Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Allow additional routes to be added for the private and intra
routing tables, like it is already available for the default table.

An example use case could be peering with some VPC and making it routed
with the VPC managed by the module. This example assumes that
requesting and accepting the peering request should be handled by a
user. As well as adding default routes on the other (peered VPC) side.

## Motivation and Context

The use case is configuring all required routes within the VPC module, instead of adding custom
calls for ``aws_route``. The latter is not always possible with terragrunt modules for example, which allows
only other modules there, and no custom resources.
(see https://github.com/gruntwork-io/terragrunt/issues/1187 and https://github.com/gruntwork-io/terragrunt/issues/1150)

Custom routes may be required for the private/intra VPC route tables to cover many cases, like
peering the managed VPC with another VPC (outside of this feature scope) and manage additional
routes on both sides. This change allows custom routes to be added for the managed VPC, for this
example. While adding the needed routes on the other side of the peering, and creating the peering would be
left for the user exercise.

## Breaking Changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects (with my [tEKS fork](https://github.com/bogdando/teks/blob/main/QUICKSTART.md#demo-dev-cluster-un-this-fork))

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -342,6 +342,8 @@ No modules.
 |  [default\_route\_table\_propagating\_vgws](#input\_default\_route\_table\_propagating\_vgws) | List of virtual gateways for propagation | `list(string)` | `[]` | no |
 |  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_route\_table\_tags](#input\_default\_route\_table\_tags) | Additional tags for the default route table | `map(string)` | `{}` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_name](#input\_default\_security\_group\_name) | Name to be used on the default security group | `string` | `null` | no |
---
examples/complete-vpc/main.tf
@@ -37,6 +37,15 @@ module "vpc" {

   manage_default_route_table = true
   default_route_table_tags   = { Name = "${local.name}-default" }
+  # Peered VPC to become routed with the one being created
+  default_route_table_routes = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]
+  intra_route_table_routes_extra = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]

   manage_default_security_group = true
   default_security_group_tags   = { Name = "${local.name}-default" }
---
main.tf
@@ -228,6 +228,25 @@ resource "aws_route_table" "private" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.private_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     {
       "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
@@ -338,6 +357,25 @@ resource "aws_route_table" "intra" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.intra_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
     var.tags,
---
variables.tf
@@ -418,6 +418,18 @@ variable "default_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_routes_extra" {
+  description = "Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
+variable "intra_route_table_routes_extra" {
+  description = "Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
 variable "tags" {
   description = "A map of tags to add to all resources"
   type        = map(string)
---

---

Choice B:
README.md
@@ -342,6 +342,8 @@ No modules.
 |  [default\_route\_table\_propagating\_vgws](#input\_default\_route\_table\_propagating\_vgws) | List of virtual gateways for propagation | `list(string)` | `[]` | no |
 |  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_route\_table\_tags](#input\_default\_route\_table\_tags) | Additional tags for the default route table | `map(string)` | `{}` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_name](#input\_default\_security\_group\_name) | Name to be used on the default security group | `string` | `null` | no |
---
examples/complete-vpc/main.tf
@@ -37,6 +37,15 @@ module "vpc" {

   manage_default_route_table = true
   default_route_table_tags   = { Name = "${local.name}-default" }
+  # Peered VPC to become routed with the one being created
+  default_route_table_routes = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]
+  intra_route_table_routes_extra = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]

   manage_default_security_group = true
   default_security_group_tags   = { Name = "${local.name}-default" }
---
main.tf
@@ -228,6 +228,25 @@ resource "aws_route_table" "private" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.private_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id             nat_gateway_id   = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     {
       "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
@@ -338,6 +357,25 @@ resource "aws_route_table" "intra" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.intra_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
     var.tags,
---
variables.tf
@@ -418,6 +418,18 @@ variable "default_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_routes_extra" {
+  description = "Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
+variable "intra_route_table_routes_extra" {
+  description = "Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
 variable "tags" {
   description = "A map of tags to add to all resources"
   type        = map(string)
---

---

Choice C:
README.md
@@ -342,6 +342,8 @@ No modules.
 |  [default\_route\_table\_propagating\_vgws](#input\_default\_route\_table\_propagating\_vgws) | List of virtual gateways for propagation | `list(string)` | `[]` | no |
 |  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_route\_table\_tags](#input\_default\_route\_table\_tags) | Additional tags for the default route table | `map(string)` | `{}` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_name](#input\_default\_security\_group\_name) | Name to be used on the default security group | `string` | `null` | no |
---
examples/complete-vpc/main.tf
@@ -37,6 +37,15 @@ module "vpc" {

   manage_default_route_table = true
   default_route_table_tags   = { Name = "${local.name}-default" }
+  # Peered VPC to become routed with the one being created
+  default_route_table_routes = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]
+  intra_route_table_routes_extra = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]

   manage_default_security_group = true
   default_security_group_tags   = { Name = "${local.name}-default" }
---
main.tf
@@ -228,6 +228,25 @@ resource "aws_route_table" "private" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.private_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     {
       "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
@@ -338,6 +357,25 @@ resource "aws_route_table" "intra" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.intra_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
     var.tags,
---
variables.tf
@@ -418,6 +418,18 @@ variable "default_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_routes_extra" {
+  description = "Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
+variable "intra_route_table_routes_extra" {
+  description = "Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
 variable "tags" {
   description = "A map of tags to add to all resources"
   type        = map(string)
---

---

Choice D:
README.md
@@ -342,6 +342,8 @@ No modules.
 |  [default\_route\_table\_propagating\_vgws](#input\_default\_route\_table\_propagating\_vgws) | List of virtual gateways for propagation | `list(string)` | `[]` | no |
 |  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of routes. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_route\_table\_tags](#input\_default\_route\_table\_tags) | Additional tags for the default route table | `map(string)` | `{}` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
+|  [default\_route\_table\_routes](#input\_default\_route\_table\_routes) | Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | `[]` | no |
 |  [default\_security\_group\_name](#input\_default\_security\_group\_name) | Name to be used on the default security group | `string` | `null` | no |
---
examples/complete-vpc/main.tf
@@ -37,6 +37,15 @@ module "vpc" {

   manage_default_route_table = true
   default_route_table_tags   = { Name = "${local.name}-default" }
+  # Peered VPC to become routed with the one being created
+  default_route_table_routes = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]
+  intra_route_table_routes_extra = [{
+    "vpc_peering_connection_id" = "pcx-00000000000000000",
+    "cidr_block"                = "20.20.20.0/24"
+  }]

   manage_default_security_group = true
   default_security_group_tags   = { Name = "${local.name}-default" }
---
main.tf
@@ -228,6 +228,25 @@ resource "aws_route_table" "private" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.private_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     {
       "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
@@ -338,6 +357,25 @@ resource "aws_route_table" "intra" {

   vpc_id = local.vpc_id

+  dynamic "route" {
+    for_each = var.intra_route_table_routes_extra
+    content {
+      # One of the following destinations must be provided
+      cidr_block      = route.value.cidr_block
+      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)
+
+      # One of the following targets must be provided
+      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
+      gateway_id                = lookup(route.value, "gateway_id", null)
+      instance_id               = lookup(route.value, "instance_id", null)
+      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
+      network_interface_id      = lookup(route.value, "network_interface_id", null)
+      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
+      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
+      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)
+    }
+  }
+
   tags = merge(
     { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
     var.tags,
---
variables.tf
@@ -418,6 +418,18 @@ variable "default_route_table_tags" {
   default     = {}
 }

+variable "private_route_table_routes_extra" {
+  description = "Configuration block of additional routes for private subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
+variable "intra_route_table_routes_extra" {
+  description = "Configuration block of additional routes for intra subnets route tables. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_route_table#route"
+  type        = list(map(string))
+  default     = []
+}
+
 variable "tags" {
   description = "A map of tags to add  all resources"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This change introduces a data source to look up the default security group of the vpc that the endpoint will be deployed into. The default security group is then explicitly associated with the endpoint if no other security groups are passed into the module, or found by the lookup function. This resolves the issue of terraform wanting to make changes on every apply, as described in the linked issue below.

## Motivation and Context
This is to fix what's described in https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/803

## Breaking Changes
No breaking changes

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

The vpc in the complete example was deployed prior to making my change. Terraform apply was run again after making my change, and terraform detected no changes to make.

Locally, I also deployed the simple-vpc example with the below endpoint configuration added to it

```
module "vpc_endpoints" {
  source = "../../modules/vpc-endpoints"

  vpc_id = module.vpc.vpc_id

  endpoints = {
    s3 = {
      service = "s3"
      tags    = { Name = "s3-vpc-endpoint" }
    }
  }

  tags = {
    Owner       = "user"
    Environment = "dev"
  }
}
```

I ran terraform apply again and was able to reproduce the problem described in the linked issue. After adding my change and running a terraform apply, no changes were detected, which is the expected behaviour.

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
modules/vpc-endpoints/README.md
@@ -73,6 +73,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

 ## Inputs
---
modules/vpc-endpoints/main.tf
@@ -3,7 +3,15 @@
 ################################################################################

 locals {
-  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  default_sg = length(var.security_group_ids) == 0 ? [try(data.aws_security_group.this[0].id, null)] : []
+  endpoints  = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
+data "aws_security_group" "this" {
+  count = var.create ? 1 : 0
+
+  name   = "default"
+  vpc_id = var.vpc_id
 }

 data "aws_vpc_endpoint_service" "this" {
@@ -26,7 +34,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", local.default_sg))) : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", local.default_sg)))

---

Choice B:
modules/vpc-endpoints/README.md
@@ -73,6 +73,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

 ## Inputs
---
modules/vpc-endpoints/main.tf
@@ -3,7 +3,15 @@
 ################################################################################

 locals {
-  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  default_sg = length(var.security_group_ids) == 0 ? [try(data.aws_security_group.this[0].id, null)] : []
+  endpoints  = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
+data "aws_security_group" "this" {
+  count = var.create ? 1 : 0
+
+  name   = "default"
+  vpc_id = var.vpc_id
 }

 data "aws_vpc_endpoint_service" "this" {
@@ : +34,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", local.default_sg))) : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -73,6 +73,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

 ## Inputs
---
modules/vpc-endpoints/main.tf
@@ -3,7 +3,15 @@
 ################################################################################

 locals {
-  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  default_sg = length(var.security_group_ids) == 0 ? [try(data.aws_security_group.this[0].id, null)] : []
+  endpoints  = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
+data "aws_security_group" "this" {
+  count = var.create ? 1 : 0
+
+  name   = "default"
+  vpc_id = var.vpc_id
 }

 data "aws_vpc_endpoint_service" "this" {
@@ -26,7 +34,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", local.default_sg))) : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -73,6 +73,7 @@ No modules.
 | Name | Type |
 |------|------|
 | [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source |
 | [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |

 ## Inputs
---
modules/vpc-endpoints/main.tf
@@ -3,7 +3,15 @@
 ################################################################################

 locals {
-  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  default_sg = length(var.security_group_ids) == 0 ? [try(data.aws_security_group.this[0].id, null)] : []
+  endpoints  = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
+data "aws_security_group" "this" {
+  count = var.create ? 1 : 0
+
+  name   = "default"
+  vpc_id = var.vpc_id
 }

 data "aws_vpc_endpoint_service" "this" {
@@ -26,7 +34,7 @@ resource "aws_vpc_endpoint" "this" {
   vpc_endpoint_type = lookup(each.value, "service_type", "Interface")
   auto_accept       = lookup(each.value, "auto_accept", null)

-  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", []))) : null
+  security_group_ids  = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.security_group_ids, lookup(each.value, "security_group_ids", local.default_sg))) : null
   subnet_ids          = lookup(each.value, "service_type", "Interface") == "Interface" ? distinct(concat(var.subnet_ids, lookup(each.value, "subnet_ids", []))) : null
   route_table_ids     = lookup(each.value, "service_type", "Interface") == "Gateway" ? lookup(each.value, "route_table_ids", null) : null
   policy              = lookup(each.value, "policy", null)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Work in progress. This PR is an idea. I would like to know if it make sense, so I can go further to finish development.

Add customized private subnet blocks (like groups) with the possibility to define different AZ(s) and subnet_suffix (Name tags).

There are some standard blocks, like:

public_subnets: `name-subnet-public-us-east-1a`
database_subnets: `name-subnet-database-us-east-1a`
private_subnets: `name-subnet-private-us-east-1a`
And so on...

They are distributed trough the `var.azs`.

However, It would be great if I could define aditional subnets that can be allocated in a specific AZ:

private_custom_blocks:

`name-subnet-foo-us-west-1a`
`name-subnet-bar-us-west-1a`
And so on...

Input a new optional variable to the module:

```
private_custom_blocks = {
  foo = {
    azs           = ["us-west-2a"]
    subnet_suffix = "subnet-foo"
    tags          = {}
    subnets       = ["10.10.192.0/27", "10.10.192.32/27", "10.10.192.64/27"]
  },
  bar = {
    azs           = ["us-west-2a", "us-west-2b", "us-west-2c"]
    subnet_suffix = "subnet-bar"
    tags          = {}
    subnets       = ["10.10.224.0/27", "10.10.224.32/27", "10.10.224.64/27"]
  },
  xpto = {
    azs           = ["us-west-2a", "us-west-2b", "us-west-2c"]
    subnet_suffix = "subnet-xpto"
    tags = {
      Foo = "bar"
    }
    subnets = ["10.10.240.0/27", "10.10.240.32/27", "10.10.240.64/27"]
  }
}
```
## Motivation and Context

Possibility to create some subnets in a specific AZ to acomplish a different need.

I need to create 3 subnets in us-east-1a to comunicate to my on-prem network. It does not need HA.
To achieve that, I have to create 9 new subnets, distributed trough my `var.azs = ["us-east-1a", "us-east-1b", "us-east-1c"]`.
The other 6 subnets will never be used.

## Breaking Changes

It does not break backwards compatibility. It would be an optional variable.

## How Has This Been Tested?

I have tested it in a fresh implementation of VPC module, creating standard and custom subnets.

---

Choice A:
main.tf
@@ -4,13 +4,28 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(local.private_custom_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(toset(flatten([
+    var.azs,
+    local.private_custom_subnets[*].azs,
+  ]))) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  private_custom_subnets = flatten([
+    for block in var.private_custom_blocks : [
+      for subnet in block.subnets : {
+        subnet        = subnet
+        azs           = block.azs
+        subnet_suffix = block.subnet_suffix
+        tags          = block.tags
+      }
+    ]
+  ])
 }

 ################################################################################
@@ -400,6 +415,31 @@ resource "aws_subnet" "private" {
   )
 }

+################################################################################
+# Custom private subnet
+################################################################################
+
+resource "aws_subnet" "custom" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  vpc_id     = local.vpc_id
+  cidr_block = local.private_custom_subnets[count.index].subnet
+
+  availability_zone    ################################################################################
@@ length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) > 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+  availability_zone_id = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) == 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "${var.name}-${local.private_custom_subnets[count.index].subnet_suffix}-%s",
+        element(local.private_custom_subnets[count.index].azs, count.index),
+      )
+    },
+    var.tags,
+    local.private_custom_subnets[count.index].tags,
+  )
+}
+
 ################################################################################
 # Outpost subnet
 ################################################################################
@@ -1075,6 +1115,16 @@ resource "aws_route_table_association" "private" {
   )
 }

+resource "aws_route_table_association" "custom_private" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  subnet_id = element(aws_subnet.custom[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.private[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
+}
+
 resource "aws_route_table_association" "outpost" {
   count = local.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

---
variables.tf
@@ -1192,3 +1192,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "private_custom_blocks" {
+  type        = map(any)
+  description = "List of maps of customized private subnets"
+  default     = {}
+}
\ No newline at end of file
---

---

Choice B:
main.tf
@@ -4,13 +4,28 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(local.private_custom_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(toset(flatten([
+    var.azs,
+    local.private_custom_subnets[*].azs,
+  ]))) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should tags deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  private_custom_subnets = flatten([
+    for block in var.private_custom_blocks : [
+      for subnet in block.subnets : {
+        subnet        = subnet
+        azs           = block.azs
+        subnet_suffix = block.subnet_suffix
+        tags          = block.tags
+      }
+    ]
+  ])
 }

 ################################################################################
@@ -400,6 +415,31 @@ resource "aws_subnet" "private" {
   )
 }

+################################################################################
+# Custom private subnet
+################################################################################
+
+resource "aws_subnet" "custom" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  vpc_id     = local.vpc_id
+  cidr_block = local.private_custom_subnets[count.index].subnet
+
+  availability_zone    = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) > 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+  availability_zone_id = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) == 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "${var.name}-${local.private_custom_subnets[count.index].subnet_suffix}-%s",
+        element(local.private_custom_subnets[count.index].azs, count.index),
+      )
+    },
+    var.tags,
+    local.private_custom_subnets[count.index].tags,
+  )
+}
+
 ################################################################################
 # Outpost subnet
 ################################################################################
@@ -1075,6 +1115,16 @@ resource "aws_route_table_association" "private" {
   )
 }

+resource "aws_route_table_association" "custom_private" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  subnet_id = element(aws_subnet.custom[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.private[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
+}
+
 resource "aws_route_table_association" "outpost" {
   count = local.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

---
variables.tf
@@ -1192,3 +1192,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "private_custom_blocks" {
+  type        = map(any)
+  description = "List of maps of customized private subnets"
+  default     = {}
+}
\ No newline at end of file
---

---

Choice C:
main.tf
@@ -4,13 +4,28 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(local.private_custom_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(toset(flatten([
+    var.azs,
+    local.private_custom_subnets[*].azs,
+  ]))) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  private_custom_subnets = flatten([
+    for block in var.private_custom_blocks : [
+      for subnet in block.subnets : {
+        subnet        = subnet
+        azs           = block.azs
+        subnet_suffix = block.subnet_suffix
+        tags          = block.tags
+      }
+    ]
+  ])
 }

 ################################################################################
@@ -400,6 +415,31 @@ resource "aws_subnet" "private" {
   )
 }

+################################################################################
+# Custom private subnet
+################################################################################
+
+resource "aws_subnet" "custom" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  vpc_id     = local.vpc_id
+  cidr_block = local.private_custom_subnets[count.index].subnet
+
+  availability_zone    = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) > 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+  availability_zone_id = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) == 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "${var.name}-${local.private_custom_subnets[count.index].subnet_suffix}-%s",
+        element(local.private_custom_subnets[count.index].azs, count.index),
+      )
+    },
+    var.tags,
+    local.private_custom_subnets[count.index].tags,
+  )
+}
+
 ################################################################################
 # Outpost subnet
 ################################################################################
@@ -1075,6 +1115,16 @@ resource "aws_route_table_association" "private" {
   )
 }

+resource "aws_route_table_association" "custom_private" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  subnet_id = element(aws_subnet.custom[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.private[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
+}
+
 resource "aws_route_table_association" "outpost" {
   count = local.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

---
variables.tf
@@ -1192,3 +1192,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "private_custom_blocks" {
+  type        = map(any)
+  description = "List of maps of customized private subnets"
+  default     = {}
+}
\ No newline at end of file
---

---

Choice D:
main.tf
@@ -4,13 +4,28 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(local.private_custom_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(toset(flatten([
+    var.azs,
+    local.private_custom_subnets[*].azs,
+  ]))) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  private_custom_subnets = flatten([
+    for block in var.private_custom_blocks : [
+      for subnet in block.subnets : {
+        subnet        = subnet
+        azs           = block.azs
+        subnet_suffix = block.subnet_suffix
+        tags          = block.tags
+      }
+    ]
+  ])
 }

 ################################################################################
@@ -400,6 +415,31 @@ resource "aws_subnet" "private" {
   )
 }

+################################################################################
+# Custom private subnet
+################################################################################
+
+resource "aws_subnet" "custom" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  vpc_id     = local.vpc_id
+  cidr_block = local.private_custom_subnets[count.index].subnet
+
+  availability_zone    = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) > 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+  availability_zone_id = length(regexall("^[a-z]{2}-", element(local.private_custom_subnets[count.index].azs, count.index))) == 0 ? element(local.private_custom_subnets[count.index].azs, count.index) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "${var.name}-${local.private_custom_subnets[count.index].subnet_suffix}-%s",
+        element(local.private_custom_subnets[count.index].azs, count.index),
+      )
+    },
+    var.tags,
+    local.private_custom_subnets[count.index].tags,
+  )
+}
+
 ################################################################################
 # Outpost subnet
 ################################################################################
@@ -1075,6 +1115,16 @@ resource "aws_route_table_association" "private" {
   )
 }

+resource "aws_route_table_association" "custom_private" {
+  count = var.create_vpc && length(local.private_custom_subnets) > 0 ? length(local.private_custom_subnets) : 0
+
+  subnet_id = element(aws_subnet.custom[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.private[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
+}
+
 resource "aws_route_table_association" "outpost" {
   count = local.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

---
variables.tf
@@ -1192,3 +1192,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "private_custom_blocks" {
+  type        = map(any)
+  description = "List of maps of customized private subnets"
+  default     = {}
+}
\ No newline at end of file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- Compact CIDR block outputs to avoid empty diffs

## Motivation and Context
- Closes #743

## Breaking Changes
- No

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.62.3
+    rev: v1.72.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -23,7 +23,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
outputs.tf
@@ -60,7 +60,7 @@ output "vpc_ipv6_cidr_block" {

 output "vpc_secondary_cidr_blocks" {
   description = "List of secondary CIDR blocks of the VPC"
-  value       = aws_vpc_ipv4_cidr_block_association.this[*].cidr_block
+  value       = compact(aws_vpc_ipv4_cidr_block_association.this[*].cidr_block)
 }

 output "vpc_owner_id" {
@@ -80,12 +80,12 @@ output "private_subnet_arns" {

 output "private_subnets_cidr_blocks" {
   description = "List of cidr_blocks of private subnets"
-  value       = aws_subnet.private[*].cidr_block
+  value       = compact(aws_subnet.private[*].cidr_block)
 }

 output "private_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of private subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.private[*].ipv6_cidr_block
+  value       = compact(aws_subnet.private[*].ipv6_cidr_block)
 }

 output "public_subnets" {
@@ -100,12 +100,12 @@ output "public_subnet_arns" {

 output "public_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public[*].cidr_block
+  value       = repos:
 }

 output "public_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public[*].ipv6_cidr_block
+  value       = compact(aws_subnet.public[*].ipv6_cidr_block)
 }

 output "outpost_subnets" {
@@ -120,12 +120,12 @@ output "outpost_subnet_arns" {

 output "outpost_subnets_cidr_blocks" {
   description = "List of cidr_blocks of outpost subnets"
-  value       = aws_subnet.outpost[*].cidr_block
+  value       = compact(aws_subnet.outpost[*].cidr_block)
 }

 output "outpost_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of outpost subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.outpost[*].ipv6_cidr_block
+  value       = compact(aws_subnet.outpost[*].ipv6_cidr_block)
 }

 output "database_subnets" {
@@ -140,12 +140,12 @@ output "database_subnet_arns" {

 output "database_subnets_cidr_blocks" {
   description = "List of cidr_blocks of database subnets"
-  value       = aws_subnet.database[*].cidr_block
+  value       = compact(aws_subnet.database[*].cidr_block)
 }

 output "database_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of database subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.database[*].ipv6_cidr_block
+  value       = compact(aws_subnet.database[*].ipv6_cidr_block)
 }

 output "database_subnet_group" {
@@ -170,12 +170,12 @@ output "redshift_subnet_arns" {

 output "redshift_subnets_cidr_blocks" {
   description = "List of cidr_blocks of redshift subnets"
-  value       = aws_subnet.redshift[*].cidr_block
+  value       = compact(aws_subnet.redshift[*].cidr_block)
 }

 output "redshift_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of redshift subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.redshift[*].ipv6_cidr_block
+  value       = compact(aws_subnet.redshift[*].ipv6_cidr_block)
 }

 output "redshift_subnet_group" {
@@ -195,12 +195,12 @@ output "elasticache_subnet_arns" {

 output "elasticache_subnets_cidr_blocks" {
   description = "List of cidr_blocks of elasticache subnets"
-  value       = aws_subnet.elasticache[*].cidr_block
+  value       = compact(aws_subnet.elasticache[*].cidr_block)
 }

 output "elasticache_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of elasticache subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.elasticache[*].ipv6_cidr_block
+  value       = compact(aws_subnet.elasticache[*].ipv6_cidr_block)
 }

 output "intra_subnets" {
@@ -215,12 +215,12 @@ output "intra_subnet_arns" {

 output "intra_subnets_cidr_blocks" {
   description = "List of cidr_blocks of intra subnets"
-  value       = aws_subnet.intra[*].cidr_block
+  value       = compact(aws_subnet.intra[*].cidr_block)
 }

 output "intra_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of intra subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.intra[*].ipv6_cidr_block
+  value       = compact(aws_subnet.intra[*].ipv6_cidr_block)
 }

 output "elasticache_subnet_group" {
---

---

Choice B:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.62.3
+    rev: v1.72.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -23,7 +23,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
outputs.tf
@@ -60,7 +60,7 @@ output "vpc_ipv6_cidr_block" {

 output "vpc_secondary_cidr_blocks" {
   description = "List of secondary CIDR blocks of the VPC"
-  value       = aws_vpc_ipv4_cidr_block_association.this[*].cidr_block
+  value       = compact(aws_vpc_ipv4_cidr_block_association.this[*].cidr_block)
 }

 output "vpc_owner_id" {
@@ -80,12 +80,12 @@ output "private_subnet_arns" {

 output "private_subnets_cidr_blocks" {
   description = "List of cidr_blocks of private subnets"
-  value       = aws_subnet.private[*].cidr_block
+  value       = compact(aws_subnet.private[*].cidr_block)
 }

 output "private_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of private subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.private[*].ipv6_cidr_block
+  value       = compact(aws_subnet.private[*].ipv6_cidr_block)
 }

 output "public_subnets" {
@@ -100,12 +100,12 @@ output "public_subnet_arns" {

 output "public_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public[*].cidr_block
+  value       = compact(aws_subnet.public[*].cidr_block)
 }

 output "public_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public[*].ipv6_cidr_block
+  value       = compact(aws_subnet.public[*].ipv6_cidr_block)
 }

 output "outpost_subnets" {
@@ -120,12 +120,12 @@ output "outpost_subnet_arns" {

 output "outpost_subnets_cidr_blocks" {
   description = "List of cidr_blocks of outpost subnets"
-  value       = aws_subnet.outpost[*].cidr_block
+  value       = compact(aws_subnet.outpost[*].cidr_block)
 }

 output "outpost_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of outpost subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.outpost[*].ipv6_cidr_block
+  value       = compact(aws_subnet.outpost[*].ipv6_cidr_block)
 }

 output "database_subnets" {
@@ -140,12 +140,12 @@ output "database_subnet_arns" {

 output "database_subnets_cidr_blocks" {
   description = "List of cidr_blocks of database subnets"
-  value       = aws_subnet.database[*].cidr_block
+  value       = compact(aws_subnet.database[*].cidr_block)
 }

 output "database_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of database subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.database[*].ipv6_cidr_block
+  value       = compact(aws_subnet.database[*].ipv6_cidr_block)
 }

 output "database_subnet_group" {
@@ -170,12 compact(aws_vpc_ipv4_cidr_block_association.this[*].cidr_block)
 @@ output "redshift_subnet_arns" {

 output "redshift_subnets_cidr_blocks" {
   description = "List of cidr_blocks of redshift subnets"
-  value       = aws_subnet.redshift[*].cidr_block
+  value       = compact(aws_subnet.redshift[*].cidr_block)
 }

 output "redshift_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of redshift subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.redshift[*].ipv6_cidr_block
+  value       = compact(aws_subnet.redshift[*].ipv6_cidr_block)
 }

 output "redshift_subnet_group" {
@@ -195,12 +195,12 @@ output "elasticache_subnet_arns" {

 output "elasticache_subnets_cidr_blocks" {
   description = "List of cidr_blocks of elasticache subnets"
-  value       = aws_subnet.elasticache[*].cidr_block
+  value       = compact(aws_subnet.elasticache[*].cidr_block)
 }

 output "elasticache_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of elasticache subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.elasticache[*].ipv6_cidr_block
+  value       = compact(aws_subnet.elasticache[*].ipv6_cidr_block)
 }

 output "intra_subnets" {
@@ -215,12 +215,12 @@ output "intra_subnet_arns" {

 output "intra_subnets_cidr_blocks" {
   description = "List of cidr_blocks of intra subnets"
-  value       = aws_subnet.intra[*].cidr_block
+  value       = compact(aws_subnet.intra[*].cidr_block)
 }

 output "intra_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of intra subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.intra[*].ipv6_cidr_block
+  value       = compact(aws_subnet.intra[*].ipv6_cidr_block)
 }

 output "elasticache_subnet_group" {
---

---

Choice C:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.62.3
+    rev: v1.72.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -23,7 +23,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
outputs.tf
@@ -60,7 +60,7 @@ output "vpc_ipv6_cidr_block" {

 output "vpc_secondary_cidr_blocks" {
   description = "List of secondary CIDR blocks of the VPC"
-  value       = aws_vpc_ipv4_cidr_block_association.this[*].cidr_block
+  value       = compact(aws_vpc_ipv4_cidr_block_association.this[*].cidr_block)
 }

 output "vpc_owner_id" {
@@ -80,12 +80,12 @@ output "private_subnet_arns" {

 output "private_subnets_cidr_blocks" {
   description = "List of cidr_blocks of private subnets"
-  value       = aws_subnet.private[*].cidr_block
+  value       = compact(aws_subnet.private[*].cidr_block)
 }

 output "private_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of private subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.private[*].ipv6_cidr_block
+  value       = compact(aws_subnet.private[*].ipv6_cidr_block)
 }

 output "public_subnets" {
@@ -100,12 +100,12 @@ output "public_subnet_arns" {

 output "public_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public[*].cidr_block
+  value       = compact(aws_subnet.public[*].cidr_block)
 }

 output "public_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public[*].ipv6_cidr_block
+  value       = compact(aws_subnet.public[*].ipv6_cidr_block)
 }

 output "outpost_subnets" {
@@ -120,12 +120,12 @@ output "outpost_subnet_arns" {

 output "outpost_subnets_cidr_blocks" {
   description = "List of cidr_blocks of outpost subnets"
-  value       = aws_subnet.outpost[*].cidr_block
+  value       = compact(aws_subnet.outpost[*].cidr_block)
 }

 output "outpost_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of outpost subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.outpost[*].ipv6_cidr_block
+  value       = compact(aws_subnet.outpost[*].ipv6_cidr_block)
 }

 output "database_subnets" {
@@ -140,12 +140,12 @@ output "database_subnet_arns" {

 output "database_subnets_cidr_blocks" {
   description = "List of cidr_blocks of database subnets"
-  value       = aws_subnet.database[*].cidr_block
+  value       = compact(aws_subnet.database[*].cidr_block)
 }

 output "database_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of database subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.database[*].ipv6_cidr_block
+  value       = compact(aws_subnet.database[*].ipv6_cidr_block)
 }

 output "database_subnet_group" {
@@ -170,12 +170,12 @@ output "redshift_subnet_arns" {

 output "redshift_subnets_cidr_blocks" {
   description = "List of cidr_blocks of redshift subnets"
-  value       = aws_subnet.redshift[*].cidr_block
+  value       = compact(aws_subnet.redshift[*].cidr_block)
 }

 output "redshift_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of redshift subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.redshift[*].ipv6_cidr_block
+  value       = compact(aws_subnet.redshift[*].ipv6_cidr_block)
 }

 output "redshift_subnet_group" {
@@ -195,12 +195,12 @@ output "elasticache_subnet_arns" {

 output "elasticache_subnets_cidr_blocks" {
   description = "List of cidr_blocks of elasticache subnets"
-  value       = aws_subnet.elasticache[*].cidr_block
+  value       = compact(aws_subnet.elasticache[*].cidr_block)
 }

 output "elasticache_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of elasticache subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.elasticache[*].ipv6_cidr_block
+  value       = compact(aws_subnet.elasticache[*].ipv6_cidr_block)
 }

 output "intra_subnets" {
@@ -215,12 +215,12 @@ output "intra_subnet_arns" {

 output "intra_subnets_cidr_blocks" {
   description = "List of cidr_blocks of intra subnets"
-  value       = aws_subnet.intra[*].cidr_block
+  value       = compact(aws_subnet.intra[*].cidr_block)
 }

 output "intra_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of intra subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.intra[*].ipv6_cidr_block
+  value       = compact(aws_subnet.intra[*].ipv6_cidr_block)
 }

 output "elasticache_subnet_group" {
---

---

Choice D:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.62.3
+    rev: v1.72.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -23,7 +23,7 @@ repos:
           - '--args=--only=terraform_standard_module_structure'
           - '--args=--only=terraform_workspace_remote'
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.3.0
     hooks:
       - id: check-merge-conflict
       - id: end-of-file-fixer
---
outputs.tf
@@ -60,7 +60,7 @@ output "vpc_ipv6_cidr_block" {

 output "vpc_secondary_cidr_blocks" {
   description = "List of secondary CIDR blocks of the VPC"
-  value       = aws_vpc_ipv4_cidr_block_association.this[*].cidr_block
+  value       = compact(aws_vpc_ipv4_cidr_block_association.this[*].cidr_block)
 }

 output "vpc_owner_id" {
@@ -80,12 +80,12 @@ output "private_subnet_arns" {

 output "private_subnets_cidr_blocks" {
   description = "List of cidr_blocks of private subnets"
-  value       = aws_subnet.private[*].cidr_block
+  value       = compact(aws_subnet.private[*].cidr_block)
 }

 output "private_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of private subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.private[*].ipv6_cidr_block
+  value       = compact(aws_subnet.private[*].ipv6_cidr_block)
 }

 output "public_subnets" {
@@ -100,12 +100,12 @@ output "public_subnet_arns" {

 output "public_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public[*].cidr_block
+  value       = compact(aws_subnet.public[*].cidr_block)
 }

 output "public_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public[*].ipv6_cidr_block
+  value       = compact(aws_subnet.public[*].ipv6_cidr_block)
 }

 output "outpost_subnets" {
@@ -120,12 +120,12 @@ output "outpost_subnet_arns" {

 output "outpost_subnets_cidr_blocks" {
   description = "List of cidr_blocks of outpost subnets"
-  value       = aws_subnet.outpost[*].cidr_block
+  value       = compact(aws_subnet.outpost[*].cidr_block)
 }

 output "outpost_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of outpost subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.outpost[*].ipv6_cidr_block
+  value       = compact(aws_subnet.outpost[*].ipv6_cidr_block)
 }

 output "database_subnets" {
@@ -140,12 +140,12 @@ output "database_subnet_arns" {

 output "database_subnets_cidr_blocks" {
   description = "List of cidr_blocks of database subnets"
-  value       = aws_subnet.database[*].cidr_block
+  value       = compact(aws_subnet.database[*].cidr_block)
 }

 output "database_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of database subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.database[*].ipv6_cidr_block
+  value       = compact(aws_subnet.database[*].ipv6_cidr_block)
 }

 output "database_subnet_group" {
@@ -170,12 +170,12 @@ output "redshift_subnet_arns" {

 output "redshift_subnets_cidr_blocks" {
   description = "List of cidr_blocks of redshift subnets"
-  value       = aws_subnet.redshift[*].cidr_block
+  value       = compact(aws_subnet.redshift[*].cidr_block)
 }

 output "redshift_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of redshift subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.redshift[*].ipv6_cidr_block
+  value       = compact(aws_subnet.redshift[*].ipv6_cidr_block)
 }

 output "redshift_subnet_group" {
@@ -195,12 +195,12 @@ output "elasticache_subnet_arns" {

 output "elasticache_subnets_cidr_blocks" {
   description = "List of cidr_blocks of elasticache subnets"
-  value       = aws_subnet.elasticache[*].cidr_block
+  value       = compact(aws_subnet.elasticache[*].cidr_block)
 }

 output "elasticache_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of elasticache subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.elasticache[*].ipv6_cidr_block
+  value       = compact(aws_subnet.elasticache[*].ipv6_cidr_block)
 }

 output "intra_subnets" {
@@ -215,12 +215,12 @@ output "intra_subnet_arns" {

 output "intra_subnets_cidr_blocks" {
   description = "List of cidr_blocks of intra subnets"
-  value       = aws_subnet.intra[*].cidr_block
+  value       = compact(aws_subnet.intra[*].cidr_block)
 }

 output "intra_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of intra subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.intra[*].ipv6_cidr_block
+  value       = compact(aws_subnet.intra[*].ipv6_cidr_block)
 }

 output "elasticache_subnet_group" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Prevent creation of data resources for VPC endpoints that are disabled.

## Motivation and Context
The data resources and resources for VPC endpoints are now in sync.

## Breaking Changes
No breaking change

## How Has This Been Tested?
- [x] I have tested and validated these changes using one of my own projects.

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -2,8 +2,12 @@
 # Endpoint(s)
 ################################################################################

+locals {
+  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
 data "aws_vpc_endpoint_service" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = local.endpoints

   service      = lookup(each.value, "service", null)
   service_name = lookup(each.value, "service_name", null)
@@ -15,7 +19,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  for_each = local.endpoints

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -2,8 +2,12 @@
 # Endpoint(s)
 ################################################################################

+locals {
+  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
 data "aws_vpc_endpoint_service" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = local.endpoints

   service      = lookup(each.value, "service", null)
   service_name = lookup(each.value, "service_name", null)
@@ -15,7 +19,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint"  {
-  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  for_each = local.endpoints

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -2,8 +2,12 @@
 # Endpoint(s)
 ################################################################################

+locals {
+  endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
 data "aws_vpc_endpoint_service" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = local.endpoints

   service      = lookup(each.value, "service", null)
   service_name = lookup(each.value, "service_name", null)
@@ -15,7 +19,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  for_each = local.endpoints

   vpc_id            = var.vpc_id
   service_name    if  = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -2,8 +2,12 @@
 # Endpoint(s)
 ################################################################################

+locals {
+ "aws_vpc_endpoint_service" endpoints = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+}
+
 data "aws_vpc_endpoint_service" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = local.endpoints

   service      = lookup(each.value, "service", null)
   service_name = lookup(each.value, "service_name", null)
@@ -15,7 +19,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }
+  for_each = local.endpoints

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/complete-vpc/main.tf
@@ -6,7 +6,7 @@ locals {
   name   = "complete-example"
   region = "eu-west-1"
   tags = {
-    Owner       = "user"
+    Owner       = "testuser"
     Environment = "staging"
     Name        = "complete"
   }
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -6,7 +6,7 @@ locals {
   name   = "complete-example"
   region = "eu-west-1"
   tags = {
-    Owner       = "user"
+    Owner       = "testuser"
     Environment = "staging"
     Name        = "complete"
   }
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -6,7 +6,7 @@ locals {
   name   = "complete-example"
   region = "eu-west-1"
   tags = {
-    Owner       = "user"
+    Owner       = "testuser"
     Environment = "staging"
     Name        = "complete"
   }
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -6,7 +6,7 @@ locals {
   name   = "complete-example"
   region = "eu-west-1"
   tags = {
-    Owner       = "user"
+    Owner       = "testuser"
     Environment = "staging"
     Name        = "complete"
   }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add support for passing `ipv6_ipam_pool_id` and `assign_generated_ipv6_cidr_block` arguments to the `aws_vpc` resource.

## Motivation and Context
I have a VPC where I need to pass the `ipv6_ipam_pool_id` and I couldn't do that without adding this feature.

## Breaking Changes
None, the module works the same as it does today.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s); I did not update any of the examples to test the new feature because BYOIPv6 is difficult to setup / test in a development environment.
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects; existing examples work as they did before if you don't pass in the new argument: `ipv6_ipam_pool_id`
- [x] I used the module for my own VPC and used the new argument `ipv6_ipam_pool_id` and it worked as expected.
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -304,6 +304,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `false` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden | `string` | `"0.0.0.0/0"` | no |
@@ -405,6 +406,7 @@ No modules.
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets | `list(string)` | `[]` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | IPAM Pool ID for an IPv6 pool. | `string` | `null` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `false` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `false` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `false` | no |
---
main.tf
@@ -26,7 +26,8 @@ resource "aws_vpc" "this" {
   enable_dns_support               = var.enable_dns_support
   enable_classiclink               = var.enable_classiclink
   enable_classiclink_dns_support   = var.enable_classiclink_dns_support
-  assign_generated_ipv6_cidr_block = var.enable_ipv6
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && var.assign_generated_ipv6_cidr_block ? true : null
+  ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id

   tags = merge(
     { "Name" = var.name },
---
variables.tf
@@ -22,6 +22,18 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = false
+}
+
+variable "ipv6_ipam_pool_id" {
+  description = "IPAM Pool ID for an IPv6 pool."
+  type        = string
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice B:
README.md
@@ -304,6 +304,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `false` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or | in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden | `string` | `"0.0.0.0/0"` | no |
@@ -405,6 +406,7 @@ No modules.
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets | `list(string)` | `[]` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | IPAM Pool ID for an IPv6 pool. | `string` | `null` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `false` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `false` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `false` | no |
---
main.tf
@@ -26,7 +26,8 @@ resource "aws_vpc" "this" {
   enable_dns_support               = var.enable_dns_support
   enable_classiclink               = var.enable_classiclink
   enable_classiclink_dns_support   = var.enable_classiclink_dns_support
-  assign_generated_ipv6_cidr_block = var.enable_ipv6
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && var.assign_generated_ipv6_cidr_block ? true : null
+  ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id

   tags = merge(
     { "Name" = var.name },
---
variables.tf
@@ -22,6 +22,18 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = false
+}
+
+variable "ipv6_ipam_pool_id" {
+  description = "IPAM Pool ID for an IPv6 pool."
+  type        = string
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice C:
README.md
@@ -304,6 +304,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `false` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden | `string` | `"0.0.0.0/0"` | no |
@@ -405,6 +406,7 @@ No modules.
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets | `list(string)` | `[]` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | IPAM Pool ID for an IPv6 pool. | `string` | `null` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `false` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `false` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `false` | no |
---
main.tf
@@ -26,7 +26,8 @@ resource "aws_vpc" "this" {
   enable_dns_support               = var.enable_dns_support
   enable_classiclink               = var.enable_classiclink
   enable_classiclink_dns_support   = var.enable_classiclink_dns_support
-  assign_generated_ipv6_cidr_block = var.enable_ipv6
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && var.assign_generated_ipv6_cidr_block ? true : null
+  ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id

   tags = merge(
     { "Name" = var.name },
---
variables.tf
@@ -22,6 +22,18 @@ variable "enable_ipv6" {
   default     = false
 {

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = false
+}
+
+variable "ipv6_ipam_pool_id" {
+  description = "IPAM Pool ID for an IPv6 pool."
+  type        = string
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice D:
README.md
@@ -304,6 +304,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `false` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden | `string` | `"0.0.0.0/0"` | no |
@@ -405,6 +406,7 @@ No modules.
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets | `list(string)` | `[]` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | IPAM Pool ID for an IPv6 pool. | `string` | `null` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `false` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `false` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `false` | no |
---
main.tf
@@ -26,7 +26,8 @@ resource "aws_vpc" "this" {
   enable_dns_support               = var.enable_dns_support
   enable_classiclink       the        = var.enable_classiclink
   enable_classiclink_dns_support   = var.enable_classiclink_dns_support
-  assign_generated_ipv6_cidr_block = var.enable_ipv6
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && var.assign_generated_ipv6_cidr_block ? true : null
+  ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id

   tags = merge(
     { "Name" = var.name },
---
variables.tf
@@ -22,6 +22,18 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = false
+}
+
+variable "ipv6_ipam_pool_id" {
+  description = "IPAM Pool ID for an IPv6 pool."
+  type        = string
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---