Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adding missing DMS endpoint

## Motivation and Context
DMS endpoint is missing

---

Choice A:
README.md
@@ -26,7 +26,7 @@ Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, Sa
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
-Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure
+Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS

 * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
 * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
@@ -350,6 +350,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dhcp\_options\_netbios\_node\_type | Specify netbios node\_type for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `""` | no |
 | dhcp\_options\_ntp\_servers | Specify a list of NTP servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no |
 | dhcp\_options\_tags | Additional tags for the DHCP option set (requires enable\_dhcp\_options set to true) | `map(string)` | `{}` | no |
+| dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
+| dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
+| dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -428,6 +431,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_config\_endpoint | Should be true if you want to provision an config endpoint to the VPC | `bool` | `false` | no |
 | enable\_datasync\_endpoint | Should be true if you want to provision an Data Sync endpoint to the VPC | `bool` | `false` | no |
 | enable\_dhcp\_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | `bool` | `false` | no |
+| enable\_dms\_endpoint | Should be true if you want to provision a DMS endpoint to the VPC | `bool` | `false` | no |
 | enable\_dns\_hostnames | Should be true to enable DNS hostnames in the VPC | `bool` | `false` | no |
 | enable\_dns\_support | Should be true to enable DNS support in the VPC | `bool` | `true` | no |
 | enable\_dynamodb\_endpoint | Should be true if you want to provision a DynamoDB endpoint to the VPC | `bool` | `false` | no |
@@ -799,6 +803,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_datasync\_dns\_entry | The DNS entries for the VPC Endpoint for DataSync. |
 | vpc\_endpoint\_datasync\_id | The ID of VPC endpoint for DataSync |
 | vpc\_endpoint\_datasync\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DataSync. |
+| vpc\_endpoint\_dms\_dns\_entry | The DNS entries for the VPC Endpoint for DMS. |
+| vpc\_endpoint\_dms\_id | The ID of VPC endpoint for DMS |
+| vpc\_endpoint\_dms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DMS. |
 | vpc\_endpoint\_dynamodb\_id | The ID of VPC endpoint for DynamoDB |
 | vpc\_endpoint\_dynamodb\_pl\_id | The prefix list for the DynamoDB VPC endpoint. |
 | vpc\_endpoint\_ebs\_dns\_entry | The DNS entries for the VPC Endpoint for EBS. |
---
outputs.tf
@@ -1407,6 +1407,21 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_dms_id" {
+  description = "The ID of VPC endpoint for DMS"
+  value       = concat(aws_vpc_endpoint.sns.*.id, [""])[0]
+}
+
+output "vpc_endpoint_dms_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.network_interface_ids)
+}
+
+output "vpc_endpoint_dms_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.dns_entry)
+}
+
 output "vpc_endpoint_rds_id" {
   description = "The ID of VPC endpoint for RDS"
   value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
@@ -1422,7 +1437,6 @@ output "vpc_endpoint_rds_dns_entry" {
   value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
 }

-
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---
variables.tf
@@ -1883,6 +1883,30 @@ variable "acm_pca_endpoint_private_dns_enabled" {
   default     = false
 }
 = "enable_dms_endpoint" {
+  description = "Should be true if you want to provision a DMS endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "dms_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for DMS endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "map_public_ip_on_launch" {
   description = "Should be false if you do not want to auto-assign public IP on launch"
   type        = bool
---
vpc-endpoints.tf
@@ -1529,3 +1529,27 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {

   tags = local.vpce_tags
 }
+
+
+#############################################
+# VPC Endpoint for Database Migration Service
+#############################################
+data "aws_vpc_endpoint_service" "dms" {
+  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+
+  service = "dms"
+}
+
+resource "aws_vpc_endpoint" "dms" {
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.dms[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.dms_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.dms_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.dms_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
---

---

Choice B:
README.md
@@ -26,7 +26,7 @@ Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, Sa
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
-Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure
+Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS

 * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
 * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
@@ -350,6 +350,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dhcp\_options\_netbios\_node\_type | Specify netbios node\_type for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `""` | no |
 | dhcp\_options\_ntp\_servers | Specify a list of NTP servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no |
 | dhcp\_options\_tags | Additional tags for the DHCP  set (requires enable\_dhcp\_options set to true) | `map(string)` | `{}` | no |
+| dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
+| dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
+| dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -428,6 +431,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_config\_endpoint | Should be true if you want to provision an config endpoint to the VPC | `bool` | `false` | no |
 | enable\_datasync\_endpoint | Should be true if you want to provision an Data Sync endpoint to the VPC | `bool` | `false` | no |
 | enable\_dhcp\_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | `bool` | `false` | no |
+| enable\_dms\_endpoint | Should be true if you want to provision a DMS endpoint to the VPC | `bool` | `false` | no |
 | enable\_dns\_hostnames | Should be true to enable DNS hostnames in the VPC | `bool` | `false` | no |
 | enable\_dns\_support | Should be true to enable DNS support in the VPC | `bool` | `true` | no |
 | enable\_dynamodb\_endpoint | Should be true if you want to provision a DynamoDB endpoint to the VPC | `bool` | `false` | no |
@@ -799,6 +803,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_datasync\_dns\_entry | The DNS entries for the VPC Endpoint for DataSync. |
 | vpc\_endpoint\_datasync\_id | The ID of VPC endpoint for DataSync |
 | vpc\_endpoint\_datasync\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DataSync. |
+| vpc\_endpoint\_dms\_dns\_entry | The DNS entries for the VPC Endpoint for DMS. |
+| vpc\_endpoint\_dms\_id | The ID of VPC endpoint for DMS |
+| vpc\_endpoint\_dms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DMS. |
 | vpc\_endpoint\_dynamodb\_id | The ID of VPC endpoint for DynamoDB |
 | vpc\_endpoint\_dynamodb\_pl\_id | The prefix list for the DynamoDB VPC endpoint. |
 | vpc\_endpoint\_ebs\_dns\_entry | The DNS entries for the VPC Endpoint for EBS. |
---
outputs.tf
@@ -1407,6 +1407,21 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_dms_id" {
+  description = "The ID of VPC endpoint for DMS"
+  value       = concat(aws_vpc_endpoint.sns.*.id, [""])[0]
+}
+
+output "vpc_endpoint_dms_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.network_interface_ids)
+}
+
+output "vpc_endpoint_dms_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.dns_entry)
+}
+
 output "vpc_endpoint_rds_id" {
   description = "The ID of VPC endpoint for RDS"
   value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
@@ -1422,7 +1437,6 @@ output "vpc_endpoint_rds_dns_entry" {
   value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
 }

-
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---
variables.tf
@@ -1883,6 +1883,30 @@ variable "acm_pca_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_dms_endpoint" {
+  description = "Should be true if you want to provision a DMS endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "dms_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for DMS endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "map_public_ip_on_launch" {
   description = "Should be false if you do not want to auto-assign public IP on launch"
   type        = bool
---
vpc-endpoints.tf
@@ -1529,3 +1529,27 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {

   tags = local.vpce_tags
 }
+
+
+#############################################
+# VPC Endpoint for Database Migration Service
+#############################################
+data "aws_vpc_endpoint_service" "dms" {
+  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+
+  service = "dms"
+}
+
+resource "aws_vpc_endpoint" "dms" {
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.dms[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.dms_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.dms_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.dms_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
---

---

Choice C:
README.md
@@ -26,7 +26,7 @@ Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, Sa
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
-Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure
+Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS

 * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
 * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
@@ -350,6 +350,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dhcp\_options\_netbios\_node\_type | Specify netbios node\_type for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `""` | no |
 | dhcp\_options\_ntp\_servers | Specify a list of NTP servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no |
 | dhcp\_options\_tags | Additional tags for the DHCP option set (requires enable\_dhcp\_options set to true) | `map(string)` | `{}` | no |
+| dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
+| dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
+| dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -428,6 +431,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_config\_endpoint | Should be true if you want to provision an config endpoint to the VPC | `bool` | `false` | no |
 | enable\_datasync\_endpoint | Should be true if you want to provision an Data Sync endpoint to the VPC | `bool` | `false` | no |
 | enable\_dhcp\_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | `bool` | `false` | no |
+| enable\_dms\_endpoint | Should be true if you want to provision a DMS endpoint to the VPC | `bool` | `false` | no |
 | enable\_dns\_hostnames | Should be true to enable DNS hostnames in the VPC | `bool` | `false` | no |
 | enable\_dns\_support | Should be true to enable DNS support in the VPC | `bool` | `true` | no |
 | enable\_dynamodb\_endpoint | Should be true if you want to provision a DynamoDB endpoint to the VPC | `bool` | `false` | no |
@@ -799,6 +803,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_datasync\_dns\_entry | The DNS entries for the VPC Endpoint for DataSync. |
 | vpc\_endpoint\_datasync\_id | The ID of VPC endpoint for DataSync |
 | vpc\_endpoint\_datasync\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DataSync. |
+| vpc\_endpoint\_dms\_dns\_entry | The DNS entries for the VPC Endpoint for DMS. |
+| vpc\_endpoint\_dms\_id | The ID of VPC endpoint for DMS |
+| vpc\_endpoint\_dms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DMS. |
 | vpc\_endpoint\_dynamodb\_id | The ID of VPC endpoint for DynamoDB |
 | vpc\_endpoint\_dynamodb\_pl\_id | The prefix list for the DynamoDB VPC endpoint. |
 | vpc\_endpoint\_ebs\_dns\_entry | The DNS entries for the VPC Endpoint for EBS. |
---
outputs.tf
@@ -1407,6 +1407,21 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_dms_id" {
+  description = "The ID of VPC endpoint for DMS"
+  value       = concat(aws_vpc_endpoint.sns.*.id, [""])[0]
+}
+
+output "vpc_endpoint_dms_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.network_interface_ids)
+}
+
+output "vpc_endpoint_dms_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.dns_entry)
+}
+
 output "vpc_endpoint_rds_id" {
   description = "The ID of VPC endpoint for RDS"
   value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
@@ -1422,7 +1437,6 @@ output "vpc_endpoint_rds_dns_entry" {
   value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
 }

-
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---
variables.tf
@@ -1883,6 +1883,30 @@ variable "acm_pca_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_dms_endpoint" {
+  description = "Should be true if you want to provision a DMS endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "dms_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for DMS endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "map_public_ip_on_launch" {
   description = "Should be false if you do not want to auto-assign public IP on launch"
   type        = bool
---
vpc-endpoints.tf
@@ -1529,3 +1529,27 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {

   tags = local.vpce_tags
 }
+
+
+#############################################
+# VPC Endpoint for Database Migration Service
+#############################################
+data "aws_vpc_endpoint_service" "dms" {
+  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+
+  service = "dms"
+}
+
+resource "aws_vpc_endpoint" "dms" {
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.dms[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.dms_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.dms_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.dms_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
---

---

Choice D:
README.md
@@ -26,7 +26,7 @@ Git-Codecommit, Textract, Transfer Server, Kinesis Streams, Kinesis Firehose, Sa
 CloudFormation, CodePipeline, Storage Gateway, AppMesh, Transfer, Service Catalog, AppStream API, AppStream Streaming,
 Athena, Rekognition, Elastic File System (EFS), Cloud Directory, Elastic Beanstalk (+ Health), Elastic Map Reduce(EMR),
 DataSync, EBS, SMS, Elastic Inference Runtime, QLDB Session, Step Functions, Access Analyzer, Auto Scaling Plans,
-Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure
+Application Auto Scaling, Workspaces, ACM PCA, RDS, CodeDeploy, CodeDeploy Commands Secure, DMS

 * [RDS DB Subnet Group](https://www.terraform.io/docs/providers/aws/r/db_subnet_group.html)
 * [ElastiCache Subnet Group](https://www.terraform.io/docs/providers/aws/r/elasticache_subnet_group.html)
@@ -350,6 +350,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | dhcp\_options\_netbios\_node\_type | Specify netbios node\_type for DHCP options set (requires enable\_dhcp\_options set to true) | `string` | `""` | no |
 | dhcp\_options\_ntp\_servers | Specify a list of NTP servers for DHCP options set (requires enable\_dhcp\_options set to true) | `list(string)` | `[]` | no |
 | dhcp\_options\_tags | Additional tags for the DHCP option set (requires enable\_dhcp\_options set to true) | `map(string)` | `{}` | no |
+| dms\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint | `bool` | `false` | no |
+| dms\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for DMS endpoint | `list(string)` | `[]` | no |
+| dms\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an | is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | ebs\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for EBS endpoint | `bool` | `false` | no |
 | ebs\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for EBS endpoint | `list(string)` | `[]` | no |
 | ebs\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for EBS endpoint. Only a single subnet within an AZ is supported. Ifomitted, private subnets will be used. | `list(string)` | `[]` | no |
@@ -428,6 +431,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | enable\_config\_endpoint | Should be true if you want to provision an config endpoint to the VPC | `bool` | `false` | no |
 | enable\_datasync\_endpoint | Should be true if you want to provision an Data Sync endpoint to the VPC | `bool` | `false` | no |
 | enable\_dhcp\_options | Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type | `bool` | `false` | no |
+| enable\_dms\_endpoint | Should be true if you want to provision a DMS endpoint to the VPC | `bool` | `false` | no |
 | enable\_dns\_hostnames | Should be true to enable DNS hostnames in the VPC | `bool` | `false` | no |
 | enable\_dns\_support | Should be true to enable DNS support in the VPC | `bool` | `true` | no |
 | enable\_dynamodb\_endpoint | Should be true if you want to provision a DynamoDB endpoint to the VPC | `bool` | `false` | no |
@@ -799,6 +803,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_datasync\_dns\_entry | The DNS entries for the VPC Endpoint for DataSync. |
 | vpc\_endpoint\_datasync\_id | The ID of VPC endpoint for DataSync |
 | vpc\_endpoint\_datasync\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DataSync. |
+| vpc\_endpoint\_dms\_dns\_entry | The DNS entries for the VPC Endpoint for DMS. |
+| vpc\_endpoint\_dms\_id | The ID of VPC endpoint for DMS |
+| vpc\_endpoint\_dms\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for DMS. |
 | vpc\_endpoint\_dynamodb\_id | The ID of VPC endpoint for DynamoDB |
 | vpc\_endpoint\_dynamodb\_pl\_id | The prefix list for the DynamoDB VPC endpoint. |
 | vpc\_endpoint\_ebs\_dns\_entry | The DNS entries for the VPC Endpoint for EBS. |
---
outputs.tf
@@ -1407,6 +1407,21 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_dms_id" {
+  description = "The ID of VPC endpoint for DMS"
+  value       = concat(aws_vpc_endpoint.sns.*.id, [""])[0]
+}
+
+output "vpc_endpoint_dms_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.network_interface_ids)
+}
+
+output "vpc_endpoint_dms_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for DMS."
+  value       = flatten(aws_vpc_endpoint.sns.*.dns_entry)
+}
+
 output "vpc_endpoint_rds_id" {
   description = "The ID of VPC endpoint for RDS"
   value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
@@ -1422,7 +1437,6 @@ output "vpc_endpoint_rds_dns_entry" {
   value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
 }

-
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---
variables.tf
@@ -1883,6 +1883,30 @@ variable "acm_pca_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_dms_endpoint" {
+  description = "Should be true if you want to provision a DMS endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "dms_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for DMS endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for DMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "dms_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for DMS endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "map_public_ip_on_launch" {
   description = "Should be false if you do not want to auto-assign public IP on launch"
   type        = bool
---
vpc-endpoints.tf
@@ -1529,3 +1529,27 @@ resource "aws_vpc_endpoint" "codeartifact_repositories" {

   tags = local.vpce_tags
 }
+
+
+#############################################
+# VPC Endpoint for Database Migration Service
+#############################################
+data "aws_vpc_endpoint_service" "dms" {
+  count = var.create_vpc && var.dms_endpoint_subnet_ids ? 1 : 0
+
+  service = "dms"
+}
+
+resource "aws_vpc_endpoint" "dms" {
+  count = var.create_vpc && var.enable_dms_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.dms[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.dms_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.dms_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.dms_endpoint_private_dns_enabled
+
+  tags = local.vpce_tags
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
RDS endpoint is missing from the outputs.

## Motivation and Context
RDS endpoint is missing from the outputs.

---

Choice A:
README.md
@@ -876,6 +876,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_qldb\_session\_dns\_entry | The DNS entries for the VPC Endpoint for QLDB Session. |
 | vpc\_endpoint\_qldb\_session\_id | The ID of VPC endpoint for QLDB Session |
 | vpc\_endpoint\_qldb\_session\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for QLDB Session. |
+| vpc\_endpoint\_rds\_dns\_entry | The DNS entries for the VPC Endpoint for RDS. |
+| vpc\_endpoint\_rds\_id | The ID of VPC endpoint for RDS |
+| vpc\_endpoint\_rds\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for RDS. |
 | vpc\_endpoint\_rekognition\_dns\_entry | The DNS entries for the VPC Endpoint for Rekognition. |
 | vpc\_endpoint\_rekognition\_id | The ID of VPC endpoint for Rekognition |
 | vpc\_endpoint\_rekognition\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Rekognition. |
---
outputs.tf
@@ -1407,6 +1407,22 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_rds_id" {
+  description = "The ID of VPC endpoint for RDS"
+  value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
+}
+
+output "vpc_endpoint_rds_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.network_interface_ids)
+}
+
+output "vpc_endpoint_rds_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
+}
+
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---

---

Choice B:
README.md
@@ -876,6 +876,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_qldb\_session\_dns\_entry | The DNS entries for the VPC Endpoint for QLDB Session. |
 | vpc\_endpoint\_qldb\_session\_id | The ID of VPC endpoint for QLDB Session |
 | vpc\_endpoint\_qldb\_session\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for QLDB Session. |
+| vpc\_endpoint\_rds\_dns\_entry | The DNS entries for the VPC Endpoint for RDS. |
+| vpc\_endpoint\_rds\_id | The ID of VPC endpoint for RDS |
+| vpc\_endpoint\_rds\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for RDS. |
 | vpc\_endpoint\_rekognition\_dns\_entry | The DNS entries for the VPC Endpoint for Rekognition. |
 | vpc\_endpoint\_rekognition\_id | The ID of VPC endpoint for Rekognition VPC | vpc\_endpoint\_rekognition\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Rekognition. |
---
outputs.tf
@@ -1407,6 +1407,22 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_rds_id" {
+  description = "The ID of VPC endpoint for RDS"
+  value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
+}
+
+output "vpc_endpoint_rds_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.network_interface_ids)
+}
+
+output "vpc_endpoint_rds_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
+}
+
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---

---

Choice C:
README.md
@@ -876,6 +876,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_qldb\_session\_dns\_entry | The DNS entries for the VPC Endpoint for QLDB Session. |
 | vpc\_endpoint\_qldb\_session\_id | The ID of VPC endpoint for QLDB Session |
 | vpc\_endpoint\_qldb\_session\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for QLDB Session. |
+| vpc\_endpoint\_rds\_dns\_entry | The DNS entries for the VPC Endpoint for RDS. |
+| vpc\_endpoint\_rds\_id | The ID of VPC endpoint for RDS |
+| vpc\_endpoint\_rds\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for RDS. |
 | vpc\_endpoint\_rekognition\_dns\_entry | The DNS entries for the VPC Endpoint for Rekognition. |
 | vpc\_endpoint\_rekognition\_id | The ID of VPC endpoint for Rekognition |
 | vpc\_endpoint\_rekognition\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Rekognition. |
---
outputs.tf
@@ -1407,6 +1407,22 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_rds_id" {
+  description = "The ID of VPC endpoint for RDS"
+  value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
+}
+
+output "vpc_endpoint_rds_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for RDS."
+  QLDB       = flatten(aws_vpc_endpoint.rds.*.network_interface_ids)
+}
+
+output "vpc_endpoint_rds_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
+}
+
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---

---

Choice D:
README.md
@@ -876,6 +876,9 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | vpc\_endpoint\_qldb\_session\_dns\_entry | The DNS entries for the VPC Endpoint for QLDB Session. |
 | DNS | The ID of VPC endpoint for QLDB Session |
 | vpc\_endpoint\_qldb\_session\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for QLDB Session. |
+| vpc\_endpoint\_rds\_dns\_entry | The DNS entries for the VPC Endpoint for RDS. |
+| vpc\_endpoint\_rds\_id | The ID of VPC endpoint for RDS |
+| vpc\_endpoint\_rds\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for RDS. |
 | vpc\_endpoint\_rekognition\_dns\_entry | The DNS entries for the VPC Endpoint for Rekognition. |
 | vpc\_endpoint\_rekognition\_id | The ID of VPC endpoint for Rekognition |
 | vpc\_endpoint\_rekognition\_network\_interface\_ids | One or more network interfaces for the VPC Endpoint for Rekognition. |
---
outputs.tf
@@ -1407,6 +1407,22 @@ output "vpc_endpoint_codeartifact_repositories_dns_entry" {
   value       = flatten(aws_vpc_endpoint.codeartifact_repositories.*.dns_entry)
 }

+output "vpc_endpoint_rds_id" {
+  description = "The ID of VPC endpoint for RDS"
+  value       = concat(aws_vpc_endpoint.rds.*.id, [""])[0]
+}
+
+output "vpc_endpoint_rds_network_interface_ids" {
+  description = "One or more network interfaces for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.network_interface_ids)
+}
+
+output "vpc_endpoint_rds_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for RDS."
+  value       = flatten(aws_vpc_endpoint.rds.*.dns_entry)
+}
+
+
 # VPC flow log
 output "vpc_flow_log_id" {
   description = "The ID of the Flow Log resource"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add the ability to define a name prefix for the NAT Gateway and the EIP's that are created for the NAT Gateway.

## Motivation and Context
Currently based on the name tag alone for the NAT Gateway and NAT Gateway's EIP's it is hard to know that the NAT Gateway is a NAT Gateway and that the EIP's that are created belong to the NAT Gateway. I wanted a way to make this more clear for reporting purposes. While I could have overridden the name using the `nat_gateway_tags` and `nat_eip_tags` options respectively it would have removed the subnet part of the name which would have left me with several NAT Gateways and EIPs with matching names in VPC's that have more than one. Adding a prefix option seemed like a sensible compromise.

## Breaking Changes
No breaking changes, if the new option is not used the previous naming scheme is used.

## How Has This Been Tested?
I ran `terraform plan` on the `examples/simple-vpc` and verified the names matched what was previously there. Then I modified `examples/simple-vpc/main.tf` adding:
```
  nat_gateway_name_prefix = "my-overridden-nat-name"
  nat_gateway_eips_name_prefix = "my-overridden-eips-name"
```
the new plan had:
```
  # module.vpc.aws_eip.nat[0] will be created
  + resource "aws_eip" "nat" {
      + allocation_id        = (known after apply)
      + association_id       = (known after apply)
      + carrier_ip           = (known after apply)
      + customer_owned_ip    = (known after apply)
      + domain               = (known after apply)
      + id                   = (known after apply)
      + instance             = (known after apply)
      + network_border_group = (known after apply)
      + network_interface    = (known after apply)
      + private_dns          = (known after apply)
      + private_ip           = (known after apply)
      + public_dns           = (known after apply)
      + public_ip            = (known after apply)
      + public_ipv4_pool     = (known after apply)
      + tags                 = {
          + "Environment" = "dev"
          + "Name"        = "my-overridden-eips-name-eu-west-1a"
          + "Owner"       = "user"
        }
      + vpc                  = true
    }

  # module.vpc.aws_nat_gateway.this[0] will be created
  + resource "aws_nat_gateway" "this" {
      + allocation_id        = (known after apply)
      + id                   = (known after apply)
      + network_interface_id = (known after apply)
      + private_ip           = (known after apply)
      + public_ip            = (known after apply)
      + subnet_id            = (known after apply)
      + tags                 = {
          + "Environment" = "dev"
          + "Name"        = "my-overridden-nat-name-eu-west-1a"
          + "Owner"       = "user"
        }
    }
```

---

Choice A:
README.md
@@ -544,6 +544,8 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | name | Name to be used on all the resources as identifier | `string` | `""` | no |
 | nat\_eip\_tags | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 | nat\_gateway\_tags | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+| nat\_gateway\_name\_prefix | Specify the prefix name for the nat gateway | `string` | `""` | no |
+| nat\_gateway\_eips\_name\_prefix | Specify the prefix name for the nat gateway's EIP's | `string` | `""` | no |
 | one\_nat\_gateway\_per\_az | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 | private\_acl\_tags | Additional tags for the private subnets network ACL | `map(string)` | `{}` | no |
 | private\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for private subnets | `bool` | `false` | no |
---
main.tf
@@ -932,7 +932,7 @@ resource "aws_eip" "nat" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_eips_name_prefix != "" ? var.nat_gateway_eips_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
@@ -957,7 +957,7 @@ resource "aws_nat_gateway" "this" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_name_prefix != "" ? var.nat_gateway_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
---
variables.tf
@@ -274,6 +274,12 @@ variable "enable_nat_gateway" {
   default |
+|    = false
 }

+variable "nat_gateway_name_prefix" {
+  description = "Optionally specify a name for your nat gateways, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
@@ -304,6 +310,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_eips_name_prefix" {
+  description = "Optionally specify a name for your nat gateways's eips, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "enable_public_s3_endpoint" {
   description = "Whether to enable S3 VPC Endpoint for public subnets"
   default     = true
---

---

Choice B:
README.md
@@ -544,6 +544,8 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | name | Name to be used on all the resources as identifier | `string` | `""` | no |
 | nat\_eip\_tags | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 | nat\_gateway\_tags | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+| nat\_gateway\_name\_prefix | Specify the prefix name for the nat gateway | `string` | `""` | no |
+| nat\_gateway\_eips\_name\_prefix | Specify the prefix name for the nat gateway's EIP's | `string` | `""` | no |
 | one\_nat\_gateway\_per\_az | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 | private\_acl\_tags | Additional tags for the private subnets network ACL | `map(string)` | `{}` | no |
 | private\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for private subnets | `bool` | `false` | no |
---
main.tf
@@ -932,7 +932,7 @@ resource "aws_eip" "nat" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_eips_name_prefix != "" ? var.nat_gateway_eips_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
@@ -957,7 +957,7 @@ resource "aws_nat_gateway" "this" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_name_prefix != "" ? var.nat_gateway_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
---
variables.tf
@@ -274,6 +274,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_name_prefix" {
+  description = "Optionally specify a name for your nat gateways, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
@@ -304,6 +310,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_eips_name_prefix" {
+  description = "Optionally specify a name for your nat gateways's eips, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "enable_public_s3_endpoint" {
   description = "Whether to enable S3 VPC Endpoint for public subnets"
   default     = true
---

---

Choice C:
README.md
@@ -544,6 +544,8 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | name | Name to be used on all the resources as identifier | `string` | `""` | no |
 | nat\_eip\_tags | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 | nat\_gateway\_tags | Additional | for the NAT gateways | `map(string)` | `{}` | no |
+| nat\_gateway\_name\_prefix | Specify the prefix name for the nat gateway | `string` | `""` | no |
+| nat\_gateway\_eips\_name\_prefix | Specify the prefix name for the nat gateway's EIP's | `string` | `""` | no |
 | one\_nat\_gateway\_per\_az | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 | private\_acl\_tags | Additional tags for the private subnets network ACL | `map(string)` | `{}` | no |
 | private\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for private subnets | `bool` | `false` | no |
---
main.tf
@@ -932,7 +932,7 @@ resource "aws_eip" "nat" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_eips_name_prefix != "" ? var.nat_gateway_eips_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
@@ -957,7 +957,7 @@ resource "aws_nat_gateway" "this" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_name_prefix != "" ? var.nat_gateway_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
---
variables.tf
@@ -274,6 +274,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_name_prefix" {
+  description = "Optionally specify a name for your nat gateways, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
@@ -304,6 +310,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_eips_name_prefix" {
+  description = "Optionally specify a name for your nat gateways's eips, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "enable_public_s3_endpoint" {
   description = "Whether to enable S3 VPC Endpoint for public subnets"
   default     = true
---

---

Choice D:
README.md
@@ -544,6 +544,8 @@ It is possible to for this VPC module with [terraform-aws-transit-gateway
 | name | Name to be used on all the resources as identifier | `string` | `""` | no |
 | nat\_eip\_tags | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 | nat\_gateway\_tags | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+| nat\_gateway\_name\_prefix | Specify the prefix name for the nat gateway | `string` | `""` | no |
+| nat\_gateway\_eips\_name\_prefix | Specify the prefix name for the nat gateway's EIP's | `string` | `""` | no |
 | one\_nat\_gateway\_per\_az | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 | private\_acl\_tags | Additional tags for the private subnets network ACL | `map(string)` | `{}` | no |
 | private\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for private subnets | `bool` | `false` | no |
---
main.tf
@@ -932,7 +932,7 @@ resource "aws_eip" "nat" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_eips_name_prefix != "" ? var.nat_gateway_eips_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
@@ -957,7 +957,7 @@ resource "aws_nat_gateway" "this" {
     {
       "Name" = format(
         "%s-%s",
-        var.name,
+        var.nat_gateway_name_prefix != "" ? var.nat_gateway_name_prefix : var.name,
         element(var.azs, var.single_nat_gateway ? 0 : count.index),
       )
     },
---
variables.tf
@@ -274,6 +274,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_name_prefix" {
+  description = "Optionally specify a name for your nat gateways, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
@@ -304,6 +310,12 @@ variable "external_nat_ips" {
   default     = []
 }

+variable "nat_gateway_eips_name_prefix" {
+  description = "Optionally specify a name for your nat gateways's eips, if not var.name will be used"
+  type        = string
+  default     = ""
+}
+
 variable "enable_public_s3_endpoint" {
   description = "Whether to enable S3 VPC Endpoint for public subnets"
   default     = true
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" =         "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice B:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice C:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) description 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice D:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an length(var.public-network_subnets) enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice B:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block =  && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice C:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+  vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---

Choice D:
main.tf
@@ -324,13 +324,13 @@ resource "aws_route_table" "intra" {
 }

 ################
-# Public subnet
+# Public-App subnet
 ################
-resource "aws_subnet" "public" {
-  count = var.create_vpc && length(var.public_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public_subnets) >= length(var.azs)) ? length(var.public_subnets) : 0
+resource "aws_subnet" "public-app" {
+  count = var.create_vpc && length(var.public-app_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-app_subnets) >= length(var.azs)) ? length(var.public-app_subnets) : 0

   vpc_id                          = local.vpc_id
-  cidr_block                      = element(concat(var.public_subnets, [""]), count.index)
+  cidr_block                      = element(concat(var.public-app_subnets, [""]), count.index)
   availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
   availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
   map_public_ip_on_launch         = var.map_public_ip_on_launch
@@ -341,13 +341,41 @@ resource "aws_subnet" "public" {
   tags = merge(
     {
       "Name" = format(
-        "%s-${var.public_subnet_suffix}-%s",
+        "%s-${var.public-app_subnet_suffix}-%s",
         var.name,
         element(var.azs, count.index),
       )
     },
     var.tags,
-    var.public_subnet_tags,
+    var.public-app_subnet_tags,
+  )
+}
+
+################
+# Public-Network subnet
+################
+resource "aws_subnet" "public-network" {
+  count = var.create_vpc && length(var.public-network_subnets) > 0 && (false == var.one_nat_gateway_per_az || length(var.public-network_subnets) >= length(var.azs)) ? length(var.public-network_subnets) : 0
+
+ -341,13 vpc_id                          = local.vpc_id
+  cidr_block                      = element(concat(var.public-network_subnets, [""]), count.index)
+  availability_zone               = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) > 0 ? element(var.azs, count.index) : null
+  availability_zone_id            = length(regexall("^[a-z]{2}-", element(var.azs, count.index))) == 0 ? element(var.azs, count.index) : null
+  map_public_ip_on_launch         = var.map_public_ip_on_launch
+  assign_ipv6_address_on_creation = var.public_subnet_assign_ipv6_address_on_creation == null ? var.assign_ipv6_address_on_creation : var.public_subnet_assign_ipv6_address_on_creation
+
+  ipv6_cidr_block = var.enable_ipv6 && length(var.public_subnet_ipv6_prefixes) > 0 ? cidrsubnet(aws_vpc.this[0].ipv6_cidr_block, 8, var.public_subnet_ipv6_prefixes[count.index]) : null
+
+  tags = merge(
+    {
+      "Name" = format(
+        "%s-${var.public-network_subnet_suffix}-%s",
+        var.name,
+        element(var.azs, count.index),
+      )
+    },
+    var.tags,
+    var.public-network_subnet_tags,
   )
 }

---
outputs.tf
@@ -88,24 +88,44 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private.*.ipv6_cidr_block
 }

-output "public_subnets" {
+output "public-app_subnets" {
   description = "List of IDs of public subnets"
-  value       = aws_subnet.public.*.id
+  value       = aws_subnet.public-app.*.id
 }

-output "public_subnet_arns" {
+output "public-network_subnets" {
+  description = "List of IDs of public subnets"
+  value       = aws_subnet.public-network.*.id
+}
+
+output "public-app_subnet_arns" {
+  description = "List of ARNs of public subnets"
+  value       = aws_subnet.public-app.*.arn
+}
+
+output "public-network_subnet_arns" {
   description = "List of ARNs of public subnets"
-  value       = aws_subnet.public.*.arn
+  value       = aws_subnet.public-network.*.arn
 }

-output "public_subnets_cidr_blocks" {
+output "public-app_subnets_cidr_blocks" {
   description = "List of cidr_blocks of public subnets"
-  value       = aws_subnet.public.*.cidr_block
+  value       = aws_subnet.public-app.*.cidr_block
+}
+
+output "public-network_subnets_cidr_blocks" {
+  description = "List of cidr_blocks of public subnets"
+  value       = aws_subnet.public-network.*.cidr_block
+}
+
+output "public-app_subnets_ipv6_cidr_blocks" {
+  description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
+  value       = aws_subnet.public-app.*.ipv6_cidr_block
 }

-output "public_subnets_ipv6_cidr_blocks" {
+output "public-network_subnets_ipv6_cidr_blocks" {
   description = "List of IPv6 cidr_blocks of public subnets in an IPv6 enabled VPC"
-  value       = aws_subnet.public.*.ipv6_cidr_block
+  value       = aws_subnet.public-network.*.ipv6_cidr_block
 }

 output "database_subnets" {
---
variables.tf
@@ -148,8 +148,14 @@ variable "elasticache_subnet_suffix" {
   default     = "elasticache"
 }

-variable "public_subnets" {
-  description = "A list of public subnets inside the VPC"
+variable "public-app_subnets" {
+  description = "A list of public-app subnets inside the VPC"
+  type        = list(string)
+  default     = []
+}
+
+variable "public-network_subnets" {
+  description = "A list of public-network subnets inside the VPC"
   type        = list(string)
   default     = []
 }
@@ -1955,7 +1961,13 @@ variable "igw_tags" {
   default     = {}
 }

-variable "public_subnet_tags" {
+variable "public-app_subnet_tags" {
+  description = "Additional tags for the public subnets"
+  type        = map(string)
+  default     = {}
+}
+
+variable "public-network_subnet_tags" {
   description = "Additional tags for the public subnets"
   type        = map(string)
   default     = {}
---

---