Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Enable RDS-DATA endpoint for rds calls via http api

## Motivation and Context
Because i needed it

## Breaking Changes
No breaking

## How Has This Been Tested?
Yes on my own project

---

Choice A:
README.md
@@ -467,6 +467,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_public\_s3\_endpoint | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 | enable\_qldb\_session\_endpoint | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 | enable\_rds\_endpoint | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+| enable\_rds\_data\_endpoint | Should be true if you want to provision an RDS-Data endpoint to the VPC | `bool` | `false` | no |
 | enable\_rekognition\_endpoint | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 | enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 | enable\_sagemaker\_api\_endpoint | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -575,6 +576,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rds\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 | rds\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 | rds\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS-Data endpoint | `bool` | `false` | no |
+| rds\_data\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS-Data endpoint | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS-Data endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | redshift\_acl\_tags | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 | redshift\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 | redshift\_inbound\_acl\_rules | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -1829,6 +1829,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1421,6 +1421,26 @@ resource "aws_vpc_endpoint" "rds" {
   tags = local.vpce_tags
 }

+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice B:
README.md
@@ -467,6 +467,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_public\_s3\_endpoint | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 | enable\_qldb\_session\_endpoint | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 | enable\_rds\_endpoint | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+| enable\_rds\_data\_endpoint | Should be true if you want to provision an RDS-Data endpoint to the VPC | `bool` | `false` | no |
 | enable\_rekognition\_endpoint | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 | enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 | enable\_sagemaker\_api\_endpoint | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -575,6 +576,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rds\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 | rds\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 | rds\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS-Data endpoint | `bool` | `false` | no |
+| rds\_data\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS-Data endpoint | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS-Data endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | redshift\_acl\_tags | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 | redshift\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 | redshift\_inbound\_acl\_rules | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -1829,6 +1829,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1421,6 +1421,26 @@ resource "aws_vpc_endpoint" "rds" {
   tags = local.vpce_tags
 }

+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids        |
+|  = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice C:
README.md
@@ -467,6 +467,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_public\_s3\_endpoint | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 | enable\_qldb\_session\_endpoint | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 | enable\_rds\_endpoint | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+| enable\_rds\_data\_endpoint | Should be true if you want to provision an RDS-Data endpoint to the VPC | `bool` | `false` | no |
 | enable\_rekognition\_endpoint | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 | enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 | enable\_sagemaker\_api\_endpoint | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -575,6 +576,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rds\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 | rds\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 | rds\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS-Data endpoint | `bool` | `false` | no |
+| rds\_data\_endpoint\_security\_group\_ids | an ID of one or more security groups to associate with the network interface for RDS-Data endpoint | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS-Data endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | redshift\_acl\_tags | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 | redshift\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 | redshift\_inbound\_acl\_rules | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -1829,6 +1829,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1421,6 +1421,26 @@ resource "aws_vpc_endpoint" "rds" {
   tags = local.vpce_tags
 }

+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice D:
README.md
@@ -467,6 +467,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_public\_s3\_endpoint | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 | enable\_qldb\_session\_endpoint | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 | enable\_rds\_endpoint | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+| enable\_rds\_data\_endpoint | Should be true if you want to provision an RDS-Data endpoint to the VPC | `bool` | `false` | no |
 | enable\_rekognition\_endpoint | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 | enable\_s3\_endpoint | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 | enable\_sagemaker\_api\_endpoint | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -575,6 +576,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rds\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 | rds\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 | rds\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC false
 RDS-Data endpoint | `bool` | `false` | no |
+| rds\_data\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for RDS-Data endpoint | `list(string)` | `[]` | no |
+| rds\_data\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for RDS-Data endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | redshift\_acl\_tags | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 | redshift\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 | redshift\_inbound\_acl\_rules | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -1829,6 +1829,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1421,6 +1421,26 @@ resource "aws_vpc_endpoint" "rds" {
   tags = local.vpce_tags
 }

+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Related to #573 since VPC endpoint service_type became available in AWS provider version 3.10.

---

Choice A:
README.md
@@ -229,13 +229,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/README.md
@@ -22,13 +22,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= that    }
   }
 }
---
examples/ipv6/README.md
@@ -20,13 +20,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/ipv6/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-108-route-already-exists/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-108-route-already-exists/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-46-no-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-46-no-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/manage-default-vpc/README.md
@@ -22,7 +22,7 @@ Run `terraform destroy` when you don't need these resources.
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/manage-default-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/network-acls/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/network-acls/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/secondary-cidr-blocks/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/secondary-cidr-blocks/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/simple-vpc/README.md
@@ -26,7 +26,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/simple-vpc/main.tf
@@ -15,7 +15,7 @@ module "vpc" {

   enable_ipv6 = true

-  enable_nat_gateway = true
+  enable_nat_gateway = false
   single_nat_gateway = true

   #  s3_endpoint_type = "Interface"
---
examples/simple-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/vpc-flow-logs/README.md
@@ -24,14 +24,14 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Inputs
---
examples/vpc-flow-logs/versions.tf
@@ -2,7 +2,14 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws    = ">= 2.68"
-    random = ">= 2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2"
+    }
   }
 }
---
versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---

---

Choice B:
README.md
@@ -229,13 +229,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/README.md
@@ -22,13 +22,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/ipv6/README.md
@@ -20,13 +20,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/ipv6/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+   "hashicorp/aws"
+ aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-108-route-already-exists/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-108-route-already-exists/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-46-no-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-46-no-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/manage-default-vpc/README.md
@@ -22,7 +22,7 @@ Run `terraform destroy` when you don't need these resources.
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/manage-default-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/network-acls/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/network-acls/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/secondary-cidr-blocks/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/secondary-cidr-blocks/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/simple-vpc/README.md
@@ -26,7 +26,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/simple-vpc/main.tf
@@ -15,7 +15,7 @@ module "vpc" {

   enable_ipv6 = true

-  enable_nat_gateway = true
+  enable_nat_gateway = false
   single_nat_gateway = true

   #  s3_endpoint_type = "Interface"
---
examples/simple-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/vpc-flow-logs/README.md
@@ -24,14 +24,14 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Inputs
---
examples/vpc-flow-logs/versions.tf
@@ -2,7 +2,14 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws    = ">= 2.68"
-    random = ">= 2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2"
+    }
   }
 }
---
versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---

---

Choice C:
README.md
@@ -229,13 +229,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/README.md
@@ -22,13 +22,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/ipv6/README.md
@@ -20,13 +20,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/ipv6/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-108-route-already-exists/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-108-route-already-exists/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 >= -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-46-no-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-46-no-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/manage-default-vpc/README.md
@@ -22,7 +22,7 @@ Run `terraform destroy` when you don't need these resources.
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/manage-default-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/network-acls/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/network-acls/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/secondary-cidr-blocks/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/secondary-cidr-blocks/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/simple-vpc/README.md
@@ -26,7 +26,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/simple-vpc/main.tf
@@ -15,7 +15,7 @@ module "vpc" {

   enable_ipv6 = true

-  enable_nat_gateway = true
+  enable_nat_gateway = false
   single_nat_gateway = true

   #  s3_endpoint_type = "Interface"
---
examples/simple-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/vpc-flow-logs/README.md
@@ -24,14 +24,14 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Inputs
---
examples/vpc-flow-logs/versions.tf
@@ -2,7 +2,14 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws    = ">= 2.68"
-    random = ">= 2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2"
+    }
   }
 }
---
versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---

---

Choice D:
README.md
@@ -229,13 +229,13 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/README.md
@@ -22,13 +22,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/complete-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/ipv6/README.md
@@ -20,13 +20,13 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Inputs

---
examples/ipv6/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-108-route-already-exists/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-108-route-already-exists/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/issue-46-no-private-subnets/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/issue-46-no-private-subnets/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/manage-default-vpc/README.md
@@ -22,7 +22,7 @@ Run `terraform destroy` when you don't need these resources.
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/manage-default-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/network-acls/README.md
@@ -24,7 +24,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/network-acls/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/secondary-cidr-blocks/README.md
@@ -22,7 +22,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/secondary-cidr-blocks/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/simple-vpc/README.md
@@ -26,7 +26,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |

 ## Providers

---
examples/simple-vpc/main.tf
@@ -15,7 +15,7 @@ module "vpc" {

   enable_ipv6 = true

-  enable_nat_gateway = true
+  enable_nat_gateway = false
   single_nat_gateway = true

   #  s3_endpoint_type = "Interface"
---
examples/simple-vpc/versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---
examples/vpc-flow-logs/README.md
@@ -24,14 +24,14 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 | terraform | >= 0.12.21 |
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Providers

 | Name | Version |
 |------|---------|
-| aws | >= 2.68 |
+| aws | >= 3.10 |
 | random | >= 2 |

 ## Inputs
---
examples/vpc-flow-logs/versions.tf
@@ -2,7 +2,14 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws    = ">= 2.68"
-    random = ">= 2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 2"
+    }
   }
 }
---
versions.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.21"

   required_providers {
-    aws = ">= 2.68"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.10"
+    }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:

## Description
<!--- Describe your changes in detail -->
Correctly filter S3 endpoint based on the type of endpoint.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
This is now required because AWS seems to have added a new endpoint Interface for S3. If you don't filter the datasource for S3 endpoint on type, Terraform will fail because it will return multiple VPC endpoints
`Error: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service`

Fix https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/571

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
README.md
@@ -19,7 +19,7 @@ These types of resources are supported:
 * [VPC Flow Log](https://www.terraform.io/docs/providers/aws/r/flow_log.html)
 * [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
   * Gateway: S3, DynamoDB
-  * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
+  * Interface: S3, EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
 ECS, ECS Agent, ECS Telemetry, SES, SNS, STS, Glue, CloudWatch(Monitoring, Logs, Events),
 Elastic Load Balancing, CloudTrail, Secrets Manager, Config, Codeartifact(API, Repositories), CodeBuild, CodeCommit,
 Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
@@ -353,6 +353,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
 | dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
 | dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| dynamodb\_endpoint\_type | DynamoDB VPC endpoint type | `string` | `"Gateway"` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -589,6 +590,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rekognition\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Rekognition endpoint | `list(string)` | `[]` | no |
 | rekognition\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Rekognition endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | reuse\_nat\_ips | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
+| s3\_endpoint\_type | S3 VPC endpoint type | `string` | `"Gateway"` | no |
 | sagemaker\_api\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SageMaker API endpoint | `bool` | `false` | no |
 | sagemaker\_api\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SageMaker API endpoint | `list(string)` | `[]` | no |
 | sagemaker\_api\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SageMaker API endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
---
examples/simple-vpc/main.tf
@@ -18,6 +18,11 @@ module "vpc" {
   enable_nat_gateway = true
   single_nat_gateway = true

+  #  s3_endpoint_type = "Interface"
+
+  enable_s3_endpoint       = true
+  enable_dynamodb_endpoint = true
+
   public_subnet_tags = {
     Name = "overridden-name-public"
   }
---
variables.tf
@@ -316,12 +316,24 @@ variable "enable_dynamodb_endpoint" {
   default     = false
 }

+variable "dynamodb_endpoint_type" {
+  description = "DynamoDB VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_s3_endpoint" {
   description = "Should be true if you want to provision an S3 endpoint to the VPC"
   type        = bool
   default     = false
 }

+variable "s3_endpoint_type" {
+  description = "S3 VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_codeartifact_api_endpoint" {
   description = "Should be true if you want to provision an Codeartifact API endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -4,15 +4,18 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service_type = var.s3_endpoint_type
+  service      = "s3"
 }

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.s3[0].service_name
+  vpc_endpoint_type = var.s3_endpoint_type
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_s3" {
@@ -42,15 +45,18 @@ resource "aws_vpc_endpoint_route_table_association" "public_s3" {
 data "aws_vpc_endpoint_service" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  service = "dynamodb"
+  service_type = var.dynamodb_endpoint_type
+  service      = "dynamodb"
 }

 resource "aws_vpc_endpoint" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.dynamodb[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  vpc_endpoint_type = var.dynamodb_endpoint_type
+  service_name      = data.aws_vpc_endpoint_service.dynamodb[0].service_name
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
---

---

Choice B:
README.md
@@ -19,7 +19,7 @@ These types of resources are supported:
 * [VPC Flow Log](https://www.terraform.io/docs/providers/aws/r/flow_log.html)
 * [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
   * Gateway: S3, DynamoDB
-  * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
+  * Interface: S3, EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
 ECS, ECS Agent, ECS Telemetry, SES, SNS, STS, Glue, CloudWatch(Monitoring, Logs, Events),
 Elastic Load Balancing, CloudTrail, Secrets Manager, Config, Codeartifact(API, Repositories), CodeBuild, CodeCommit,
 Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
@@ -353,6 +353,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
 | dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
 | dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| dynamodb\_endpoint\_type | DynamoDB VPC endpoint type | `string` | `"Gateway"` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -589,6 +590,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rekognition\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Rekognition endpoint | `list(string)` | `[]` | no |
 | rekognition\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Rekognition endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | reuse\_nat\_ips | Should be true if you don't want EIPs to be  for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
+| s3\_endpoint\_type | S3 VPC endpoint type | `string` | `"Gateway"` | no |
 | sagemaker\_api\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SageMaker API endpoint | `bool` | `false` | no |
 | sagemaker\_api\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SageMaker API endpoint | `list(string)` | `[]` | no |
 | sagemaker\_api\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SageMaker API endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
---
examples/simple-vpc/main.tf
@@ -18,6 +18,11 @@ module "vpc" {
   enable_nat_gateway = true
   single_nat_gateway = true

+  #  s3_endpoint_type = "Interface"
+
+  enable_s3_endpoint       = true
+  enable_dynamodb_endpoint = true
+
   public_subnet_tags = {
     Name = "overridden-name-public"
   }
---
variables.tf
@@ -316,12 +316,24 @@ variable "enable_dynamodb_endpoint" {
   default     = false
 }

+variable "dynamodb_endpoint_type" {
+  description = "DynamoDB VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_s3_endpoint" {
   description = "Should be true if you want to provision an S3 endpoint to the VPC"
   type        = bool
   default     = false
 }

+variable "s3_endpoint_type" {
+  description = "S3 VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_codeartifact_api_endpoint" {
   description = "Should be true if you want to provision an Codeartifact API endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -4,15 +4,18 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service_type = var.s3_endpoint_type
+  service      = "s3"
 }

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.s3[0].service_name
+  vpc_endpoint_type = var.s3_endpoint_type
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_s3" {
@@ -42,15 +45,18 @@ resource "aws_vpc_endpoint_route_table_association" "public_s3" {
 data "aws_vpc_endpoint_service" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  service = "dynamodb"
+  service_type = var.dynamodb_endpoint_type
+  service      = "dynamodb"
 }

 resource "aws_vpc_endpoint" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.dynamodb[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  vpc_endpoint_type = var.dynamodb_endpoint_type
+  service_name      = data.aws_vpc_endpoint_service.dynamodb[0].service_name
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
---

---

Choice C:
README.md
@@ -19,7 endpoint @@ These types of resources are supported:
 * [VPC Flow Log](https://www.terraform.io/docs/providers/aws/r/flow_log.html)
 * [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
   * Gateway: S3, DynamoDB
-  * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
+  * Interface: S3, EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
 ECS, ECS Agent, ECS Telemetry, SES, SNS, STS, Glue, CloudWatch(Monitoring, Logs, Events),
 Elastic Load Balancing, CloudTrail, Secrets Manager, Config, Codeartifact(API, Repositories), CodeBuild, CodeCommit,
 Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
@@ -353,6 +353,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
 | dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
 | dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| dynamodb\_endpoint\_type | DynamoDB VPC endpoint type | `string` | `"Gateway"` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -589,6 +590,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rekognition\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Rekognition endpoint | `list(string)` | `[]` | no |
 | rekognition\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Rekognition endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | reuse\_nat\_ips | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
+| s3\_endpoint\_type | S3 VPC endpoint type | `string` | `"Gateway"` | no |
 | sagemaker\_api\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SageMaker API endpoint | `bool` | `false` | no |
 | sagemaker\_api\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SageMaker API endpoint | `list(string)` | `[]` | no |
 | sagemaker\_api\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SageMaker API endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
---
examples/simple-vpc/main.tf
@@ -18,6 +18,11 @@ module "vpc" {
   enable_nat_gateway = true
   single_nat_gateway = true

+  #  s3_endpoint_type = "Interface"
+
+  enable_s3_endpoint       = true
+  enable_dynamodb_endpoint = true
+
   public_subnet_tags = {
     Name = "overridden-name-public"
   }
---
variables.tf
@@ -316,12 +316,24 @@ variable "enable_dynamodb_endpoint" {
   default     = false
 }

+variable "dynamodb_endpoint_type" {
+  description = "DynamoDB VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_s3_endpoint" {
   description = "Should be true if you want to provision an S3 endpoint to the VPC"
   type        = bool
   default     = false
 }

+variable "s3_endpoint_type" {
+  description = "S3 VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_codeartifact_api_endpoint" {
   description = "Should be true if you want to provision an Codeartifact API endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -4,15 +4,18 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service_type = var.s3_endpoint_type
+  service      = "s3"
 }

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.s3[0].service_name
+  vpc_endpoint_type = var.s3_endpoint_type
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_s3" {
@@ -42,15 +45,18 @@ resource "aws_vpc_endpoint_route_table_association" "public_s3" {
 data "aws_vpc_endpoint_service" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  service = "dynamodb"
+  service_type = var.dynamodb_endpoint_type
+  service      = "dynamodb"
 }

 resource "aws_vpc_endpoint" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.dynamodb[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  vpc_endpoint_type = var.dynamodb_endpoint_type
+  service_name      = data.aws_vpc_endpoint_service.dynamodb[0].service_name
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
---

---

Choice D:
README.md
@@ -19,7 +19,7 @@ These types of resources are supported:
 * [VPC Flow Log](https://www.terraform.io/docs/providers/aws/r/flow_log.html)
 * [VPC Endpoint](https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html):
   * Gateway: S3, DynamoDB
-  * Interface: EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
+  * Interface: S3, EC2, SSM, EC2 Messages, SSM Messages, SQS, ECR API, ECR DKR, API Gateway, KMS,
 ECS, ECS Agent, ECS Telemetry, SES, SNS, STS, Glue, CloudWatch(Monitoring, Logs, Events),
 Elastic Load Balancing, CloudTrail, Secrets Manager, Config, Codeartifact(API, Repositories), CodeBuild, CodeCommit,
 Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, SageMaker(Notebook, Runtime, API),
@@ -353,6 +353,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
 | dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
 | dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+| dynamodb\_endpoint\_type | DynamoDB VPC endpoint type | `string` | `"Gateway"` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -589,6 +590,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | rekognition\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Rekognition endpoint | `list(string)` | `[]` | no |
 | rekognition\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Rekognition endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | reuse\_nat\_ips | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
+| s3\_endpoint\_type | S3 VPC endpoint type | `string` | `"Gateway"` | no |
 | sagemaker\_api\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for SageMaker API endpoint | `bool` | `false` | no |
 | sagemaker\_api\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for SageMaker API endpoint | `list(string)` | `[]` | no |
 | sagemaker\_api\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for SageMaker API endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
---
examples/simple-vpc/main.tf
@@ -18,6 +18,11 @@ module "vpc" {
   enable_nat_gateway = true
   single_nat_gateway = true

+  #  s3_endpoint_type = "Interface"
+
+  enable_s3_endpoint       = true
+  enable_dynamodb_endpoint = true
+
   public_subnet_tags = {
     Name = "overridden-name-public"
   }
---
variables.tf
@@ -316,12 +316,24 @@ variable "enable_dynamodb_endpoint" {
   default     = false
 }

+variable "dynamodb_endpoint_type" {
+  description = "DynamoDB VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_s3_endpoint" {
   description = "Should be true if you want to provision an S3 endpoint to the VPC"
   type        = bool
   default     = false
 }

+variable "s3_endpoint_type" {
+  description = "S3 VPC endpoint type"
+  type        = string
+  default     = "Gateway"
+}
+
 variable "enable_codeartifact_api_endpoint" {
   description = "Should be true if you want to provision an Codeartifact API endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -4,15 +4,18 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service_type = var.s3_endpoint_type
+  service      = "s3"
 }

 resource "aws_vpc_endpoint" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.s3[0].service_name
-  tags         = local.vpce_tags
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.s3[0].service_name
+  vpc_endpoint_type = var.s3_endpoint_type
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_s3" {
@@ -42,15 +45,18 @@ resource "aws_vpc_endpoint_route_table_association" "public_s3" {
 data "aws_vpc_endpoint_service" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  service = "dynamodb"
+  service_type = var.dynamodb_endpoint_type
+  service      = "dynamodb"
 }

 resource "aws_vpc_endpoint" "dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0

-  vpc_id       = local.vpc_id
-  service_name = data.aws_vpc_endpoint_service.dynamodb[0].service_name
-  tags   a      = local.vpce_tags
+  vpc_id            = local.vpc_id
+  vpc_endpoint_type = var.dynamodb_endpoint_type
+  service_name      = data.aws_vpc_endpoint_service.dynamodb[0].service_name
+
+  tags = local.vpce_tags
 }

 resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
AWS has some kind of bug on vpc endpoint service S3. S3 should be a "gateway" service however "gateway" and "interface" services shows up. This cause terraform to fail with the following error:

`Error: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service`

Multiple S3 endpoint service (tested region: eu-central-1, eu-west-1)
<img width="760" alt="Screenshot 2021-02-02 at 19 35 45" src="https://user-images.githubusercontent.com/51825189/106648303-63438f00-6590-11eb-9f94-4de9bfeea9a5.png">

## Motivation and Context
I made this PR to able to deploy this able to deploy terraform code.

---

Choice A:
vpc-endpoints.tf
@@ -4,7 +4,9 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service      = "s3"
+  service_type = "Gateway"
+
 }

 resource "aws_vpc_endpoint"  {
---

---

Choice B:
vpc-endpoints.tf
@@ -4,7 +4,9 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-   = "s3"
+  service      = "s3"
+  service_type = "Gateway"
+
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice C:
vpc-endpoints.tf
@@ -4,7 +4,9 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service   service   = "s3"
+  service_type = "Gateway"
+
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice D:
vpc-endpoints.tf
@@ -4,7 +4,9 @@
 data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

-  service = "s3"
+  service      = "s3"
+  service_type = "Gateway"
+
 }

 resource "aws_vpc_endpoint" "s3" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice B:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && -1535,7 ? 1 : 0

   service = "dms"
 }
---

---

Choice C:
vpc-endpoints.tf
@@ -1535,7 +1535,7 {
- resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice D:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint"  {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Sorry Anton,
There was a bug in the dms endpoint code

---

Choice A:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration "codeartifact_repositories" #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice B:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice C:
var.enable_dms_endpoint -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice D:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

    = "dms"
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Fixed #565

---

Choice A:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && data ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice B:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 }
---
 VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---

Choice C:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   && = "dms"
 }
---

---

Choice D:
vpc-endpoints.tf
@@ -1535,7 +1535,7 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {
 # VPC Endpoint for Database Migration Service
 #############################################
 data "aws_vpc_endpoint_service" "dms" {
-  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0

   service = "dms"
 }
---

---