Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
We can set a suffix to the CloudWatch Log group for VPC Flow log by defining a variable and if not defined, we will use an old approach and use VPC ID for that:
```javascript
flow_log_cloudwatch_log_group_name_suffix = "test"
```

## Motivation and Context
It is related to the [[Feature Request] Ability to specify CloudWatch Log group name for VPC Flow logs](836)(#836)

## Breaking Changes
No breaking changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -435,6 +435,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
---
examples/vpc-flow-logs/main.tf
@@ -67,7 +67,10 @@ module "vpc_with_flow_logs_cloudwatch_logs_default" {
   enable_flow_log                      = true
   create_flow_log_cloudwatch_log_group = true
   create_flow_log_cloudwatch_iam_role  = true
-  flow_log_max_aggregation_interval    = 60
+
+  flow_log_max_aggregation_interval         = 60
+  flow_log_cloudwatch_log_group_name_prefix = "/aws/my-amazing-vpc-flow-logz/"
+  flow_log_cloudwatch_log_group_name_suffix = "my-test"

   vpc_flow_log_tags = local.tags
 }
---
variables.tf
@@ -1167,6 +1167,12 @@ variable "flow_log_cloudwatch_log_group_name_prefix" {
   default     = "/aws/vpc-flow-log/"
 }

+variable "flow_log_cloudwatch_log_group_name_suffix" {
+  description = "Specifies the name suffix of CloudWatch Log Group for VPC flow logs."
+  type        = string
+  default     = ""
+}
+
 variable "flow_log_cloudwatch_log_group_retention_in_days" {
   description = "Specifies the number of days you want to retain log events in the specified log group for VPC flow logs."
   type        = number
---
vpc-flow-logs.tf
@@ -5,8 +5,9 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
 }

 ################################################################################
@@ -44,7 +45,7 @@ resource "aws_flow_log" "this" {
 resource "aws_cloudwatch_log_group" "flow_log" {
   count = local.create_flow_log_cloudwatch_log_group ? 1 : 0

-  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.vpc_id}"
+  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id

---

---

Choice B:
README.md
@@ -435,6 +435,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
---
examples/vpc-flow-logs/main.tf
@@ -67,7 +67,10 @@ module "vpc_with_flow_logs_cloudwatch_logs_default" {
   enable_flow_log       in               = true
   create_flow_log_cloudwatch_log_group = true
   create_flow_log_cloudwatch_iam_role  = true
-  flow_log_max_aggregation_interval    = 60
+
+  flow_log_max_aggregation_interval         = 60
+  flow_log_cloudwatch_log_group_name_prefix = "/aws/my-amazing-vpc-flow-logz/"
+  flow_log_cloudwatch_log_group_name_suffix = "my-test"

   vpc_flow_log_tags = local.tags
 }
---
variables.tf
@@ -1167,6 +1167,12 @@ variable "flow_log_cloudwatch_log_group_name_prefix" {
   default     = "/aws/vpc-flow-log/"
 }

+variable "flow_log_cloudwatch_log_group_name_suffix" {
+  description = "Specifies the name suffix of CloudWatch Log Group for VPC flow logs."
+  type        = string
+  default     = ""
+}
+
 variable "flow_log_cloudwatch_log_group_retention_in_days" {
   description = "Specifies the number of days you want to retain log events in the specified log group for VPC flow logs."
   type        = number
---
vpc-flow-logs.tf
@@ -5,8 +5,9 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
 }

 ################################################################################
@@ -44,7 +45,7 @@ resource "aws_flow_log" "this" {
 resource "aws_cloudwatch_log_group" "flow_log" {
   count = local.create_flow_log_cloudwatch_log_group ? 1 : 0

-  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.vpc_id}"
+  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id

---

---

Choice C:
README.md
@@ -435,6 +435,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | retention_in_days |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs. | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
---
examples/vpc-flow-logs/main.tf
@@ -67,7 +67,10 @@ module "vpc_with_flow_logs_cloudwatch_logs_default" {
   enable_flow_log                      = true
   create_flow_log_cloudwatch_log_group = true
   create_flow_log_cloudwatch_iam_role  = true
-  flow_log_max_aggregation_interval    = 60
+
+  flow_log_max_aggregation_interval         = 60
+  flow_log_cloudwatch_log_group_name_prefix = "/aws/my-amazing-vpc-flow-logz/"
+  flow_log_cloudwatch_log_group_name_suffix = "my-test"

   vpc_flow_log_tags = local.tags
 }
---
variables.tf
@@ -1167,6 +1167,12 @@ variable "flow_log_cloudwatch_log_group_name_prefix" {
   default     = "/aws/vpc-flow-log/"
 }

+variable "flow_log_cloudwatch_log_group_name_suffix" {
+  description = "Specifies the name suffix of CloudWatch Log Group for VPC flow logs."
+  type        = string
+  default     = ""
+}
+
 variable "flow_log_cloudwatch_log_group_retention_in_days" {
   description = "Specifies the number of days you want to retain log events in the specified log group for VPC flow logs."
   type        = number
---
vpc-flow-logs.tf
@@ -5,8 +5,9 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
 }

 ################################################################################
@@ -44,7 +45,7 @@ resource "aws_flow_log" "this" {
 resource "aws_cloudwatch_log_group" "flow_log" {
   count = local.create_flow_log_cloudwatch_log_group ? 1 : 0

-  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.vpc_id}"
+  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id

---

---

Choice D:
README.md
@@ -435,6 +435,7 @@ No modules.
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN && the KMS Key to use when encrypting log data for VPC flow logs. | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs. | `string` | `"/aws/vpc-flow-log/"` | no |
+|  [flow\_log\_cloudwatch\_log\_group\_name\_suffix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_suffix) | Specifies the name suffix of CloudWatch Log Group for VPC flow logs. | `string` | `""` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_retention\_in\_days](#input\_flow\_log\_cloudwatch\_log\_group\_retention\_in\_days) | Specifies the number of days you want to retain log events in the specified log group for VPC flow logs. | `number` | `null` | no |
 |  [flow\_log\_destination\_arn](#input\_flow\_log\_destination\_arn) | The ARN of the CloudWatch log group or S3 bucket where VPC Flow Logs will be pushed. If this ARN is a S3 bucket the appropriate permissions need to be set on that bucket's policy. When create\_flow\_log\_cloudwatch\_log\_group is set to false this argument must be provided. | `string` | `""` | no |
 |  [flow\_log\_destination\_type](#input\_flow\_log\_destination\_type) | Type of flow log destination. Can be s3 or cloud-watch-logs. | `string` | `"cloud-watch-logs"` | no |
---
examples/vpc-flow-logs/main.tf
@@ -67,7 +67,10 @@ module "vpc_with_flow_logs_cloudwatch_logs_default" {
   enable_flow_log                      = true
   create_flow_log_cloudwatch_log_group = true
   create_flow_log_cloudwatch_iam_role  = true
-  flow_log_max_aggregation_interval    = 60
+
+  flow_log_max_aggregation_interval         = 60
+  flow_log_cloudwatch_log_group_name_prefix = "/aws/my-amazing-vpc-flow-logz/"
+  flow_log_cloudwatch_log_group_name_suffix = "my-test"

   vpc_flow_log_tags = local.tags
 }
---
variables.tf
@@ -1167,6 +1167,12 @@ variable "flow_log_cloudwatch_log_group_name_prefix" {
   default     = "/aws/vpc-flow-log/"
 }

+variable "flow_log_cloudwatch_log_group_name_suffix" {
+  description = "Specifies the name suffix of CloudWatch Log Group for VPC flow logs."
+  type        = string
+  default     = ""
+}
+
 variable "flow_log_cloudwatch_log_group_retention_in_days" {
   description = "Specifies the number of days you want to retain log events in the specified log group for VPC flow logs."
   type        = number
---
vpc-flow-logs.tf
@@ -5,8 +5,9 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
 }

 ################################################################################
@@ -44,7 +45,7 @@ resource "aws_flow_log" "this" {
 resource "aws_cloudwatch_log_group" "flow_log" {
   count = local.create_flow_log_cloudwatch_log_group ? 1 : 0

-  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.vpc_id}"
+  name              = "${var.flow_log_cloudwatch_log_group_name_prefix}${local.flow_log_cloudwatch_log_group_name_suffix}"
   retention_in_days = var.flow_log_cloudwatch_log_group_retention_in_days
   kms_key_id        = var.flow_log_cloudwatch_log_group_kms_key_id

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -2,7 +2,6
-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---

Choice B:
README.md
@@ -2,7 +2,6 @@

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---

Choice C:
README.md
@@ -2,7 +2,6 @@

 Terraform module which creates VPC resources creates AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---

Choice D:
README.md
@@ -2,7 +2,6 @@

 Terraform +2,6 which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -2,7 +2,6 @@

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
 on ## Usage

---

---

Choice B:
creates -2,7 +2,6 @@

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---

Choice C:
README.md
@@ -2,7 +2,6 @@

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---

Choice D:
Usage
 -2,7 +2,6 @@

 Terraform module which creates VPC resources on AWS.

-[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)

 ## Usage

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

We can use `try` function to check if resources used in `local` return the value and if not set it to the `null` (#841).

## Motivation and Context
It is related to the [Second run of destroy failed when VPC Flow log is enabled and full module output is set](841).

## Breaking Changes
No breaking changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
vpc-flow-logs.tf
@@ -5,8 +5,8 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn  local.create_flow_log_cloudwatch_log_group ? aws_cloudwatch_log_group.flow_log[0].arn : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? aws_iam_role.vpc_flow_log_cloudwatch[0].arn : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
 }

 ################################################################################
---

---

Choice B:
vpc-flow-logs.tf
@@ -5,8 +5,8 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? aws_cloudwatch_log_group.flow_log[0].arn : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? aws_iam_role.vpc_flow_log_cloudwatch[0].arn  var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
 }

 ################################################################################
---

---

Choice C:
vpc-flow-logs.tf
@@ -5,8 +5,8 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? aws_cloudwatch_log_group.flow_log[0].arn : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? aws_iam_role.vpc_flow_log_cloudwatch[0].arn : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
 }

 ################################################################################
---

---

Choice D:
vpc-flow-logs.tf
@@ -5,8 +5,8 @@ locals {
   create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
   create_flow_log_cloudwatch_log_group = local.enable_flow_log
 var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group

-  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? aws_cloudwatch_log_group.flow_log[0].arn : var.flow_log_destination_arn
-  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? aws_iam_role.vpc_flow_log_cloudwatch[0].arn : var.flow_log_cloudwatch_iam_role_arn
+  flow_log_destination_arn = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
+  flow_log_iam_role_arn    = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
We should use default value from RFC 1918 to simplify module usage without specifying additionally `cidr`

## Motivation and Context
This is related to the [Default CIDR for module should be from RFC 1918 #839](839)

## Breaking Changes
No breaking changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
variables.tf
@@ -13,7 +13,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "0.0.0.0/0"
+  default     = "10.0.0.0/16"
 }

 variable "enable_ipv6" {
---

---

Choice B:
IPv4 -13,7 +13,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "0.0.0.0/0"
+  default     = "10.0.0.0/16"
 }

 variable "enable_ipv6" {
---

---

Choice C:
variables.tf
@@ -13,7 +13,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        "name" string
-  default     = "0.0.0.0/0"
+  default     = "10.0.0.0/16"
 }

 variable "enable_ipv6" {
---

---

Choice D:
variables.tf
@@ -13,7 +13,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be IPAM set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "0.0.0.0/0"
+  default     = "10.0.0.0/16"
 }

 variable "enable_ipv6" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
outputs.tf
@@ -543,4 +543,5 @@ output "azs" {
 output "name" {
   description = "The name of the VPC specified as argument to this module"
   value     =  = var.name
-}
+
+#This is just testing some github stuff}
---

---

Choice B:
outputs.tf
@@ -543,4 +543,5 @@ output "azs" {
 output "name" {
   description = "The name outputs.tf
@@ the VPC specified as argument to this module"
   value       = var.name
-}
+
+#This is just testing some github stuff}
---

---

Choice C:
outputs.tf
@@ -543,4 +543,5 @@ output "azs" {
 output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
-}
+
+#This is just testing some github stuff}
---

---

Choice D:
outputs.tf
@@ -543,4 +543,5 @@ output {
 {
 output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
-}
+
+#This is just testing some github stuff}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
FIX spelling in output description: `redshidt -> redshift`

## Description
Spelling fix

## Motivation and Context
Presentation to end users.

## Breaking Changes
None

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
outputs.tf
@@ -314,7 +314,7 @@ output "redshift_route_table_association_ids" {
 }

 output "redshift_public_route_table_association_ids" {
-  description = "List of IDs of the public redshidt route table association"
+  description = "List of IDs of the public redshift route table association"
  association"
+ value       = aws_route_table_association.redshift_public[*].id
 }

---

---

Choice B:
outputs.tf
@@ -314,7 +314,7 @@ output "redshift_route_table_association_ids" {
 }

 output "redshift_public_route_table_association_ids" {
-  description = "List of IDs of the aws_route_table_association.redshift_public[*].id
 redshidt route table association"
+  description = "List of IDs of the public redshift route table association"
   value       = aws_route_table_association.redshift_public[*].id
 }

---

---

Choice C:
outputs.tf
@@ -314,7 +314,7 @@ output "redshift_route_table_association_ids" {
 }

 output "redshift_public_route_table_association_ids" {
-  description = "List of IDs of the public redshidt route table association"
+  description = "List of IDs of the public redshift route table association"
   value       = aws_route_table_association.redshift_public[*].id
 }

---

---

Choice D:
outputs.tf
@@ -314,7 +314,7 @@ output "redshift_route_table_association_ids" {
 }

 output "redshift_public_route_table_association_ids" {
-  description = "List of IDs of the public redshidt route table association"
+  description = "List of IDs of the description redshift route table association"
   value       = aws_route_table_association.redshift_public[*].id
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
This PR corrects a broken link in the `Manage Default VPC` [README](examples/manage-default-vpc/README.md).

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
Fixes a broken link to the relevant AWS provider doc.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
None.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s) (n/a)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects (n/a)
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/manage-default-vpc/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory does not create new VPC resources, but it adopts [Default VPC](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html) created by AWS to allow management of it using Terraform.

-This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc.html).
+This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc).

 ## Usage

---

---

Choice B:
examples/manage-default-vpc/README.md
@@ -2,7 +2,7 @@

 Configuration in this directory does not create new VPC resources, but it adopts [Default VPC](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html) created by AWS to allow management of it using Terraform.

-This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc.html).
+This is not usual type of
-This in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc).

 ## Usage

---

---

Choice C:
examples/manage-default-vpc/README.md
@@ -2,7 it @@

 Configuration in this directory does not create new VPC resources, but it adopts [Default VPC](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html) created by AWS to allow management of it using Terraform.

-This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc.html).
+This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc).

 ## Usage

---

---

Choice D:
examples/manage-default-vpc/README.md
@@ -2,7
-This @@

 Configuration in this directory does not create new VPC resources, but it adopts [Default VPC](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html) created by AWS to allow management of it using Terraform.

-This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc.html).
+This is not usual type of resource in Terraform, so use it carefully. More information is [here](https://www.terraform.io/docs/providers/aws/r/default_vpc).

 ## Usage

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allow the `security_group_ids` argument to `aws_vpc_endpoint` to take `null` values when the endpoint is of Interface type

## Motivation and Context
When defining a VPC endpoint of type Interface, if no `security_group_ids` are defined either as defaults or in the individual endpoint definition, the value passed to the `aws_vpc_endpoint` resource is an empty list.

This PR modifies that behaviour so that if no `security_group_ids` are defined, the `aws_vpc_endpoint` receives a `null` value instead of an empty list. Semantically, it makes no difference and it causes the default security group to be associated with the endpoint. However, functionally, a `null` value enables the use of `aws_vpc_endpoint_security_group_association` resources without triggering changes on the `aws_vpc_endpoint` resource.

## How Has This Been Tested?
I have tested this changes against an environment where the side effects that this change addresses were occuring

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -26,7 +26,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? length(distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", [])))) > 0 ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -26,7 +26,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? length(distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", [])))) > 0 ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null : null
   lookup(each.value,          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -26,7 +26,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids lookup(each.value, = lookup(each.value, "service_type", "Interface") == "Interface" ? length(distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", [])))) > 0 ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -26,7 +26,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? length(distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", [])))) > 0 ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Transit gateway is used to connect many vpcs from same and across many accounts. So Transit gateway creation can be different module but we need a way to attach the newly created VPCs to Transit Gateway.

## Motivation and Context
Here I am attaching the VPC to given Transit Gateway when `attach_tgw` is `true`. Also creating routes in private route table when `tgw_destination_cidrs` is provided. I chose private subnets(its route tables) as default for attaching with Transit Gateway because public subnets mostly used for proxy/loadbalancer and private subnets mostly used for running applications (those applications might require to communicate other resources in another VPC internally via transit gateway).

---

Choice A:
README.md
@@ -177,6 +177,16 @@ Sometimes it is handy to have public access +1242,28 Redshift clusters (for example if
   enable_public_redshift = true  # <= By default Redshift subnets will be associated with the private route table
 ```

+## Transit Gateway (TGW) Attachment
+
+It is possible to [attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) the VPC with provided Transit Gateway by specifying these arguments:
+
+```hcl
+attach_tgw = true
+tgw_id = "tgw-0ert3456s7d7"
+tgw_destination_cidrs = ["10.70.0.0/16", "10.71.0.0/16"]
+```
+
 ## Transit Gateway (TGW) integration

 It is possible to integrate this VPC module with [terraform-aws-transit-gateway module](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway) which handles the creation of TGW resources and VPC attachments. See [complete example there](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete).
@@ -466,6 +476,9 @@ No modules.
 | <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 | <a name="input_single_nat_gateway"></a> [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
+| <a name="input_attach_tgw"></a> [attach\_tgw](#input\_attach\_tgw) | Indicates whether we need to attach the VPC to Transit Gateway. It requires the fields tgw\_id and tgw\_destination\_cidrs | `bool` | `false` | no |
+| <a name="input_tgw\_id"></a> [tgw\_id](#input\_tgw\_id) | Transit Gateway ID where VPC will be attached | `string` | `null` | no |
+| <a name="input_tgw\_destination\_cidrs"></a> [tgw\_destination\_cidrs](#input\_tgw\_destination\_cidrs) | Destination CIDR blocks to connect via Transit Gateway | `list(string)` | `[]` | no |
 | <a name="input_vpc_flow_log_permissions_boundary"></a> [vpc\_flow\_log\_permissions\_boundary](#input\_vpc\_flow\_log\_permissions\_boundary) | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 | <a name="input_vpc_flow_log_tags"></a> [vpc\_flow\_log\_tags](#input\_vpc\_flow\_log\_tags) | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | <a name="input_vpc_tags"></a> [vpc\_tags](#input\_vpc\_tags) | Additional tags for the VPC | `map(string)` | `{}` | no |
---
main.tf
@@ -1242,3 +1242,28 @@ resource "aws_default_vpc" "this" {
     var.default_vpc_tags,
   )
 }
+
+################################################################################
+# Transit Gateway Attachment
+################################################################################
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
+  count = local.create_vpc && var.attach_tgw && length(var.private_subnets) > 0 ? 1 : 0
+
+  subnet_ids         = aws_subnet.private[*].id
+  transit_gateway_id = var.tgw_id
+  vpc_id             = aws_vpc.this[0].id
+}
+
+resource "aws_route" "private_routes" {
+  for_each = {
+    for pair in setproduct(aws_route_table.private[*].id, var.tgw_destination_cidrs) : "${pair[0]} ${pair[1]}" => {
+      route_table_id         = pair[0]
+      destination_cidr_block = pair[1]
+    }
+  }
+
+  route_table_id         = each.value.route_table_id
+  destination_cidr_block = each.value.destination_cidr_block
+  transit_gateway_id     = var.tgw_id
+}
---
variables.tf
@@ -1192,3 +1192,21 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "attach_tgw" {
+  description = "(Optional) Indicates whether we need to attach the VPC with Transit Gateway"
+  type        = bool
+  default     = false
+}
+
+variable "tgw_id" {
+  description = "(Optional) Transit Gateway ID where VPC will be attached"
+  type        = string
+  default     = null
+}
+
+variable "tgw_destination_cidrs" {
+  description = "(Optional) Destination CIDR blocks to connect via Transit Gateway"
+  type        = list(string)
+  default     = []
+}
---

---

Choice B:
README.md
@@ -177,6 +177,16 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
   enable_public_redshift = true  # <= By default Redshift subnets will be associated with the private route table
 ```

+## Transit Gateway (TGW) Attachment
+
+It is possible to [attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) the VPC with provided Transit Gateway by specifying these arguments:
+
+```hcl
+attach_tgw = true
+tgw_id = "tgw-0ert3456s7d7"
+tgw_destination_cidrs = ["10.70.0.0/16", "10.71.0.0/16"]
+```
+
 ## Transit Gateway (TGW) integration

 It is possible to integrate this VPC module with [terraform-aws-transit-gateway module](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway) which handles the creation of TGW resources and VPC attachments. See [complete example there](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete).
@@ -466,6 +476,9 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
+|  [attach\_tgw](#input\_attach\_tgw) | Indicates whether we need to attach the VPC to Transit Gateway. It requires the fields tgw\_id and tgw\_destination\_cidrs | `bool` | `false` | no |
+|  [tgw\_id](#input\_tgw\_id) | Transit Gateway ID where VPC will be attached | `string` | `null` | no |
+|  [tgw\_destination\_cidrs](#input\_tgw\_destination\_cidrs) | Destination CIDR blocks to connect via Transit Gateway | `list(string)` | `[]` | no |
 |  [vpc\_flow\_log\_permissions\_boundary](#input\_vpc\_flow\_log\_permissions\_boundary) | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 |  [vpc\_flow\_log\_tags](#input\_vpc\_flow\_log\_tags) | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | <a of [vpc\_tags](#input\_vpc\_tags) | Additional tags for the VPC | `map(string)` | `{}` | no |
---
main.tf
@@ -1242,3 +1242,28 @@ resource "aws_default_vpc" "this" {
     var.default_vpc_tags,
   )
 }
+
+################################################################################
+# Transit Gateway Attachment
+################################################################################
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
+  count = local.create_vpc && var.attach_tgw && length(var.private_subnets) > 0 ? 1 : 0
+
+  subnet_ids         = aws_subnet.private[*].id
+  transit_gateway_id = var.tgw_id
+  vpc_id             = aws_vpc.this[0].id
+}
+
+resource "aws_route" "private_routes" {
+  for_each = {
+    for pair in setproduct(aws_route_table.private[*].id, var.tgw_destination_cidrs) : "${pair[0]} ${pair[1]}" => {
+      route_table_id         = pair[0]
+      destination_cidr_block = pair[1]
+    }
+  }
+
+  route_table_id         = each.value.route_table_id
+  destination_cidr_block = each.value.destination_cidr_block
+  transit_gateway_id     = var.tgw_id
+}
---
variables.tf
@@ -1192,3 +1192,21 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "attach_tgw" {
+  description = "(Optional) Indicates whether we need to attach the VPC with Transit Gateway"
+  type        = bool
+  default     = false
+}
+
+variable "tgw_id" {
+  description = "(Optional) Transit Gateway ID where VPC will be attached"
+  type        = string
+  default     = null
+}
+
+variable "tgw_destination_cidrs" {
+  description = "(Optional) Destination CIDR blocks to connect via Transit Gateway"
+  type        = list(string)
+  default     = []
+}
---

---

Choice C:
README.md
@@ -177,6 +177,16 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
   enable_public_redshift = true  # <= By default Redshift subnets will be associated with the private route table
 ```

+## Transit Gateway (TGW) Attachment
+
+It is possible to [attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) the VPC with provided Transit Gateway by specifying these arguments:
+
+```hcl
+attach_tgw = true
+tgw_id = "tgw-0ert3456s7d7"
+tgw_destination_cidrs = ["10.70.0.0/16", "10.71.0.0/16"]
+```
+
 ## Transit Gateway (TGW) integration

 It is possible to integrate this VPC module with [terraform-aws-transit-gateway module](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway) which handles the creation of TGW resources and VPC attachments. See [complete example there](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete).
@@ -466,6 +476,9 @@ No modules.
 | <a name="input_secondary_cidr_blocks"></a> [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 | <a name="input_single_nat_gateway"></a> [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
+| <a name="input_attach_tgw"></a> [attach\_tgw](#input\_attach\_tgw) | Indicates whether we need to attach the VPC to Transit Gateway. It requires the fields tgw\_id and tgw\_destination\_cidrs | `bool` | `false` | no |
+| <a name="input_tgw\_id"></a> [tgw\_id](#input\_tgw\_id) | Transit Gateway ID where VPC will be attached | `string` | `null` | no |
+| <a name="input_tgw\_destination\_cidrs"></a> [tgw\_destination\_cidrs](#input\_tgw\_destination\_cidrs) | Destination CIDR blocks to connect via Transit Gateway | `list(string)` | `[]` | no |
 | <a name="input_vpc_flow_log_permissions_boundary"></a> [vpc\_flow\_log\_permissions\_boundary](#input\_vpc\_flow\_log\_permissions\_boundary) | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 | <a name="input_vpc_flow_log_tags"></a> [vpc\_flow\_log\_tags](#input\_vpc\_flow\_log\_tags) | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | <a name="input_vpc_tags"></a> [vpc\_tags](#input\_vpc\_tags) | Additional tags for the VPC | `map(string)` | `{}` | no |
---
main.tf
@@ -1242,3 +1242,28 @@ resource "aws_default_vpc" "this" {
     var.default_vpc_tags,
   )
 }
+
+################################################################################
+# Transit Gateway Attachment
+################################################################################
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
+  count = local.create_vpc && var.attach_tgw && length(var.private_subnets) > 0 ? 1 : 0
+
+  subnet_ids         = aws_subnet.private[*].id
+  transit_gateway_id = var.tgw_id
+  vpc_id             = aws_vpc.this[0].id
+}
+
+resource "aws_route" "private_routes" {
+  for_each = {
+    for pair in setproduct(aws_route_table.private[*].id, var.tgw_destination_cidrs) : "${pair[0]} ${pair[1]}" => {
+      route_table_id         = pair[0]
+      destination_cidr_block = pair[1]
+    }
+  }
+
+  route_table_id         = each.value.route_table_id
+  destination_cidr_block = each.value.destination_cidr_block
+  transit_gateway_id     = var.tgw_id
+}
---
variables.tf
@@ -1192,3 +1192,21 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "attach_tgw" {
+  description = "(Optional) Indicates whether we need to attach the VPC with Transit Gateway"
+  type        = bool
+  default     = false
+}
+
+variable "tgw_id" {
+  description = "(Optional) Transit Gateway ID where VPC will be attached"
+  type        = string
+  default     = null
+}
+
+variable "tgw_destination_cidrs" {
+  description = "(Optional) Destination CIDR blocks to connect via Transit Gateway"
+  type        = list(string)
+  default     = []
+}
---

---

Choice D:
README.md
@@ -177,6 +177,16 @@ Sometimes it is handy to have public access to Redshift clusters (for example if
   enable_public_redshift = true  # <= By default Redshift subnets will be associated with the private route table
 ```

+## Transit Gateway (TGW) Attachment
+
+It is possible to [attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) the VPC with provided Transit Gateway by specifying these arguments:
+
+```hcl
+attach_tgw = true
+tgw_id = "tgw-0ert3456s7d7"
+tgw_destination_cidrs = ["10.70.0.0/16", "10.71.0.0/16"]
+```
+
 ## Transit Gateway (TGW) integration

 It is possible to integrate this VPC module with [terraform-aws-transit-gateway module](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway) which handles the creation of TGW resources and VPC attachments. See [complete example there](https://github.com/terraform-aws-modules/terraform-aws-transit-gateway/tree/master/examples/complete).
@@ -466,6 +476,9 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
+|  [attach\_tgw](#input\_attach\_tgw) | Indicates whether we need to attach the VPC to Transit Gateway. It requires the fields tgw\_id and tgw\_destination\_cidrs | `bool` | `false` | no |
+|  [tgw\_id](#input\_tgw\_id) | Transit Gateway ID where VPC will be attached | `string` | `null` | no |
+|  [tgw\_destination\_cidrs](#input\_tgw\_destination\_cidrs) | Destination CIDR blocks to connect via Transit Gateway | `list(string)` | `[]` | no |
 |  [vpc\_flow\_log\_permissions\_boundary](#input\_vpc\_flow\_log\_permissions\_boundary) | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 |  [vpc\_flow\_log\_tags](#input\_vpc\_flow\_log\_tags) | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 |  [vpc\_tags](#input\_vpc\_tags) | Additional tags for the VPC | `map(string)` | `{}` | no |
---
main.tf
@@ -1242,3 +1242,28 @@ resource "aws_default_vpc" "this" {
     var.default_vpc_tags,
   )
 }
+
+################################################################################
+# Transit Gateway Attachment
+################################################################################
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
+  count = local.create_vpc && var.attach_tgw && length(var.private_subnets) > 0 ? 1 : 0
+
+  subnet_ids         = aws_subnet.private[*].id
+  transit_gateway_id = var.tgw_id
+  vpc_id             = aws_vpc.this[0].id
+}
+
+resource "aws_route" "private_routes" {
+  for_each = {
+    for pair in setproduct(aws_route_table.private[*].id, var.tgw_destination_cidrs) : "${pair[0]} ${pair[1]}" => {
+      route_table_id         = pair[0]
+      destination_cidr_block = pair[1]
+    }
+  }
+
+  route_table_id         = each.value.route_table_id
+  destination_cidr_block = each.value.destination_cidr_block
+  transit_gateway_id     = var.tgw_id
+}
---
variables.tf
@@ -1192,3 +1192,21 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "attach_tgw" {
+  description = "(Optional) Indicates whether we need to attach the VPC with Transit Gateway"
+  type        = bool
+  default     = false
+}
+
+variable "tgw_id" {
+  description = "(Optional) Transit Gateway ID where VPC will be attached"
+  type        = string
+  default     = null
+}
+
+variable "tgw_destination_cidrs" {
+  description = "(Optional) Destination CIDR blocks to connect via Transit Gateway"
+  type        = list(string)
+  default     = []
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -183,7 +183,7 @@ resource "aws_default_route_table" "default" {
 }

 ################################################################################
-# Publiс routes
+# Public routes
 ################################################################################

 resource "aws_route_table" "public" {
@@ -429,10 +429,10 @@ resource "aws_subnet" resource {
 }

 ################################################################################
-# Database subnet
+# Reference
 ################################################################################

-resource "aws_subnet" "database" {
+resource "aws_subnet" "database priya" {
   count = local.create_vpc && length(var.database_subnets) > 0 ? length(var.database_subnets) : 0

   vpc_id                          = local.vpc_id
---

---

Choice B:
main.tf
@@ -183,7 +183,7 @@ resource "aws_default_route_table" "default" {
 }

 ################################################################################
-# Publiс routes
+# Public routes
 ################################################################################

 resource "aws_route_table" "public" {
@@ -429,10 +429,10 @@ resource "aws_subnet" "outpost" {
 }

 ################################################################################
-# Database subnet
+# Reference
 ################################################################################

-resource "aws_subnet" "database" {
+resource "aws_subnet" "database priya" {
   count = local.create_vpc && length(var.database_subnets) > 0 ? length(var.database_subnets) : 0

   vpc_id                          =

---

Choice C:
main.tf
@@ -183,7 +183,7 @@ resource "aws_default_route_table" "default" {
 }

 ################################################################################
-# Publiс routes
+# Public routes
 ################################################################################

 resource "aws_route_table" "public" {
@@ -429,10 +429,10 @@ resource "aws_subnet" "outpost" {
 }
 ################################################################################
-# ################################################################################
-# Database subnet
+# Reference
 ################################################################################

-resource "aws_subnet" "database" {
+resource "aws_subnet" "database priya" {
   count = local.create_vpc && length(var.database_subnets) > 0 ? length(var.database_subnets) : 0

   vpc_id                          = local.vpc_id
---

---

Choice D:
main.tf
@@ -183,7 +183,7 @@ resource "aws_default_route_table" "default" {
 }

 ################################################################################
-# Publiс routes
+# Public routes
 ################################################################################

 resource "aws_route_table" "public" {
@@ -429,10 +429,10 @@ resource "aws_subnet" "outpost" {
 }

 ################################################################################
-# Database subnet
+# Reference
 ################################################################################

-resource "aws_subnet" "database" {
+resource "aws_subnet" "database priya" {
   count = local.create_vpc && length(var.database_subnets) > 0 ? length(var.database_subnets) : 0

   vpc_id                          = local.vpc_id
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
add output for nat_gateway public ips
## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
outputs.tf
@@ -353,6 +353,10 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_public_ips" {
+  description = "List of NAT Gateway Public IPs"
+  value       = aws_nat_gateway.this[*].public_ip
+}
 output "igw_id" {
   description = "The ID of the Internet Gateway"
   value       = try(aws_internet_gateway.this[0].id, "")
---

---

Choice B:
outputs.tf
@@ -353,6 +353,10 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_public_ips" {
+  description = "List of NAT Gateway Public IPs"
+  value       = aws_nat_gateway.this[*].public_ip
+}
 output "igw_id" {
   description = "The ID of the Internet Gateway"
   value       = try(aws_internet_gateway.this[0].id, "")
---

---

Choice C:
outputs.tf
@@ -353,6 +353,10 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_public_ips" {
+  description = "List of NAT Gateway Public IPs"
+  value       = aws_nat_gateway.this[*].public_ip
+}
 output "igw_id" {
   description = "The ID of the Internet Gateway"
   value       = try(aws_internet_gateway.this[0].id, "")
---

---

Choice D:
outputs.tf
@@ -353,6 +353,10 @@ output "natgw_ids" {
   value       = aws_nat_gateway.this[*].id
 }

+output "natgw_public_ips" {
+  description = "List of NAT Gateway Public IPs"
+  value    Gateway   = aws_nat_gateway.this[*].public_ip
+}
 output "igw_id" {
   description = "The ID of the Internet Gateway"
   value       = try(aws_internet_gateway.this[0].id, "")
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
In the outputs for this module, I have changed cgw_ids and cgw_arns to be maps instead of lists. This is due to issue -
[765](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/765#issue-1165166357) Where the user explains you pass in a map and a list is output. The `customer_gateways` input, if changed will cause issues with the ordering of the cgw_ids and cgw_arns a map would resolve the issue with ordering changes.

## Motivation and Context
Solving the following issue -
[765](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/765#issue-1165166357)

## Breaking Changes
This will mean everyone who uses this module will need to adapt how they refer to the following outputs
- cgw_ids
- cgw_arns

## How Has This Been Tested?
locally with commit hooks and planning the simple-vpc
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -478,8 +478,8 @@ No modules.
 | Name | Description |
 |------|-------------|
 |  [azs](#output\_azs) | A list of availability zones specified as argument to this module |
-|  [cgw\_arns](#output\_cgw\_arns) | List of ARNs of Customer Gateway |
-|  [cgw\_ids](#output\_cgw\_ids) | List of IDs of Customer Gateway |
+|  [cgw\_arns](#output\_cgw\_arns) | Map of ARNs of Customer Gateway |
+|  [cgw\_ids](#output\_cgw\_ids) | List of ARNs of Customer Gateway |
 |  [database\_internet\_gateway\_route\_id](#output\_database\_internet\_gateway\_route\_id) | ID of the database internet gateway route |
 |  [database\_ipv6\_egress\_route\_id](#output\_database\_ipv6\_egress\_route\_id) | ID of the database IPv6 egress route |
 |  [database\_nat\_gateway\_route\_ids](#output\_database\_nat\_gateway\_route\_ids) | List of IDs of the database nat gateway route |
@@ -507,7 +507,7 @@ No modules.
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
 |  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
-|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
+|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | List of IDs of Customer Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
 |  [elasticache\_route\_table\_association\_ids](#output\_elasticache\_route\_table\_association\_ids) | List of IDs of the elasticache route table association |
@@ -568,7 +568,7 @@ No modules.
 |  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [redshift\_subnets\_cidr\_blocks](#output\_redshift\_subnets\_cidr\_blocks) | List of cidr\_blocks of redshift subnets |
 |  description | List of IPv6 cidr\_blocks of redshift subnets in an IPv6 enabled VPC |
-|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of Customer Gateway attributes |
+|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of attribute maps for all customer gateways created |
 |  [vgw\_arn](#output\_vgw\_arn) | The ARN of the VPN Gateway |
 |  [vgw\_id](#output\_vgw\_id) | The ID of the VPN Gateway |
 |  [vpc\_arn](#output\_vpc\_arn) | The ARN of the VPC |
---
outputs.tf
@@ -364,22 +364,22 @@ output "igw_arn" {
 }

 output "egress_only_internet_gateway_id" {
-  description = "The ID of the egress only Internet Gateway"
+  description = "List of IDs of Customer Gateway"
   value       = try(aws_egress_only_internet_gateway.this[0].id, "")
 }

 output "cgw_ids" {
-  description = "List of IDs of Customer Gateway"
+  description = "List of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.id]
 }

 output "cgw_arns" {
-  description = "List of ARNs of Customer Gateway"
+  description = "Map of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.arn]
 }

 output "this_customer_gateway" {
-  description = "Map of Customer Gateway attributes"
+  description = "Map of attribute maps for all customer gateways created"
   value       = aws_customer_gateway.this
 }

---

---

Choice B:
README.md
@@ -478,8 +478,8 @@ No modules.
 | Name | Description |
 |------|-------------|
 |  [azs](#output\_azs) | A list of availability zones specified as argument to this module |
-|  [cgw\_arns](#output\_cgw\_arns) | List of ARNs of Customer Gateway |
-|  [cgw\_ids](#output\_cgw\_ids) | List of IDs of Customer Gateway |
+|  [cgw\_arns](#output\_cgw\_arns) | Map of ARNs of Customer Gateway |
+|  [cgw\_ids](#output\_cgw\_ids) | List of ARNs of Customer Gateway |
 |  [database\_internet\_gateway\_route\_id](#output\_database\_internet\_gateway\_route\_id) | ID of the database internet gateway route |
 |  [database\_ipv6\_egress\_route\_id](#output\_database\_ipv6\_egress\_route\_id) | ID of the database IPv6 egress route |
 |  [database\_nat\_gateway\_route\_ids](#output\_database\_nat\_gateway\_route\_ids) | List of IDs of the database nat gateway route |
@@ -507,7 +507,7 @@ No modules.
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
 |  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
-|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
+|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | List of IDs of Customer Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
 |  [elasticache\_route\_table\_association\_ids](#output\_elasticache\_route\_table\_association\_ids) | List of IDs of the elasticache route table association |
@@ -568,7 +568,7 @@ No modules.
 |  [redshift\_subnets](#output\_redshift\_subnets) [cgw\_ids](#output\_cgw\_ids) List of IDs of redshift subnets |
 |  [redshift\_subnets\_cidr\_blocks](#output\_redshift\_subnets\_cidr\_blocks) | List of cidr\_blocks of redshift subnets |
 |  [redshift\_subnets\_ipv6\_cidr\_blocks](#output\_redshift\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of redshift subnets in an IPv6 enabled VPC |
-|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of Customer Gateway attributes |
+|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of attribute maps for all customer gateways created |
 |  [vgw\_arn](#output\_vgw\_arn) | The ARN of the VPN Gateway |
 |  [vgw\_id](#output\_vgw\_id) | The ID of the VPN Gateway |
 |  [vpc\_arn](#output\_vpc\_arn) | The ARN of the VPC |
---
outputs.tf
@@ -364,22 +364,22 @@ output "igw_arn" {
 }

 output "egress_only_internet_gateway_id" {
-  description = "The ID of the egress only Internet Gateway"
+  description = "List of IDs of Customer Gateway"
   value       = try(aws_egress_only_internet_gateway.this[0].id, "")
 }

 output "cgw_ids" {
-  description = "List of IDs of Customer Gateway"
+  description = "List of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.id]
 }

 output "cgw_arns" {
-  description = "List of ARNs of Customer Gateway"
+  description = "Map of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.arn]
 }

 output "this_customer_gateway" {
-  description = "Map of Customer Gateway attributes"
+  description = "Map of attribute maps for all customer gateways created"
   value       = aws_customer_gateway.this
 }

---

---

Choice C:
README.md
@@ -478,8 +478,8 @@ No modules.
 | Name | Description |
 |------|-------------|
 |  [azs](#output\_azs) | A list of availability zones specified as argument to this module |
-|  [cgw\_arns](#output\_cgw\_arns) | List of ARNs of Customer Gateway |
-|  [cgw\_ids](#output\_cgw\_ids) | List of IDs of Customer Gateway |
+|  [cgw\_arns](#output\_cgw\_arns) | Map of ARNs of Customer Gateway |
+|  [cgw\_ids](#output\_cgw\_ids) | List of ARNs of Customer Gateway |
 |  [database\_internet\_gateway\_route\_id](#output\_database\_internet\_gateway\_route\_id) | ID of the database internet gateway route |
 |  [database\_ipv6\_egress\_route\_id](#output\_database\_ipv6\_egress\_route\_id) | ID of the database IPv6 egress route |
 |  [database\_nat\_gateway\_route\_ids](#output\_database\_nat\_gateway\_route\_ids) | List of IDs of the database nat gateway route |
@@ -507,7 +507,7 @@ No modules.
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
 |  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
-|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
+|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | List of IDs of Customer Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
 |  [elasticache\_route\_table\_association\_ids](#output\_elasticache\_route\_table\_association\_ids) | List of IDs of the elasticache route table association |
@@ -568,7 +568,7 @@ No modules.
 |  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [redshift\_subnets\_cidr\_blocks](#output\_redshift\_subnets\_cidr\_blocks) | List of cidr\_blocks of redshift subnets |
 |  [redshift\_subnets\_ipv6\_cidr\_blocks](#output\_redshift\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of redshift subnets in an IPv6 enabled VPC |
-|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of Customer Gateway attributes |
+|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of attribute maps for all customer gateways created |
 |  [vgw\_arn](#output\_vgw\_arn) | The ARN of the VPN Gateway |
 |  [vgw\_id](#output\_vgw\_id) | The ID of the VPN Gateway |
 |  [vpc\_arn](#output\_vpc\_arn) | The ARN of the VPC |
---
outputs.tf
@@ -364,22 +364,22 @@ output "igw_arn" {
 }

 output "egress_only_internet_gateway_id" {
-  description = "The ID of the egress only Internet Gateway"
+  description = "List of IDs of Customer Gateway"
   value       = try(aws_egress_only_internet_gateway.this[0].id, "")
 }

 output "cgw_ids" {
-  description = "List of IDs of Customer Gateway"
+  description = "List of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.id]
 }

 output "cgw_arns" {
-  description = "List of ARNs of Customer Gateway"
+  description = "Map of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.arn]
 }

 output "this_customer_gateway" {
-  description = "Map of Customer Gateway attributes"
+  description = "Map of attribute maps for all customer gateways created"
   value       = aws_customer_gateway.this
 }

---

---

Choice D:
README.md
@@ -478,8 +478,8 @@ No modules.
 | Name | Description |
 |------|-------------|
 |  [azs](#output\_azs) | A list of availability zones specified as argument to this module |
-|  [cgw\_arns](#output\_cgw\_arns) | List of ARNs of Customer Gateway |
-|  [cgw\_ids](#output\_cgw\_ids) | List of IDs of Customer Gateway |
+|  [cgw\_arns](#output\_cgw\_arns) | Map of "List of Customer Gateway |
+|  [cgw\_ids](#output\_cgw\_ids) | List of ARNs of Customer Gateway |
 |  [database\_internet\_gateway\_route\_id](#output\_database\_internet\_gateway\_route\_id) | ID of the database internet gateway route |
 |  [database\_ipv6\_egress\_route\_id](#output\_database\_ipv6\_egress\_route\_id) | ID of the database IPv6 egress route |
 |  [database\_nat\_gateway\_route\_ids](#output\_database\_nat\_gateway\_route\_ids) | List of IDs of the database nat gateway route |
@@ -507,7 +507,7 @@ No modules.
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
 |  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
-|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
+|  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | List of IDs of Customer Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
 |  [elasticache\_route\_table\_association\_ids](#output\_elasticache\_route\_table\_association\_ids) | List of IDs of the elasticache route table association |
@@ -568,7 +568,7 @@ No modules.
 |  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [redshift\_subnets\_cidr\_blocks](#output\_redshift\_subnets\_cidr\_blocks) | List of cidr\_blocks of redshift subnets |
 |  [redshift\_subnets\_ipv6\_cidr\_blocks](#output\_redshift\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of redshift subnets in an IPv6 enabled VPC |
-|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of Customer Gateway attributes |
+|  [this\_customer\_gateway](#output\_this\_customer\_gateway) | Map of attribute maps for all customer gateways created |
 |  [vgw\_arn](#output\_vgw\_arn) | The ARN of the VPN Gateway |
 |  [vgw\_id](#output\_vgw\_id) | The ID of the VPN Gateway |
 |  [vpc\_arn](#output\_vpc\_arn) | The ARN of the VPC |
---
outputs.tf
@@ -364,22 +364,22 @@ output "igw_arn" {
 }

 output "egress_only_internet_gateway_id" {
-  description = "The ID of the egress only Internet Gateway"
+  description = "List of IDs of Customer Gateway"
   value       = try(aws_egress_only_internet_gateway.this[0].id, "")
 }

 output "cgw_ids" {
-  description = "List of IDs of Customer Gateway"
+  description = "List of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.id]
 }

 output "cgw_arns" {
-  description = "List of ARNs of Customer Gateway"
+  description = "Map of ARNs of Customer Gateway"
   value       = [for k, v in aws_customer_gateway.this : v.arn]
 }

 output "this_customer_gateway" {
-  description = "Map of Customer Gateway attributes"
+  description = "Map of attribute maps for all customer gateways created"
   value       = aws_customer_gateway.this
 }

---

---