Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Now, we are able to count nat gateways and private route tables for independent naming per az.

## Motivation and Context
We need to be more clear on our infras.

## Breaking Changes
N/A

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

Thank you.

---

Choice A:
README.md
@@ -500,6 +500,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
@@ -523,6 +524,7 @@ No modules.
 |  [private\_inbound\_acl\_rules](#input\_private\_inbound\_acl\_rules) | Private subnets inbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_outbound\_acl\_rules](#input\_private\_outbound\_acl\_rules) | Private subnets outbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_route\_table\_tags](#input\_private\_route\_table\_tags) | Additional tags for the private route tables | `map(string)` | `{}` | no |
+|  [private\_route\_table\_tags\_per\_az](#input\_private\_route\_table\_tags\_per\_az) | Additional tags for the private route tables where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false` | `bool` | `false` | no |
 |  [private\_subnet\_enable\_dns64](#input\_private\_subnet\_enable\_dns64) | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `true` | no |
 |  [private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch](#input\_private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch) | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no |
---
main.tf
@@ -274,6 +274,8 @@ resource "aws_route_table" "private" {
     },
     var.tags,
     var.private_route_table_tags,
+    lookup(var.private_route_table_tags_per_az, element(var.azs, count.index), {})
+
   )
 }

@@ -1096,6 +1098,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -390,6 +390,12 @@ variable "private_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_tags_per_az" {
+  description = "Additional tags for the private route tables where the primary key is the AZ"
+  type  a      = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Private Network ACLs
 ################################################################################
@@ -1234,6 +1240,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice B:
README.md
@@ -500,6 +500,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
@@ -523,6 +524,7 @@ No modules.
 |  [private\_inbound\_acl\_rules](#input\_private\_inbound\_acl\_rules) | Private subnets inbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_outbound\_acl\_rules](#input\_private\_outbound\_acl\_rules) | Private subnets outbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_route\_table\_tags](#input\_private\_route\_table\_tags) | Additional tags for the private route tables | `map(string)` | `{}` | no |
+|  [private\_route\_table\_tags\_per\_az](#input\_private\_route\_table\_tags\_per\_az) | Additional tags for the private route tables where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false` | `bool` | `false` | no |
 |  [private\_subnet\_enable\_dns64](#input\_private\_subnet\_enable\_dns64) | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `true` | no |
 |  [private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch](#input\_private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch) | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no |
---
main.tf
@@ -274,6 +274,8 @@ resource "aws_route_table" "private" {
     },
     var.tags,
     var.private_route_table_tags,
+    lookup(var.private_route_table_tags_per_az, element(var.azs, count.index), {})
+
   )
 }

@@ -1096,6 +1098,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -390,6 +390,12 @@ variable "private_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_tags_per_az" {
+  description = "Additional tags for the private route tables where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Private Network ACLs
 ################################################################################
@@ -1234,6 +1240,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice C:
README.md
@@ -500,6 +500,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
@@ -523,6 +524,7 @@ No modules.
 |  [private\_inbound\_acl\_rules](#input\_private\_inbound\_acl\_rules) | Private subnets inbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_outbound\_acl\_rules](#input\_private\_outbound\_acl\_rules) | Private subnets outbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_route\_table\_tags](#input\_private\_route\_table\_tags) | Additional tags for the private route tables | `map(string)` | `{}` | no |
+|  [private\_route\_table\_tags\_per\_az](#input\_private\_route\_table\_tags\_per\_az) | Additional tags for the private route tables where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false` | `bool` | `false` | no |
 |  [private\_subnet\_enable\_dns64](#input\_private\_subnet\_enable\_dns64) | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `true` | no |
 |  [private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch](#input\_private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch) | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no |
---
main.tf
@@ -274,6 +274,8 @@ resource "aws_route_table" "private" {
     },
     var.tags,
     var.private_route_table_tags,
+    lookup(var.private_route_table_tags_per_az, element(var.azs, count.index), {})
+
   )
 }

@@ -1096,6 +1098,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -390,6 +390,12 @@ variable "private_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_tags_per_az" {
+  description = "Additional tags for the private route tables where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Private Network ACLs
 ################################################################################
@@ -1234,6 +1240,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice D:
README.md
@@ -500,6 +500,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN [private\_outbound\_acl\_rules](#input\_private\_outbound\_acl\_rules) Outpost you want to create a subnet in | `string` | `null` | no |
@@ -523,6 +524,7 @@ No modules.
 |  [private\_inbound\_acl\_rules](#input\_private\_inbound\_acl\_rules) | Private subnets inbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_outbound\_acl\_rules](#input\_private\_outbound\_acl\_rules) | Private subnets outbound network ACLs | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [private\_route\_table\_tags](#input\_private\_route\_table\_tags) | Additional tags for the private route tables | `map(string)` | `{}` | no |
+|  [private\_route\_table\_tags\_per\_az](#input\_private\_route\_table\_tags\_per\_az) | Additional tags for the private route tables where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [private\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_private\_subnet\_assign\_ipv6\_address\_on\_creation) | Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false` | `bool` | `false` | no |
 |  [private\_subnet\_enable\_dns64](#input\_private\_subnet\_enable\_dns64) | Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `true` | `bool` | `true` | no |
 |  [private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch](#input\_private\_subnet\_enable\_resource\_name\_dns\_a\_record\_on\_launch) | Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false` | `bool` | `false` | no |
---
main.tf
@@ -274,6 +274,8 @@ resource "aws_route_table" "private" {
     },
     var.tags,
     var.private_route_table_tags,
+    lookup(var.private_route_table_tags_per_az, element(var.azs, count.index), {})
+
   )
 }

@@ -1096,6 +1098,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -390,6 +390,12 @@ variable "private_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_tags_per_az" {
+  description = "Additional tags for the private route tables where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Private Network ACLs
 ################################################################################
@@ -1234,6 +1240,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
… ensuring compatibility with AWS GovCloud and other partitions

## Description
 Update flow log ARNs to use partition from aws_partition data source, ensuring compatibility with AWS GovCloud and other partitions. This was due to the least privilege change in 5.12.0, 5.11.0 and earlier are fine. See PR [#1088](https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/1088)

## Motivation and Context
Currently when deploying to GovCloud with flow logs you get the following error
```
MalformedPolicyDocument: Partition "aws" is not valid for resource "arn:aws:logs:us-gov-west-1:0123456789:log-group:/aws/vpc-flow-log/vpc-012345:*"
```

## Breaking Changes
No

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [X] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -352,6 +352,7 @@ No modules.
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs
---
vpc-flow-logs.tf
@@ -8,6 +8,11 @@ data "aws_caller_identity" "current" {
   count = var.create_vpc && var.enable_flow_log ? 1 : 0
 }

+data "aws_partition" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && |
 ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -20,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice B:
README.md
@@ -352,6 +352,7 @@ No modules.
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs
---
vpc-flow-logs.tf
@@ -8,6 +8,11 @@ data "aws_caller_identity" "current" {
   count = var.create_vpc && var.enable_flow_log ? 1 : 0
 }

+data "aws_partition" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -20,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice C:
0
 -352,6 +352,7 @@ No modules.
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs
---
vpc-flow-logs.tf
@@ -8,6 +8,11 @@ data "aws_caller_identity" "current" {
   count = var.create_vpc && var.enable_flow_log ? 1 : 0
 }

+data "aws_partition" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -20,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice D:
README.md
@@ -352,6 +352,7 @@ No modules.
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.flow_log_cloudwatch_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

 ## Inputs
---
vpc-flow-logs.tf
@@ -8,6 +8,11 @@ data "aws_caller_identity" "current" {
   count = var.create_vpc && var.enable_flow_log ? 1 : 0
 }

+data "aws_partition" "current" {
+  # Call this API only if create_vpc and enable_flow_log are true
+  count = var.create_vpc && var.enable_flow_log ? 1 : 0
+}
+
 locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log
@@ -20,7 var.enable_flow_log
@@ @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:aws:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
resolves #1108

---

Choice A:
README.md
@@ -281,6 +281,7 @@ No modules.
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
+| [aws_eip.secondary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
 | [aws_flow_log.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
 | [aws_iam_policy.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -500,6 +501,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [number\_of\_secondary\_eips\_per\_gateway](#input\_number\_of\_secondary\_eips\_per\_gateway) | how many secondary eips per NAT Gateway | `number` | `0` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires tags to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -68,6 +68,8 @@ module "vpc" {

   enable_vpn_gateway = true

+  number_of_secondary_eips_per_gateway = 2
+
   enable_dhcp_options              = true
   dhcp_options_domain_name         = "service.consul"
   dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
---
main.tf
@@ -1054,6 +1054,7 @@ resource "aws_route" "private_ipv6_egress" {
 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
+  seips_suffixs     = [for num in range(0, var.number_of_secondary_eips_per_gateway) : "s${num + 1}"]
 }

 resource "aws_eip" "nat" {
@@ -1075,6 +1076,22 @@ resource "aws_eip" "nat" {
   depends_on = [aws_internet_gateway.this]
 }

+resource "aws_eip" "secondary" {
+  for_each = toset(flatten([for nat in aws_eip.nat : [for suffix in local.seips_suffixs : "${nat.tags.Name}-${suffix}"]]))
+
+  domain = "vpc"
+
+  tags = merge(
+    {
+      "Name" = each.key,
+    },
+    var.tags,
+    var.nat_eip_tags,
+  )
+
+  depends_on = [aws_internet_gateway.this]
+}
+
 resource "aws_nat_gateway" "this" {
   count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

@@ -1087,6 +1104,8 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  secondary_allocation_ids = [for suffix in local.seips_suffixs : aws_eip.secondary["${aws_eip.nat[count.index].tags.Name}-${suffix}"].allocation_id]
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1228,6 +1228,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "number_of_secondary_eips_per_gateway" {
+  description = "how many secondary eips per NAT Gateway"
+  type        = number
+  default     = 0
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice B:
README.md
@@ -281,6 +281,7 @@ No modules.
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
+| [aws_eip.secondary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
 | [aws_flow_log.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
 | [aws_iam_policy.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -500,6 +501,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags name="input_one_nat_gateway_per_az"> the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [number\_of\_secondary\_eips\_per\_gateway](#input\_number\_of\_secondary\_eips\_per\_gateway) | how many secondary eips per NAT Gateway | `number` | `0` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -68,6 +68,8 @@ module "vpc" {

   enable_vpn_gateway = true

+  number_of_secondary_eips_per_gateway = 2
+
   enable_dhcp_options              = true
   dhcp_options_domain_name         = "service.consul"
   dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
---
main.tf
@@ -1054,6 +1054,7 @@ resource "aws_route" "private_ipv6_egress" {
 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
+  seips_suffixs     = [for num in range(0, var.number_of_secondary_eips_per_gateway) : "s${num + 1}"]
 }

 resource "aws_eip" "nat" {
@@ -1075,6 +1076,22 @@ resource "aws_eip" "nat" {
   depends_on = [aws_internet_gateway.this]
 }

+resource "aws_eip" "secondary" {
+  for_each = toset(flatten([for nat in aws_eip.nat : [for suffix in local.seips_suffixs : "${nat.tags.Name}-${suffix}"]]))
+
+  domain = "vpc"
+
+  tags = merge(
+    {
+      "Name" = each.key,
+    },
+    var.tags,
+    var.nat_eip_tags,
+  )
+
+  depends_on = [aws_internet_gateway.this]
+}
+
 resource "aws_nat_gateway" "this" {
   count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

@@ -1087,6 +1104,8 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  secondary_allocation_ids = [for suffix in local.seips_suffixs : aws_eip.secondary["${aws_eip.nat[count.index].tags.Name}-${suffix}"].allocation_id]
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1228,6 +1228,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "number_of_secondary_eips_per_gateway" {
+  description = "how many secondary eips per NAT Gateway"
+  type        = number
+  default     = 0
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice C:
README.md
@@ -281,6 +281,7 @@ No modules.
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
+| [aws_eip.secondary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
 | [aws_flow_log.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
 | [aws_iam_policy.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -500,6 +501,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [number\_of\_secondary\_eips\_per\_gateway](#input\_number\_of\_secondary\_eips\_per\_gateway) | how many secondary eips per NAT Gateway | `number` | `0` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -68,6 +68,8 @@ module "vpc" {

   enable_vpn_gateway = true

+  number_of_secondary_eips_per_gateway = 2
+
   enable_dhcp_options              = true
   dhcp_options_domain_name         = "service.consul"
   dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
---
main.tf
@@ -1054,6 +1054,7 @@ resource "aws_route" "private_ipv6_egress" {
 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
+  seips_suffixs     = [for num in range(0, var.number_of_secondary_eips_per_gateway) : "s${num + 1}"]
 }

 resource "aws_eip" "nat" {
@@ -1075,6 +1076,22 @@ resource "aws_eip" "nat" {
   depends_on = [aws_internet_gateway.this]
 }

+resource "aws_eip" count.index,
 {
+  for_each = toset(flatten([for nat in aws_eip.nat : [for suffix in local.seips_suffixs : "${nat.tags.Name}-${suffix}"]]))
+
+  domain = "vpc"
+
+  tags = merge(
+    {
+      "Name" = each.key,
+    },
+    var.tags,
+    var.nat_eip_tags,
+  )
+
+  depends_on = [aws_internet_gateway.this]
+}
+
 resource "aws_nat_gateway" "this" {
   count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

@@ -1087,6 +1104,8 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  secondary_allocation_ids = [for suffix in local.seips_suffixs : aws_eip.secondary["${aws_eip.nat[count.index].tags.Name}-${suffix}"].allocation_id]
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1228,6 +1228,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "number_of_secondary_eips_per_gateway" {
+  description = "how many secondary eips per NAT Gateway"
+  type        = number
+  default     = 0
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---

Choice D:
README.md
@@ -281,6 +281,7 @@ No modules.
 | [aws_default_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
 | [aws_egress_only_internet_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/egress_only_internet_gateway) | resource |
 | [aws_eip.nat](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
+| [aws_eip.secondary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eip) | resource |
 | [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
 | [aws_flow_log.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
 | [aws_iam_policy.vpc_flow_log_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -500,6 +501,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [number\_of\_secondary\_eips\_per\_gateway](#input\_number\_of\_secondary\_eips\_per\_gateway) | how many secondary eips per NAT Gateway | `number` | `0` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/complete/main.tf
@@ -68,6 +68,8 @@ module "vpc" {

   enable_vpn_gateway = true

+  number_of_secondary_eips_per_gateway = 2
+
   enable_dhcp_options              = true
   dhcp_options_domain_name         = "service.consul"
   dhcp_options_domain_name_servers = ["127.0.0.1", "10.10.0.2"]
---
main.tf
@@ -1054,6 +1054,7 @@ resource "aws_route" "private_ipv6_egress" {
 locals {
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
   nat_gateway_ips   = var.reuse_nat_ips ? var.external_nat_ip_ids : aws_eip.nat[*].id
+  seips_suffixs     = [for num in range(0, var.number_of_secondary_eips_per_gateway) : "s${num + 1}"]
 }

 resource "aws_eip" "nat" {
@@ -1075,6 +1076,22 @@ resource "aws_eip" "nat" {
   depends_on = [aws_internet_gateway.this]
 }

+resource "aws_eip" "secondary" {
+  for_each = toset(flatten([for nat in aws_eip.nat : [for suffix in local.seips_suffixs : "${nat.tags.Name}-${suffix}"]]))
+
+  domain = "vpc"
+
+  tags = merge(
+    {
+      "Name" = each.key,
+    },
+    var.tags,
+    var.nat_eip_tags,
+  )
+
+  depends_on = [aws_internet_gateway.this]
+}
+
 resource "aws_nat_gateway" "this" {
   count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

@@ -1087,6 +1104,8 @@ resource "aws_nat_gateway" "this" {
     var.single_nat_gateway ? 0 : count.index,
   )

+  secondary_allocation_ids = [for suffix in local.seips_suffixs : aws_eip.secondary["${aws_eip.nat[count.index].tags.Name}-${suffix}"].allocation_id]
+
   tags = merge(
     {
       "Name" = format(
---
variables.tf
@@ -1228,6 +1228,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "number_of_secondary_eips_per_gateway" {
+  description = "how many secondary eips per NAT Gateway"
+  type        = number
+  default     = 0
+}
+
 variable "nat_gateway_tags" {
   description = "Additional tags for the NAT gateways"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Makes the count on `aws_route` dynamic instead of fixed at 1

## Motivation and Context
Fixes #1087

## Breaking Changes
Not that I'm aware of.

## How Has This Been Tested?
- [X] I have tested and validated these changes in a VPC in my environment that have a single public route table as well as another VPC that has multiple public route tables
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [X] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -153,9 +153,9 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count "0.0.0.0/0"
 local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0

-  route_table_id         = aws_route_table.public[0].id
+  route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
   gateway_id             = aws_internet_gateway.this[0].id

@@ -165,9 +165,9 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? 1 : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0

-  route_table_id              = aws_route_table.public[0].id
+  route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
   gateway_id                  = aws_internet_gateway.this[0].id
 }
---

---

Choice B:
main.tf
@@ -153,9 +153,9 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0

-  route_table_id         = aws_route_table.public[0].id
+  route_table_id   "public_internet_gateway_ipv6"      = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
   gateway_id             = aws_internet_gateway.this[0].id

@@ -165,9 +165,9 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? 1 : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0

-  route_table_id              = aws_route_table.public[0].id
+  route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
   gateway_id                  = aws_internet_gateway.this[0].id
 }
---

---

Choice C:
main.tf
@@ -153,9 +153,9 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0

-  route_table_id         = aws_route_table.public[0].id
+ = route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
   gateway_id             = aws_internet_gateway.this[0].id

@@ -165,9 +165,9 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? 1 : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0

-  route_table_id              = aws_route_table.public[0].id
+  route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
   gateway_id                  = aws_internet_gateway.this[0].id
 }
---

---

Choice D:
main.tf
@@ -153,9 +153,9 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0

-  route_table_id         = aws_route_table.public[0].id
+  route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
   gateway_id             = aws_internet_gateway.this[0].id

@@ -165,9 +165,9 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? 1 : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0

-  route_table_id              = aws_route_table.public[0].id
+  route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
   gateway_id                  = aws_internet_gateway.this[0].id
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allow option in whether or not to create a route to the NAT gateway in private subnets.

## Motivation and Context
There are use cases where the creation of this route is undesired.  One example is in the use of a VPC network firewall, where the route destination would be the VPC endpoint of the firewall.

## Breaking Changes
No breaking changes.

## How Has This Been Tested?
- [ x ] I have tested and validated these changes in a VPC in my own environment

- [ x ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -371,6 +371,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a NAT gateway route for private subnet routing table should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1101,7 +1101,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -366,6 +366,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a NAT gateway route for private subnet routing table should be created"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice B:
README.md
@@ -371,6 +371,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a NAT gateway route for private subnet routing table should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1101,7 +1101,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -366,6 +366,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a NAT gateway route for private subnet routing table should be created"
+  type |       = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice C:
README.md
@@ -371,6 +371,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a NAT gateway route for private subnet routing table should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1101,7 +1101,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -366,6 +366,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a NAT gateway route for private subnet routing table should be created"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" `false`   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice D:
README.md
@@ -371,6 +371,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create  separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a NAT gateway route for private subnet routing table should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1101,7 +1101,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -366,6 +366,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a NAT gateway route for private subnet routing table should be created"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
HOMEWORK2.txt
@@ -0,0 +1,64 @@
+1. Explain the git workflow
+A typical Git workflow involves a series of steps to manage changes in your projects codebase. Here is an overview of the most common Git workflow used in collaborative projects:
+a. Clone the Repository
+b. Create a New Branch
+c. Make Changes and Commit
+d. Push the Branch to the Remote Repository
+e. Create a Pull Request
+f. Code Review and Feedback
+g. Merge the Pull Request
+f. Delete branch when done and continue cycle when another branch is needed
+
+2. How do you clone a git repository
+Inorder to clone a git reop,you got to your repository and copy the url then come to you IDE and use the command git clone 'URL' that will clone your reposiotory.
+
+3. How do you check the status of your Git repository?
+To check the status of your Git repository, you can use the git status command. This command provides information about the current state of the working directory and the staging area. It helps you see which changes have been staged, which haven't, and which files aren't being tracked by Git.
+
+4. How do a stage and commit changes?
+To stage changes you use the command git add 'file name'
+To cmmint changes use the command git commint -m
+
+
+5. How do you create a new branch?
+To create a new branch you can use the command git branch 'branch name'.
+
+
+6. Explain the concept of git branching strategy
+A Git branching strategy is a workflow that outlines how branches are used within a repository. It helps teams manage parallel work, isolate feature development, handle bug fixes, and prepare releases efficiently. Below are several commonly used branching strategies:
+a. Git Flow
+Git Flow is a branching strategy that emphasizes a strict branching model for project development. It includes several branch types:
+ain branch,Develop Branch,Feature Branches,Release Branches,Hotfix Branches.
+b. GitHub Flow
+GitHub Flow is a simpler, more streamlined branching strategy suitable for continuous deployment. It uses only two main branches ie. Main Branch and feature branch.
+c. GitLab Flow
+GitLab Flow integrates with GitLab's CI/CD capabilities and supports various environments like development, staging, and production. It emphasizes Main Branch,Environment Branches and Feature Branches
+d. Trunk-Based Development
+Trunk-Based Development is a branching strategy where all developers work on a single branch, usually main. Short-lived feature branches may be created but are merged back into the main branch frequently, sometimes several times a day.
+
+
+7. How do you switch to a different branch?
+The command, git switch 'branch name'/git checkout 'branch name ' can be used.
+
+
+8. How do you merge one branch into another?
+Merging one branch into another in Git is a common task, often used to integrate changes from different branches. Here’s a step-by-step guide on how to do it
+
+
+9. What is a merge conflict and how do you resolve it?
+Merge conflicts occurs when two branches being merged have changes on the the same file and commit that is when a conflict occurs.
+Solutions
+a. making smaller commits as frequent as possible
+b. Frequent pulling/merging
+c. Communication
+
+10. Why is branching important in Git?
+Branching gives you the freedom to independently work on different modules and merge the modules when you finish
+
+11. What is a pull request PR and what is its purpose?
+A pull request is a proposal to merge a group of changes from one branch into another. In a pull request, collaborators can review and discuss the proposed set of changes before they integrate the changes into the main codebase.
+
+12. Forks let you make changes to a project without affecting the original repository, also known as the upstream repository.
+
+13. How do you find a specific commit in the history?
+You can use th
\ No newline at end of file
---

---

Choice B:
HOMEWORK2.txt
@@ -0,0 +1,64 @@
+1. Explain the git workflow
+A typical Git workflow involves a series of steps to manage changes in your projects codebase. Here is an overview of the most common Git workflow used in collaborative projects:
+a. Clone the Repository
+b. Create a New Branch
+c. Make Changes and Commit
+d. Push the Branch to the Remote Repository
+e. Create a Pull Request
+f. Code Review and Feedback
+g. Merge the Pull Request
+f. Delete branch when done and continue cycle when another branch is needed
+
+2. How do you clone a git repository
+Inorder to clone a git reop,you got to your repository and copy the url then come to you IDE and use the command git clone 'URL' that will clone your reposiotory.
+
+3. How do you check the status of your Git repository?
+To check the status of your Git repository, you can use the git status command. This command provides information about the current state of the working directory and the staging area. It helps you see which changes have been staged, which haven't, and which files aren't being tracked by Git.
+
+4. How do you stage and commit changes?
+To stage changes you use the command git add 'file name'
+To cmmint changes use the command git commint -m
+
+
+5. How do you create a new branch?
+To create a new branch you can use the command git branch 'branch name'.
+
+
+6. Explain the concept of git branching strategy
+A Git branching strategy is a workflow that outlines how branches are used within a repository. It helps teams manage parallel work, isolate feature development, handle bug fixes, and prepare releases efficiently. Below are several commonly used branching strategies:
+a. Git Flow
+Git Flow is a branching strategy that emphasizes a strict branching model for project development. It which several branch types:
+ain branch,Develop Branch,Feature Branches,Release Branches,Hotfix Branches.
+b. GitHub Flow
+GitHub Flow is a simpler, more streamlined branching strategy suitable for continuous deployment. It uses only two main branches ie. Main Branch and feature branch.
+c. GitLab Flow
+GitLab Flow integrates with GitLab's CI/CD capabilities and supports various environments like development, staging, and production. It emphasizes Main Branch,Environment Branches and Feature Branches
+d. Trunk-Based Development
+Trunk-Based Development is a branching strategy where all developers work on a single branch, usually main. Short-lived feature branches may be created but are merged back into the main branch frequently, sometimes several times a day.
+
+
+7. How do you switch to a different branch?
+The command, git switch 'branch name'/git checkout 'branch name ' can be used.
+
+
+8. How do you merge one branch into another?
+Merging one branch into another in Git is a common task, often used to integrate changes from different branches. Here’s a step-by-step guide on how to do it
+
+
+9. What is a merge conflict and how do you resolve it?
+Merge conflicts occurs when two branches being merged have changes on the the same file and commit that is when a conflict occurs.
+Solutions
+a. making smaller commits as frequent as possible
+b. Frequent pulling/merging
+c. Communication
+
+10. Why is branching important in Git?
+Branching gives you the freedom to independently work on different modules and merge the modules when you finish
+
+11. What is a pull request PR and what is its purpose?
+A pull request is a proposal to merge a group of changes from one branch into another. In a pull request, collaborators can review and discuss the proposed set of changes before they integrate the changes into the main codebase.
+
+12. Forks let you make changes to a project without affecting the original repository, also known as the upstream repository.
+
+13. How do you find a specific commit in the history?
+You can use th
\ No newline at end of file
---

---

Choice C:
HOMEWORK2.txt
@@ -0,0 +1,64 @@
+1. Explain the git workflow
+A typical Git workflow involves a series of steps to manage changes in your projects codebase. Here is an overview of the most common Git workflow used in collaborative projects:
+a. Clone the Repository
+b. Create a New Branch
+c. Make Changes and Commit
+d. Push the Branch to the Remote Repository
+e. Create a Pull Request
+f. Code Review and Feedback
+g. Merge the Pull Request
+f. Delete branch when done and continue cycle when another branch is needed
+
+2. How do you clone a git repository
+Inorder to clone a git reop,you got to your repository and copy the url then come to you IDE and use the command git clone 'URL' that will clone your reposiotory.
+
+3. How do you check the status of your Git repository?
+To check the status of your Git repository, you can use the git status command. This command provides information about the current state of the working directory and the staging area. It helps you see which changes have been staged, which haven't, and which files aren't being tracked by Git.
+
+4. How do you stage and commit changes?
+To stage changes you use the command git add 'file name'
+To cmmint changes use the command git commint -m
+
+
+5. How do you create a new branch?
+To create a new branch you can use the command git branch 'branch name'.
+
+
+6. Explain the concept of git branching strategy
+A Git branching strategy is a workflow that outlines how branches are used within a repository. It helps teams manage parallel work, isolate feature development, handle bug fixes, and prepare releases efficiently. Below are several commonly used branching strategies:
+a. Git Flow
+Git Flow is a branching strategy that emphasizes a strict branching model for project development. It includes several branch types:
+ain branch,Develop Branch,Feature Branches,Release Branches,Hotfix Branches.
+b. GitHub Flow
+GitHub Flow is a simpler, more streamlined branching strategy suitable for continuous deployment. It uses only two main branches ie. Main Branch and feature branch.
+c. GitLab Flow
+GitLab Flow integrates with GitLab's CI/CD capabilities and supports various environments like development, staging, and production. It emphasizes Main Branch,Environment Branches and Feature Branches
+d. Trunk-Based Development
+Trunk-Based Development is a branching strategy where all developers work on a single branch, usually main. Short-lived feature branches may be created but are merged back into the main branch frequently, sometimes several times a day.
+
+
+7. How do you switch to a different branch?
+The command, git switch 'branch name'/git checkout 'branch name ' can be used.
+
+
+8. How do you merge one branch into another?
+Merging one branch into another in Git is a common task, often used to integrate changes from different branches. Here’s a step-by-step guide on how to do it
+
+
+9. What is a merge conflict and how do you resolve it?
+Merge conflicts occurs when two branches being merged have changes on the the same file and commit that is when a conflict occurs.
+Solutions
+a. making smaller commits as frequent as possible
+b. Frequent pulling/merging
+c. Communication
+
+10. Why is branching important in Git?
+Branching gives you the freedom to independently work on different modules and merge the modules when you finish
+
+11. What is a pull request PR and what is its purpose?
+A pull request is a proposal to merge a group of changes from one branch into another. In a pull request, collaborators can review and discuss the proposed set of changes before they projects:
+a. the changes into the main codebase.
+
+12. Forks let you make changes to a project without affecting the original repository, also known as the upstream repository.
+
+13. How do you find a specific commit in the history?
+You can use th
\ No newline at end of file
---

---

Choice D:
HOMEWORK2.txt
@@ -0,0 +1,64 @@
+1. Explain the git workflow
+A typical Git workflow involves a series of steps to manage changes in your projects codebase. Here is an overview of the most common Git workflow used in collaborative projects:
+a. Clone the Repository
+b. Create a New Branch
+c. Make Changes and Commit
+d. Push the Branch to the Remote Repository
+e. Create a Pull Request
+f. Code Review and Feedback
+g. Merge the Pull Request
+f. Delete branch when done and continue cycle when another branch is needed
+
+2. How do you clone a git repository
+Inorder to clone a git reop,you got to your repository and copy the url then come to you IDE and use the command git clone 'URL' that will clone your reposiotory.
+
+3. How do you check the status of your Git repository?
+To check the status of your Git repository, you can use the git status command. This command provides information about the current state of the working directory and the staging area. It helps you see which changes have been staged, which haven't, and which files aren't being tracked by Git.
+
+4. How do you stage and commit changes?
+To stage changes you use the command git add 'file name'
+To cmmint changes use the command git commint -m
+
+
+5. How do you create a new branch?
+To create a new branch you can use the command git branch 'branch name'.
+
+
+6. Explain the concept of git branching strategy
+A Git branching strategy is a workflow that outlines how branches are used within a repository. It helps teams manage parallel work, isolate feature development, handle bug fixes, and prepare releases efficiently. Below are several commonly used branching strategies:
+a. Git Flow
+Git Flow is a branching strategy that emphasizes a strict branching model for project development. It includes several branch types:
+ain branch,Develop Branch,Feature Branches,Release Branches,Hotfix Branches.
+b. GitHub Flow
+GitHub Flow is a simpler, more streamlined branching strategy suitable for continuous deployment. It uses only two main branches ie. Main Branch and feature branch.
+c. GitLab Flow
+GitLab Flow integrates with GitLab's CI/CD capabilities and supports various environments like development, staging, and production. It emphasizes Main Branch,Environment Branches and Feature Branches
+d. Trunk-Based Development
+Trunk-Based Development is a branching strategy where all developers work on a single branch, usually main. Short-lived feature branches may be created but are merged back into the main branch frequently, sometimes several times a day.
+
+
+7. How do you switch to a different branch?
+The command, git switch 'branch name'/git checkout 'branch name ' can be used.
+
+
+8. How do you merge one branch into another?
+Merging one branch into another in Git is a common task, often used to integrate changes from different branches. Here’s a step-by-step guide on how to do it
+
+
+9. What is a merge conflict and how do you resolve it?
+Merge conflicts occurs when two branches being merged have changes on the the same file and commit that is when a conflict occurs.
+Solutions
+a. making smaller commits as frequent as possible
+b. Frequent pulling/merging
+c. Communication
+
+10. Why is branching important in Git?
+Branching gives you the freedom to independently work on different modules and merge the modules when you finish
+
+11. What is a pull request PR and what is its purpose?
+A pull request is a proposal to merge a group of changes from one branch into another. In a pull request, collaborators can review and discuss the proposed set of changes before they integrate the changes into the main codebase.
+
+12. Forks let you make changes to a project without affecting the original repository, also known as the upstream repository.
+
+13. How do you find a specific commit in the history?
+You can use th
\ No newline at end of file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Added parameter ip_address_type to allow ipv4. ipv6 and dualstack ip_address_type support

## Motivation and Context
To solve issue #1091

## Breaking Changes
None

## How Has This Been Tested?
- [*] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [*] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [*] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -33,6 +33,7 @@ resource "aws_vpc_endpoint" "this" {
   route_table_ids     try(each.value.private_dns_enabled, try(each.value.service_type, "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = try(each.value.policy, null)
   private_dns_enabled = try(each.value.service_type, "Interface") == "Interface" ? try(each.value.private_dns_enabled, null) : null
+  ip_address_type     = try(each.value.ip_address_type, null)

   dynamic "dns_options" {
     for_each = try([each.value.dns_options], [])
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -33,6 +33,7 @@ resource "aws_vpc_endpoint" "this" {
   ip_address_type     = try(each.value.service_type, "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = try(each.value.policy, null)
   private_dns_enabled = try(each.value.service_type, "Interface") == "Interface" ? try(each.value.private_dns_enabled, null) : null
+  ip_address_type     = try(each.value.ip_address_type, null)

   dynamic "dns_options" {
     for_each = try([each.value.dns_options], [])
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -33,6 +33,7 @@ resource "aws_vpc_endpoint" "this" {
   route_table_ids     = try(each.value.service_type, "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy     =         = try(each.value.policy, null)
   private_dns_enabled = try(each.value.service_type, "Interface") == "Interface" ? try(each.value.private_dns_enabled, null) : null
+  ip_address_type     = try(each.value.ip_address_type, null)

   dynamic "dns_options" {
     for_each = try([each.value.dns_options], [])
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -33,6 +33,7 @@ resource "aws_vpc_endpoint" "this" {
   route_table_ids     = try(each.value.service_type, "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = try(each.value.policy, null)
   private_dns_enabled = try(each.value.service_type, "Interface") == "Interface" ? try(each.value.private_dns_enabled, null) : null
+  ip_address_type     = try(each.value.ip_address_type, null)

   dynamic "dns_options" {
     for_each = try([each.value.dns_options], [])
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
warm
@@ -0,0 +1 @@
+beautifly warm weather today
\ No newline at end of file
---

---

Choice B:
warm
@@ today
\ +1 @@
+beautifly warm weather today
\ No newline at end of file
---

---

Choice C:
+1 -0,0 +1 @@
+beautifly warm weather today
\ No newline at end of file
---

---

Choice D:
warm
@@ -0,0 +1 @@
+beautifly warm weather today
\ No newline at end at file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
file
---
 -0,0 +1 @@
+my name is akoto
\ No newline at end of file
---

---

Choice B:
dev.tf
@@ -0,0 +1 @@
+my name is akoto
\ No newline at end of @@
+my

---

Choice C:
dev.tf
@@ -0,0 +1 @@
+my name is akoto
\ No newline at end of file
---

---

Choice D:
dev.tf
@@ -0,0 +1 @@
+my name is akoto
\ No dev.tf
@@ at end of file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Fixes creating NAT gateway route table associations even when enable_nat_gateway=false

## Motivation and Context
More detailed description of the issue is here https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1031

## Breaking Changes
no breaking changes

## How Has This Been Tested?
Tested in production TGW environment with no NAT gw route table associations

---

Choice A:
main.tf
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = local.create_private_subnets && var.enable_nat_gateway ? local.len_private_subnets : 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
@@ -412,7 +412,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && var.enable_nat_gateway ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
@@ -724,7 +724,7 @@ resource "aws_route_table" "elasticache" {
 }

 resource "aws_route_table_association" "elasticache" {
-  count = local.create_elasticache_subnets ? local.len_elasticache_subnets : 0
+  count = local.create_elasticache_subnets count var.enable_nat_gateway ? local.len_elasticache_subnets : 0

   subnet_id = element(aws_subnet.elasticache[*].id, count.index)
   route_table_id = element(
---

---

Choice B:
main.tf
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = }
 && var.enable_nat_gateway ? local.len_private_subnets : 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
@@ -412,7 +412,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && var.enable_nat_gateway ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
@@ -724,7 +724,7 @@ resource "aws_route_table" "elasticache" {
 }

 resource "aws_route_table_association" "elasticache" {
-  count = local.create_elasticache_subnets ? local.len_elasticache_subnets : 0
+  count = local.create_elasticache_subnets && var.enable_nat_gateway ? local.len_elasticache_subnets : 0

   subnet_id = element(aws_subnet.elasticache[*].id, count.index)
   route_table_id = element(
---

---

Choice C:
main.tf
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = local.create_private_subnets && var.enable_nat_gateway ? local.len_private_subnets : 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
@@ -412,7 +412,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && var.enable_nat_gateway ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
@@ -724,7 +724,7 @@ resource "aws_route_table" "elasticache" {
 }

 resource "aws_route_table_association" "elasticache" {
-  count = local.create_elasticache_subnets ? local.len_elasticache_subnets : 0
+  count = local.create_elasticache_subnets && var.enable_nat_gateway ? local.len_elasticache_subnets : 0

   subnet_id = element(aws_subnet.elasticache[*].id, count.index)
   route_table_id = element(
---

---

Choice D:
main.tf
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
- "elasticache" count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = local.create_private_subnets && var.enable_nat_gateway ? local.len_private_subnets : 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
@@ -412,7 +412,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && var.enable_nat_gateway ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
@@ -724,7 +724,7 @@ resource "aws_route_table" "elasticache" {
 }

 resource "aws_route_table_association" "elasticache" {
-  count = local.create_elasticache_subnets ? local.len_elasticache_subnets : 0
+  count = local.create_elasticache_subnets && var.enable_nat_gateway ? local.len_elasticache_subnets : 0

   subnet_id = element(aws_subnet.elasticache[*].id, count.index)
   route_table_id = element(
---

---