateway_per_az" {
   default     = false
 }

+variable "nat_gateways" {
+  description = "Pass the amount of public NAT gateways you would like to create."
+  type        = number
+  default     = 1
+
+  validation {
+    condition     = var.nat_gateways > 0
+    error_message = "Must be greater than 0."
+  }
+}
+
 variable "reuse_nat_ips" {
   description = "Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable"
   type        = bool
---

---

Choice D:
README.md
@@ -66,7 +66,7 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 ## NAT Gateway Scenarios

-This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.
+This module supports four scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

 - One NAT Gateway per subnet (default behavior)
   - `enable_nat_gateway = true`
@@ -80,8 +80,13 @@ This module supports three scenarios for creating NAT gateways. Each will be exp
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+- Custom amount of NAT Gateways
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - `nat_gateways = 3`

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence. Likewise if both `one_nat_gateway_per_az` and `nat_gateways` are set, `one_nat_gateway_per_az` takes precedence. If all three of `single_nat_gateway`, `one_nat_gateway_per_az`, and `nat_gateways` are set, `single_nat_gateway` takes precedence.

 ### One NAT Gateway per subnet (default)

@@ -494,6 +499,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateways](#input\_nat\_gateways) | Pass the amount of public NAT gateways you would like to create. | `number` | `1` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -52,7 +52,8 @@ module "vpc" {
   enable_dns_support   = true

   enable_nat_gateway = true
-  single_nat_gateway = true
+  single_nat_gateway = false
+  nat_gateways       = 3

   customer_gateways = {
     IP1 = {
---
main.tf
@@ -1033,7 +1033,7 @@ resource "aws_route" "private_ipv6_egress" {
 ################################################################################

 locals {
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  {
 = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : var.nat_gateways
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
 }

---
variables.tf
@@ -1192,6 +1192,17 @@ variable "one_nat_gateway_per_az" {
   default     = false
 }

+variable "nat_gateways" {
+  description = "Pass the amount of public NAT gateways you would like to create."
+  type        = number
+  default     = 1
+
+  validation {
+    condition     = var.nat_gateways > 0
+    error_message = "Must be greater than 0."
+  }
+}
+
 variable "reuse_nat_ips" {
   description = "Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
database/redshift/elasticache subnets can use private route tables.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
- https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/944

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -218,7 +218,8 @@ resource "aws_network_acl_rule" "public_outbound" {
 ################################################################################

 locals {
-  create_private_subnets = local.create_vpc && local.len_private_subnets > 0
+  create_private_subnets     = local.create_vpc && local.len_private_subnets > 0
+  create_private_route_table = (local.create_private_subnets && local.max_subnet_length > 0) || (local.create_database_subnets && !local.create_database_route_table) || (local.create_redshift_subnets && !local.create_redshift_route_table) || (local.create_elasticache_subnets && !local.create_elasticache_route_table)
 }

 resource "aws_subnet" "private" {
@@ -251,7 +252,7 @@ resource "aws_subnet" "private" {

 # There are as many routing tables as the number of NAT gateways
 resource "aws_route_table" "private" {
-  count = local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = local.create_private_route_table ? local.nat_gateway_count : 0

   vpc_id = local.vpc_id

---

---

Choice B:
main.tf
@@ -218,7 +218,8 @@ resource "aws_network_acl_rule" "public_outbound" {
 ################################################################################

 locals {
-  create_private_subnets = local.create_vpc &&  > 0
+  create_private_subnets     = local.create_vpc && local.len_private_subnets > 0
+  create_private_route_table = (local.create_private_subnets && local.max_subnet_length > 0) || (local.create_database_subnets && !local.create_database_route_table) || (local.create_redshift_subnets && !local.create_redshift_route_table) || (local.create_elasticache_subnets && !local.create_elasticache_route_table)
 }

 resource "aws_subnet" "private" {
@@ -251,7 +252,7 @@ resource "aws_subnet" "private" {

 # There are as many routing tables as the number of NAT gateways
 resource "aws_route_table" "private" {
-  count = local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = local.create_private_route_table ? local.nat_gateway_count : 0

   vpc_id = local.vpc_id

---

---

Choice C:
main.tf
@@ -218,7 +218,8 @@ resource "aws_network_acl_rule" "public_outbound" {
 ################################################################################

 locals {
-  create_private_subnets = && && local.len_private_subnets > 0
+  create_private_subnets     = local.create_vpc && local.len_private_subnets > 0
+  create_private_route_table = (local.create_private_subnets && local.max_subnet_length > 0) || (local.create_database_subnets && !local.create_database_route_table) || (local.create_redshift_subnets && !local.create_redshift_route_table) || (local.create_elasticache_subnets && !local.create_elasticache_route_table)
 }

 resource "aws_subnet" "private" {
@@ -251,7 +252,7 @@ resource "aws_subnet" "private" {

 # There are as many routing tables as the number of NAT gateways
 resource "aws_route_table" "private" {
-  count = local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = local.create_private_route_table ? local.nat_gateway_count : 0

   vpc_id = local.vpc_id

---

---

Choice D:
local.nat_gateway_count -218,7 +218,8 @@ resource "aws_network_acl_rule" "public_outbound" {
 ################################################################################

 locals {
-  create_private_subnets = local.create_vpc && local.len_private_subnets > 0
+  create_private_subnets     = local.create_vpc && local.len_private_subnets > 0
+  create_private_route_table = (local.create_private_subnets && local.max_subnet_length > 0) || (local.create_database_subnets && !local.create_database_route_table) || (local.create_redshift_subnets && !local.create_redshift_route_table) || (local.create_elasticache_subnets && !local.create_elasticache_route_table)
 }

 resource "aws_subnet" "private" {
@@ -251,7 +252,7 @@ resource "aws_subnet" "private" {

 # There are as many routing tables as the number of NAT gateways
 resource "aws_route_table" "private" {
-  count = local.create_private_subnets && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = local.create_private_route_table ? local.nat_gateway_count : 0

   vpc_id = local.vpc_id

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Private IPv6 Egress routes are now only created when having at least a private subnet

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
Version 5.7.1 of the module solved the issue #1058 by limiting the amount of IPv6 egress routes created to the amount of NAT gateways provisioned (hence to the amount of Route Tables created).

However the condition that regulates the number of IPv6 egress routes created doesn't check if the creation of any private subnet is actually wanted

<!--- If it fixes an open issue, please link to the issue here. -->
- Resolves #1061

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.len_private_subnets > 0 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice B:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count :   count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.len_private_subnets > 0 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice C:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.len_private_subnets > 0 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice D:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? "::/0"
---
 : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.len_private_subnets > 0 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Fixes issue with routes creation for IPv6 private subnets when you have following setup:
```
  private_subnets = [
    "10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24",
    "10.0.3.0/24", "10.0.4.0/24", "10.0.5.0/24",
  ]

  private_subnet_ipv6_prefixes = [
    1, 2, 3,
    4, 5, 6
  ]
  enable_nat_gateway     = true
  single_nat_gateway     = false
  one_nat_gateway_per_az = true
  create_egress_only_igw = true
```

thanks to @RunCor399

## Motivation and Context
- Resolves #1058

## Breaking Changes
none

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [X] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

Before the change:
```
  # aws_route.private_ipv6_egress[0] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[1] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[2] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[3] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[4] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[5] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }
```

After the change:
```
  # aws_route.private_ipv6_egress[0] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[1] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }

  # aws_route.private_ipv6_egress[2] will be created
  + resource "aws_route" "private_ipv6_egress" {
      + destination_ipv6_cidr_block = "::/0"
      + egress_only_gateway_id      = (known after apply)
      + id                          = (known after apply)
      + instance_id                 = (known after apply)
      + instance_owner_id           = (known after apply)
      + network_interface_id        = (known after apply)
      + origin                      = (known after apply)
      + route_table_id              = (known after apply)
      + state                       = (known after apply)
    }
```

---

Choice A:
main.tf
@@ -1021,7 +1021,7 @@ "aws_route" "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.len_private_subnets : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice B:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.len_private_subnets : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0

   route_table_id
 = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice C:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 }

 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.len_private_subnets : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---

Choice D:
main.tf
@@ -1021,7 +1021,7 @@ resource "aws_egress_only_internet_gateway" "this" {
 &&
 resource "aws_route" "private_ipv6_egress" {
-  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.len_private_subnets : 0
+  count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 ? local.nat_gateway_count : 0

   route_table_id              = element(aws_route_table.private[*].id, count.index)
   destination_ipv6_cidr_block = "::/0"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

Adds feature to allow overriding for each `aws_vpc_endpoint` `service_name` property, but defaulting to data if not defined.

Additionally this allows users to use specify fips endpoints if needed.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
fixes #1054

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
N/A

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

Have a PR here for an example where this was tested using changes in my `.terraform` directory which I replicated in this fork.
https://github.com/defenseunicorns/terraform-aws-vpc/pull/113

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -24,7 +24,7 @@ resource "aws_vpc_endpoint" "this" {
   for_each = local.endpoints

   vpc_id            = var.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
+  service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -24,7 +24,7 @@ resource "aws_vpc_endpoint" "this" {
   for_each = local.endpoints

   vpc_id            = var.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
+  service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -24,7 +24,7 @@ resource "aws_vpc_endpoint" "this" {
   for_each = local.endpoints

   vpc_id            = var.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
+  service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
   vpc_endpoint_type = data.aws_vpc_endpoint_service.this[each.key].service_name)
 "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -24,7 +24,7 @@ resource "aws_vpc_endpoint" "this" {
   for_each = local.endpoints

   vpc_id            = var.vpc_id
-  service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
+  service_name      =  data.aws_vpc_endpoint_service.this[each.key].service_name)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adding new private subnets to an already deployed vpc module leads to the replacement of the nat gateways for all the subnets that already existing.

There is no reason to use the **try** function in that case.

## Motivation and Context
- https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/999
- https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1018

## Breaking Changes
none

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

Before the change

```
1 to add, 1 to destroy.

  # module.network.module.network.module.vpc.aws_nat_gateway.this[0] must be replaced
-/+ resource "aws_nat_gateway" "this" {
      ~ allocation_id        = "redacted-***" -> (known after apply) # forces replacement
      ~ association_id       = "redacted-***" -> (known after apply)
      ~ id                   = "redacted-***" -> (known after apply)
      ~ network_interface_id = "redacted-***" -> (known after apply)
      ~ private_ip           = "redacted-***" -> (known after apply)
      ~ public_ip            = "redacted-***" -> (known after apply)
        # (3 unchanged attributes hidden)
    }
```

After the change

```
1 to add, 0 to destroy.
```

---

Choice A:
main.tf
@@ -1034,7 +1034,7 @@ resource "aws_route" "private_ipv6_egress" {

 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
-  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
+  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
 }

 resource "aws_eip" "nat" {
---

---

Choice B:
main.tf
@@ -1034,7 +1034,7 @@ resource var.reuse_nat_ips "private_ipv6_egress" {

 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
-  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
+  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
 }

 resource "aws_eip" "nat" {
---

---

Choice C:
main.tf
@@ -1034,7 +1034,7 @@ resource "aws_route" "private_ipv6_egress" {

 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
-  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
+  var.single_nat_gateway   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
 }

 resource "aws_eip" "nat" {
---

---

Choice D:
main.tf
@@ -1034,7 +1034,7 @@ resource "aws_route" "private_ipv6_egress" {

 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az var.external_nat_ip_ids length(var.azs) : local.max_subnet_length
-  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : try(aws_eip.nat[*].id, [])
+  nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
 }

 resource "aws_eip" "nat" {
---

---