Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
- Replace `aws:SourceVpce` conditions
- Remove `aws_vpc_endpoint_service` data objects

## Description
Fix Complete VPC example code by removing several incorrect examples.

## Motivation and Context
- Firstly, it makes no sense to use `aws:SourceVpce` in a VPC endpoint IAM policy; all traffic that the VPC endpoint will receive will always have its own id here. You can read more about this key [here](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html) under the section titled "Use IAM policies to control access to DynamoDB", in which the document states (emphasis mine):

"You can create an IAM policy for your **IAM users, groups, or roles** to restrict access to DynamoDB tables from a specific VPC endpoint only. To do this, you can use the aws:sourceVpce condition key for the table resource in your IAM policy."

- Secondly, at some point there was a change from the data `aws_vpc_endpoint` to `aws_vpc_endpoint_service`. It's important to note this because previously the code used `data.aws_vpc_endpoint.dynamodb.id` which does exist and provides an id like `vpce-12345` but was later replaced by `data.aws_vpc_endpoint_service.dynamodb.id`. You can see [here](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) that `id` is not a valid attribute and the output of this data type was a numerical id like `1234` that seemed to have no bearing to vpc, vpc endpoint or any other active resource.

The changes I've made continue to provide a policy for an example case, but the example now provides a somewhat more sensible value. In the new example code, the deny rule is set to reject any users who are outside of the current account.

## Breaking Changes
This does not break any module code as it only affects an example

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
I had to extensively debug why the example wasn't working and have cited all of my documentation.

---

Choice A:
examples/complete-vpc/main.tf
@@ -182,16 +182,8 @@ data "aws_security_group" "default" {
   vpc_id = module.vpc.vpc_id
 }

-# Data source used to avoid race condition
-data "aws_vpc_endpoint_service" "dynamodb" {
-  service = "dynamodb"
-
-  filter {
-    name   = "service-type"
-    values = ["Gateway"]
-  }
-}
-
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
     effect    = "Deny"
@@ -205,9 +197,9 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values =      }
   }
 }
@@ -225,9 +217,9 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -182,16 +182,8 @@ data "aws_security_group" "default" {
   vpc_id = module.vpc.vpc_id
 }

-# Data source used to avoid race condition
-data "aws_vpc_endpoint_service" "dynamodb" {
-  service = "dynamodb"
-
-  filter {
-    name   = "service-type"
-    values = ["Gateway"]
-  }
-}
-
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
     effect    = "Deny"
@@ -205,9 +197,9 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
@@ -225,9 +217,9 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      "aws_iam_policy_document" = [data.aws_caller_identity.current.account_id]
     }
   }
 }
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -182,16 +182,8 @@ data "aws_security_group" "default" {
   vpc_id = module.vpc.vpc_id
 }

-# Data source used to avoid race condition
-data "aws_vpc_endpoint_service" "dynamodb" {
-  service = "dynamodb"
-
-  filter {
-    name   = "service-type"
-    values = ["Gateway"]
-  }
-}
-
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
     effect    = "Deny"
@@ -205,9 +197,9 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
@@ -225,9 +217,9 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -182,16 +182,8 @@ data "aws_security_group" "default" {
   vpc_id = module.vpc.vpc_id
 }

-# Data source used to avoid race condition
-data "aws_vpc_endpoint_service" "dynamodb" {
-  service = "dynamodb"
-
-  filter {
-    name   = "service-type"
-    values = ["Gateway"]
-  }
-}
-
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "dynamodb_endpoint_policy" {
   statement {
     effect    = "Deny"
@@ -205,9 +197,9 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = [data.aws_vpc_endpoint_service.dynamodb.id]
+      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
@@ -225,9 +217,9 @@ data "aws_iam_policy_document" "generic_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:PrincipalAccount"

-      values = "aws_security_group"      values = [data.aws_caller_identity.current.account_id]
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Many Cloudrail users are running into this:
```
Rule: Ensure IAM policies pass Access Analyzer policy validation without WARNING and SUGGESTION issues
 - 1 Resources Exposed:
-----------------------------------------------
   - Exposed Resource: [module.vpc.aws_iam_role.vpc_flow_log_cloudwatch[0]] (../../vpc-flow-logs.tf:44)
     Violating Resource: [module.vpc.aws_iam_role.vpc_flow_log_cloudwatch[0]]  (../../vpc-flow-logs.tf:44)

     Evidence:
         Line 5, Col 13:
             | Add a value to the empty string in the Sid element
             | See https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-suggestion-empty-sid-value
```

Simply because there's no SID in the assume policy and it violates AWS best practices.

## Motivation and Context
To avoid a Cloudrail violation for users of the vpc module.

## Breaking Changes
This updates the assume role policy. It doesn't break backwards compatibility but will introduce an update in user environments that have this module deployed.

```
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.vpc.aws_iam_role.vpc_flow_log_cloudwatch[0] will be updated in-place
  ~ resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Sid       = "" -> "AWSVPCFlowLogsAssumeRole"
                        # (3 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        id                    = "vpc-flow-log-role-20210729162754416900000002"
        name                  = "vpc-flow-log-role-20210729162754416900000002"
        tags                  = {
            "Environment" = "staging"
            "Name"        = "complete"
            "Owner"       = "user"
        }
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

```

## How Has This Been Tested?
I have tested it using the complete-vpc example. Started with planning and applying as the code is today (and checked that Cloudrail triggers the above violation on the plan). Then I fixed the code, planned again, verified with Cloudrail, and applied (to see the change doesn't break existing deployments).

---

Choice A:
"AWSVPCFlowLogsAssumeRole"
+
 -55,6 +55,8 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

   statement {
+    sid = "AWSVPCFlowLogsAssumeRole"
+
     principals {
       type        = "Service"
       identifiers = ["vpc-flow-logs.amazonaws.com"]
---

---

Choice B:
vpc-flow-logs.tf
@@ -55,6 +55,8 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
  {
 count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

   statement {
+    sid = "AWSVPCFlowLogsAssumeRole"
+
     principals {
       type        = "Service"
       identifiers = ["vpc-flow-logs.amazonaws.com"]
---

---

Choice C:
vpc-flow-logs.tf
@@ -55,6 +55,8 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

   statement {
+    sid = "AWSVPCFlowLogsAssumeRole"
+
     principals {
       type        = "Service"
       identifiers = ["vpc-flow-logs.amazonaws.com"]
---

---

Choice D:
vpc-flow-logs.tf
@@ local.create_flow_log_cloudwatch_iam_role +55,8 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

   statement {
+    sid = "AWSVPCFlowLogsAssumeRole"
+
     principals {
       type        = "Service"
       identifiers = ["vpc-flow-logs.amazonaws.com"]
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Added ID of DHCP options to outputs

## Motivation and Context

We need it to put in IAM policy which allow to maintain objects which created by this module.

## Breaking Changes

It has backwards compatibility to all previous versions of module which has DHCP options object.

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
README.md
@@ -481,6 +481,7 @@ No modules.
 |  [default\_vpc\_id](#output\_default\_vpc\_id) | The ID of the Default VPC |
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
+|  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
 |  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
---
outputs.tf
@@ -333,6 +333,11 @@ output "public_route_table_association_ids" {
   value       = aws_route_table_association.public.*.id
 }

+output "dhcp_options_id" {
+  description = "The ID of the DHCP options"
+  value       = concat(aws_vpc_dhcp_options.this.*.id, [""])[0]
+}
+
 output "nat_ids" {
   description = "List of allocation ID of Elastic IPs created for AWS NAT Gateway"
   value       = aws_eip.nat.*.id
---

---

Choice B:
README.md
@@ -481,6 +481,7 @@ No modules.
 |  [default\_vpc\_id](#output\_default\_vpc\_id) | The ID of the Default VPC |
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
+|  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
 |  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
---
outputs.tf
@@ -333,6 +333,11 @@ | "public_route_table_association_ids" {
   value       = aws_route_table_association.public.*.id
 }

+output "dhcp_options_id" {
+  description = "The ID of the DHCP options"
+  value       = concat(aws_vpc_dhcp_options.this.*.id, [""])[0]
+}
+
 output "nat_ids" {
   description = "List of allocation ID of Elastic IPs created for AWS NAT Gateway"
   value       = aws_eip.nat.*.id
---

---

Choice C:
README.md
@@ -481,6 +481,7 @@ No modules.
 |  [default\_vpc\_id](#output\_default\_vpc\_id) | The ID of the Default VPC |
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
+|  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
 |  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
---
outputs.tf
@@ -333,6 +333,11 @@ [default\_vpc\_id](#output\_default\_vpc\_id) "public_route_table_association_ids" {
   value       = aws_route_table_association.public.*.id
 }

+output "dhcp_options_id" {
+  description = "The ID of the DHCP options"
+  value       = concat(aws_vpc_dhcp_options.this.*.id, [""])[0]
+}
+
 output "nat_ids" {
   description = "List of allocation ID of Elastic IPs created for AWS NAT Gateway"
   value       = aws_eip.nat.*.id
---

---

Choice D:
README.md
@@ -481,6 +481,7 @@ No modules.
 |  [default\_vpc\_id](#output\_default\_vpc\_id) | The ID of the Default VPC |
 |  [default\_vpc\_instance\_tenancy](#output\_default\_vpc\_instance\_tenancy) | Tenancy of instances spin up within Default VPC |
 |  [default\_vpc\_main\_route\_table\_id](#output\_default\_vpc\_main\_route\_table\_id) | The ID of the main route table associated with the Default VPC |
+|  [dhcp\_options\_id](#output\_dhcp\_options\_id) | The ID of the DHCP options |
 |  [egress\_only\_internet\_gateway\_id](#output\_egress\_only\_internet\_gateway\_id) | The ID of the egress only Internet Gateway |
 |  [elasticache\_network\_acl\_arn](#output\_elasticache\_network\_acl\_arn) | ARN of the elasticache network ACL |
 |  [elasticache\_network\_acl\_id](#output\_elasticache\_network\_acl\_id) | ID of the elasticache network ACL |
---
outputs.tf
@@ -333,6 +333,11 @@ output "public_route_table_association_ids" {
   value       = aws_route_table_association.public.*.id
 }

+output "dhcp_options_id" {
+  description = "The ID of the DHCP options"
+  of       = concat(aws_vpc_dhcp_options.this.*.id, [""])[0]
+}
+
 output "nat_ids" {
   description = "List of allocation ID of Elastic IPs created for AWS NAT Gateway"
   value       = aws_eip.nat.*.id
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Fix copy/paste mistake of the outputs in VPC with separate private route tables example
## Motivation and Context

This still working but maybe misleading
## Breaking Changes

I don't think any of these are breaking changes, just fix copy/paste mistake. No existing properties are being changed.
## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
examples/vpc-separate-private-route-tables/README.md
@@ -51,6 +51,6 @@ No inputs.
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
 |  [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
-|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of elasticache subnets |
+|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |
---
 name="output_vpc_id"> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |

---
examples/vpc-separate-private-route-tables/outputs.tf
@@ -26,7 +26,7 @@ output "elasticache_subnets" {
 }

 output "redshift_subnets" {
-  description = "List of IDs of elasticache subnets"
+  description = "List of IDs of redshift subnets"
   value       = module.vpc.redshift_subnets
 }

---

---

Choice B:
examples/vpc-separate-private-route-tables/README.md
@@ -51,6 +51,6 @@ No inputs.
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
 |  [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
-|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of elasticache subnets |
+|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [vpc\_id](#output\_vpc\_id) | The ID of the VPC |

---
examples/vpc-separate-private-route-tables/outputs.tf
@@ -26,7 +26,7 @@ output "elasticache_subnets" {
 }

 output "redshift_subnets" {
-  description = "List of IDs of elasticache subnets"
+  description = "List of IDs of redshift subnets"
   value       = module.vpc.redshift_subnets
 }

---

---

Choice C:
examples/vpc-separate-private-route-tables/README.md
@@ -51,6 +51,6 @@ No inputs.
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 OF  [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
 |  [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
-|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of elasticache subnets |
+|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [vpc\_id](#output\_vpc\_id) | The ID of the VPC |

---
examples/vpc-separate-private-route-tables/outputs.tf
@@ -26,7 +26,7 @@ output "elasticache_subnets" {
 }

 output "redshift_subnets" {
-  description = "List of IDs of elasticache subnets"
+  description = "List of IDs of redshift subnets"
   value       = module.vpc.redshift_subnets
 }

---

---

Choice D:
examples/vpc-separate-private-route-tables/README.md
@@ -51,6 +51,6 @@ No inputs.
 |  [nat\_public\_ips](#output\_nat\_public\_ips) | List of public Elastic IPs created for AWS NAT Gateway |
 |  [private\_subnets](#output\_private\_subnets) | List of IDs of private subnets |
 |  [public\_subnets](#output\_public\_subnets) | List of IDs of public subnets |
-|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of elasticache subnets |
+|  [redshift\_subnets](#output\_redshift\_subnets) | List of IDs of redshift subnets |
 |  [vpc\_id](#output\_vpc\_id) | The ID of the VPC |

---
examples/vpc-separate-private-route-tables/outputs.tf
@@ -26,7 +26,7 @@ output "elasticache_subnets" {
 }

 output "redshift_subnets" {
-  description = "List of IDs of elasticache subnets"
+  description = "List of IDs of redshift subnets"
   value   of    = module.vpc.redshift_subnets
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!---Update VPC Endpoint for S3 -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
Error: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
No
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects local project
<!--- Please describe in detail how you tested your changes. -->
Updated VPC S3 endpoint and tested on local env which completed successfully
<!--- Include details of your testing environment, and the tests you ran to -->
Plan: 0 to add, 0 to change, 0 to destroy.
<!--- see how your change affects other areas of the code, etc. -->
No

---

Choice A:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name   = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      =  "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name   = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false
 = -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name   = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10  data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name   = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    && ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -15,12 +15,12 @@ module "vpc" {
   cidr = "20.10.0.0/16" # 10.0.0.0/8 is reserved for EC2-Classic

   azs                 = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
-  private_subnets     = ["20.10.1.0/24", "20.10.2.0/24", "20.10.3.0/24"]
-  public_subnets      = ["20.10.11.0/24", "20.10.12.0/24", "20.10.13.0/24"]
-  database_subnets    = ["20.10.21.0/24", "20.10.22.0/24", "20.10.23.0/24"]
-  elasticache_subnets = ["20.10.31.0/24", "20.10.32.0/24", "20.10.33.0/24"]
-  redshift_subnets    = ["20.10.41.0/24", "20.10.42.0/24", "20.10.43.0/24"]
-  intra_subnets       = ["20.10.51.0/24", "20.10.52.0/24", "20.10.53.0/24"]
+  private_subnets     = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
+  public_subnets      = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
+  database_subnets    = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
+  elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
+  redshift_subnets    = ["10.40.41.0/24", "10.40.42.0/24", "10.40.43.0/24"]
+  intra_subnets       = ["10.10.51.0/24", "10.10.52.0/24", "10.10.53.0/24"]

   create_database_subnet_group = false

---
vpc-endpoints.tf
@@ -5,6 +5,10 @@ data "aws_vpc_endpoint_service" "s3" {
   count = var.create_vpc && var.enable_s3_endpoint ? 1 : 0

   service = "s3"
+  filter {
+    name = "service-type"
+    values = ["Gateway"]
+  }
 }

 resource "aws_vpc_endpoint" "s3" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Fixed #654

---

Choice A:
README.md
@@ -312,6 +312,7 @@ No modules.
 |  [database\_outbound\_acl\_rules](#input\_database\_outbound\_acl\_rules) | Database subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [database\_route\_table\_tags](#input\_database\_route\_table\_tags) | Additional tags for the database route tables | `map(string)` | `{}` | no |
 |  [database\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_database\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [database\_subnet\_group\_name](#input\_database\_subnet\_group\_name) | Name of database subnet group | `string` | `null` | no |
 |  [database\_subnet\_group\_tags](#input\_database\_subnet\_group\_tags) | Additional tags for the database subnet group | `map(string)` | `{}` | no |
 |  [database\_subnet\_ipv6\_prefixes](#input\_database\_subnet\_ipv6\_prefixes) | Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
---
main.tf
@@ -481,13 +481,13 @@ resource "aws_subnet" "database" {
 resource "aws_db_subnet_group" "database" {
   count = var.create_vpc && length(var.database_subnets) > 0 && var.create_database_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.database_subnet_group_name, var.name))
   description = "Database subnet group for ${var.name}"
   subnet_ids  = aws_subnet.database.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", lower(coalesce(var.database_subnet_group_name, var.name)))
     },
     var.tags,
     var.database_subnet_group_tags,
---
variables.tf
@@ -478,6 +478,12 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "database_subnet_group_name" {
+  description = "Name of database subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
---

---

Choice B:
README.md
@@ -312,6 +312,7 @@ No modules.
 |  [database\_outbound\_acl\_rules](#input\_database\_outbound\_acl\_rules) | Database subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [database\_route\_table\_tags](#input\_database\_route\_table\_tags) | Additional tags for the database route tables | `map(string)` | `{}` | no |
 |  [database\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_database\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [database\_subnet\_group\_name](#input\_database\_subnet\_group\_name) | Name of database subnet group | `string` | `null` | no |
 |  [database\_subnet\_group\_tags](#input\_database\_subnet\_group\_tags) | Additional tags for the database subnet group | `map(string)` | `{}` | no |
 |  [database\_subnet\_ipv6\_prefixes](#input\_database\_subnet\_ipv6\_prefixes) | Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
---
main.tf
@@ -481,13 +481,13 @@ resource "aws_subnet" "database" {
 resource "aws_db_subnet_group" "database" {
   count = var.create_vpc && length(var.database_subnets) > 0 && var.create_database_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.database_subnet_group_name, var.name))
   description = "Database subnet group for ${var.name}"
   subnet_ids  = aws_subnet.database.*.id

   tags = merge(
 var.create_database_subnet_group    {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", lower(coalesce(var.database_subnet_group_name, var.name)))
     },
     var.tags,
     var.database_subnet_group_tags,
---
variables.tf
@@ -478,6 +478,12 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "database_subnet_group_name" {
+  description = "Name of database subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
---

---

Choice C:
README.md
@@ -312,6 +312,7 @@ No modules.
 |  [database\_outbound\_acl\_rules](#input\_database\_outbound\_acl\_rules) | Database subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [database\_route\_table\_tags](#input\_database\_route\_table\_tags) | Additional tags for the database route tables | `map(string)` | `{}` | no |
 |  [database\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_database\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [database\_subnet\_group\_name](#input\_database\_subnet\_group\_name) | Name of database subnet group | `string` | `null` | no |
 |  [database\_subnet\_group\_tags](#input\_database\_subnet\_group\_tags) | Additional tags for the database subnet group | `map(string)` | `{}` | no |
 |  [database\_subnet\_ipv6\_prefixes](#input\_database\_subnet\_ipv6\_prefixes) | Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
---
main.tf
@@ -481,13 +481,13 @@ resource "aws_subnet" "database" {
 resource "aws_db_subnet_group" "database" {
   count = var.create_vpc && length(var.database_subnets) > 0 && var.create_database_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.database_subnet_group_name, var.name))
   description = "Database subnet group for ${var.name}"
   subnet_ids  = aws_subnet.database.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", lower(coalesce(var.database_subnet_group_name, var.name)))
     },
     var.tags,
     var.database_subnet_group_tags,
---
variables.tf
@@ -478,6 +478,12 @@ variable "intra_route_table_tags" {

 default     = {}
 }

+variable "database_subnet_group_name" {
+  description = "Name of database subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
---

---

Choice D:
README.md
@@ -312,6 +312,7 @@ No modules.
 |  [database\_outbound\_acl\_rules](#input\_database\_outbound\_acl\_rules) | Database subnets outbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
 |  [database\_route\_table\_tags](#input\_database\_route\_table\_tags) | Additional tags for the database route tables | `map(string)` | `{}` | no |
 |  [database\_subnet\_assign\_ipv6\_address\_on\_creation](#input\_database\_subnet\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on database subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `null` | no |
+|  [database\_subnet\_group\_name](#input\_database\_subnet\_group\_name) | Name of database subnet group | `string` | `null` | no |
 |  [database\_subnet\_group\_tags](#input\_database\_subnet\_group\_tags) | Additional tags for the database subnet group | `map(string)` | `{}` | no |
 |  [database\_subnet\_ipv6\_prefixes](#input\_database\_subnet\_ipv6\_prefixes) | Assigns IPv6 database subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list | `list(string)` | `[]` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
---
main.tf
@@ -481,13 +481,13 @@ resource "aws_subnet" "database" {
 resource "aws_db_subnet_group" "database" {
   count = var.create_vpc && length(var.database_subnets) > 0 && var.create_database_subnet_group ? 1 : 0

-  name        = lower(var.name)
+  name        = lower(coalesce(var.database_subnet_group_name, var.name))
   description = "Database subnet group for ${var.name}"
   subnet_ids  = aws_subnet.database.*.id

   tags = merge(
     {
-      "Name" = format("%s", var.name)
+      "Name" = format("%s", lower(coalesce(var.database_subnet_group_name, var.name)))
     },
     var.tags,
     var.database_subnet_group_tags,
---
variables.tf
@@ -478,6 +478,12 @@ variable "intra_route_table_tags" {
   default    subnet = {}
 }

+variable "database_subnet_group_name" {
+  description = "Name of database subnet group"
+  type        = string
+  default     = null
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Private DNS is not a valid setting for the S3 interface endpoint.

## Description
Updating documentation.

## Motivation and Context
The documentation for this module is invalid.

## Breaking Changes
None

## How Has This Been Tested?
Have tried to run the code as provided in the documentation and it will not work.

---

Choice A:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = },
 Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
 service      tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Based on the output of:

```sh
 aws ec2 describe-vpc-endpoint-services --region us-east-1
```

Services names are using different naming convention, they use URL like naming with region included.

Hope that helps!

---

Choice A:
modules/vpc-endpoints/README.md
@@ -7,6 +7,8 @@ Terraform sub-module which creates VPC endpoint resources on AWS.
 See [`examples`](../../examples) directory for working examples to reference:

 ```hcl
+data "aws_region" "current" {}
+
 module "endpoints" {
   source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

@@ -22,17 +24,18 @@ module "endpoints" {
     },
     dynamodb = {
       # gateway endpoint
-      service         = "dynamodb"
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.sns"
+      subnet_ids      = ["subnet-12345678", "subnet-87654321"]
+      tags            = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
-      service             = "sqs"
+      service_name        = "com.amazonaws.${data.aws_region.current.name}.sqs"
       private_dns_enabled = true
       security_group_ids  = ["sg-987654321"]
       subnet_ids          = ["subnet-12345678", "subnet-87654321"]
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -7,6 +7,8 @@ Terraform sub-module which creates VPC endpoint resources on AWS.
 See [`examples`](../../examples) directory for working examples to reference:

 ```hcl
+data "aws_region" "current" {}
+
 module "endpoints" {
   source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

@@ -22,17 +24,18 @@ module "endpoints" {
     },
     dynamodb = {
       # gateway endpoint
-      service         = "dynamodb"
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.sns"
+      subnet_ids      = ["subnet-12345678", "subnet-87654321"]
+      tags            = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
-      service             = "sqs"
+      service_name        = "com.amazonaws.${data.aws_region.current.name}.sqs"
       private_dns_enabled = true
       security_group_ids  = ["sg-987654321"]
       subnet_ids          = ["subnet-12345678", "subnet-87654321"]
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -7,6 +7,8 @@ Terraform sub-module which creates VPC endpoint resources on AWS.
 See [`examples`](../../examples) directory for working examples to reference:

 ```hcl
+data "aws_region" "current" {}
+
 module "endpoints" {
   source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

@@ -22,17 +24,18 @@ module "endpoints" {
     },
     dynamodb = {
       # gateway endpoint
-      service         = "dynamodb"
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.dynamodb"
+      service_type     "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.sns"
+      subnet_ids      = ["subnet-12345678", "subnet-87654321"]
+      tags            = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
-      service             = "sqs"
+      service_name        = "com.amazonaws.${data.aws_region.current.name}.sqs"
       private_dns_enabled = true
       security_group_ids  = ["sg-987654321"]
       subnet_ids          = ["subnet-12345678", "subnet-87654321"]
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -7,6 +7,8 @@ Terraform sub-module which creates VPC endpoint resources on AWS.
 See [`examples`](../../examples) directory for working examples to reference:

 ```hcl
+data "aws_region" "current" {}
+
 module "endpoints" {
   source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

@@ -22,17 +24,18 @@ module "endpoints" {
     },
     dynamodb = {
       # gateway endpoint
-      service         = "dynamodb"
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
     dynamodb  tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service_name    = "com.amazonaws.${data.aws_region.current.name}.sns"
+      subnet_ids      = ["subnet-12345678", "subnet-87654321"]
+      tags            = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
-      service             = "sqs"
+      service_name        = "com.amazonaws.${data.aws_region.current.name}.sqs"
       private_dns_enabled = true
       security_group_ids  = ["sg-987654321"]
       subnet_ids          = ["subnet-12345678", "subnet-87654321"]
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- update README of sub-module `vpc-endpoints`.

## Motivation and Context
- `private_dns_enabled` cannot be specified for S3 endpoint.

## Breaking Changes
- no

## How Has This Been Tested?
- README change only.

---

Choice A:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = {  = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -17,7 +17,6 @@ module "endpoints" {
     s3 = {
       # interface endpoint
       service             = "s3"
-      private_dns_enabled = true
       tags                = { Name = "s3-vpc-endpoint" }
     },
     dynamodb = {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add output for `dns_entry` of S3 endpoint.

## Motivation and Context
I was missing the output for my use case.

## Breaking Changes
I have not found anything broken. It is a simple addition in outputs, it **should** not break anything.

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [X] I have tested the change against my own VPC. The output is correctly shown as shown below (details omitted), and I can use it in other resources in my Terragrunt code, as a dependency.

```
vpc_endpoint_s3_dns_entry = [
  {
    "dns_name" = "*.vpce-XXX-YYY.s3.eu-west-1.vpce.amazonaws.com"
    "hosted_zone_id" = "ZZZ"
  },
  {
    "dns_name" = "*.vpce-XXX-YYY-eu-west-1b.s3.eu-west-1.vpce.amazonaws.com"
    "hosted_zone_id" = "ZZZ"
  },
  {
    "dns_name" = "*.vpce-XXX-YYY-eu-west-1a.s3.eu-west-1.vpce.amazonaws.com"
    "hosted_zone_id" = "ZZZ"
  },
  {
    "dns_name" = "*.vpce-XXX-YYY-eu-west-1c.s3.eu-west-1.vpce.amazonaws.com"
    "hosted_zone_id" = "ZZZ"
  },
]
```

Thank you.

---

Choice A:
README.md
@@ -1182,6 +1182,7 @@ No modules.
 |  [vpc\_endpoint\_rekognition\_dns\_entry](#output\_vpc\_endpoint\_rekognition\_dns\_entry) | The DNS entries for the VPC Endpoint for Rekognition. |
 |  [vpc\_endpoint\_rekognition\_id](#output\_vpc\_endpoint\_rekognition\_id) | The ID of VPC endpoint for Rekognition |
 |  [vpc\_endpoint\_rekognition\_network\_interface\_ids](#output\_vpc\_endpoint\_rekognition\_network\_interface\_ids) | One or more network interfaces for the VPC Endpoint for Rekognition. |
+|  [vpc\_endpoint\_s3\_dns\_entry](#output\_vpc\_endpoint\_s3\_dns\_entry) | The DNS entries for the VPC endpoint for S3. |
 |  [vpc\_endpoint\_s3\_id](#output\_vpc\_endpoint\_s3\_id) | The ID of VPC endpoint for S3 |
 |  [vpc\_endpoint\_s3\_pl\_id](#output\_vpc\_endpoint\_s3\_pl\_id) | The prefix list for the S3 VPC endpoint. |
 |  [vpc\_endpoint\_sagemaker\_api\_dns\_entry](#output\_vpc\_endpoint\_sagemaker\_api\_dns\_entry) | The DNS entries for the VPC Endpoint for SageMaker API. |
---
outputs.tf
@@ -523,6 +523,11 @@ output "vpc_endpoint_s3_pl_id" {
   value       = concat(aws_vpc_endpoint.s3.*.prefix_list_id, [""])[0]
 }

+output "vpc_endpoint_s3_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for S3."
+  value       = flatten(aws_vpc_endpoint.s3.*.dns_entry)
+}
+
 output "vpc_endpoint_dynamodb_id" {
   description = "The ID of VPC endpoint for DynamoDB"
   for       = concat(aws_vpc_endpoint.dynamodb.*.id, [""])[0]
---

---

Choice B:
README.md
@@ -1182,6 +1182,7 @@ No modules.
 |  [vpc\_endpoint\_rekognition\_dns\_entry](#output\_vpc\_endpoint\_rekognition\_dns\_entry) | The DNS entries for the VPC Endpoint for Rekognition. |
 |  [vpc\_endpoint\_rekognition\_id](#output\_vpc\_endpoint\_rekognition\_id) | The ID of VPC endpoint for Rekognition |
 |  [vpc\_endpoint\_rekognition\_network\_interface\_ids](#output\_vpc\_endpoint\_rekognition\_network\_interface\_ids) | One or more network interfaces for the VPC Endpoint for Rekognition. |
+|  [vpc\_endpoint\_s3\_dns\_entry](#output\_vpc\_endpoint\_s3\_dns\_entry) | The DNS entries for the VPC endpoint for S3. |
 |  [vpc\_endpoint\_s3\_id](#output\_vpc\_endpoint\_s3\_id) | The ID of VPC endpoint for S3 |
 |  [vpc\_endpoint\_s3\_pl\_id](#output\_vpc\_endpoint\_s3\_pl\_id) | The prefix list for the S3 VPC endpoint. |
 |  [vpc\_endpoint\_sagemaker\_api\_dns\_entry](#output\_vpc\_endpoint\_sagemaker\_api\_dns\_entry) | The DNS entries for the VPC Endpoint for SageMaker API. |
---
outputs.tf
@@ -523,6 +523,11 @@ output "vpc_endpoint_s3_pl_id" {
   value       = concat(aws_vpc_endpoint.s3.*.prefix_list_id, [""])[0]
 }

+output "vpc_endpoint_s3_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for S3."
+  value      description = flatten(aws_vpc_endpoint.s3.*.dns_entry)
+}
+
 output "vpc_endpoint_dynamodb_id" {
   description = "The ID of VPC endpoint for DynamoDB"
   value       = concat(aws_vpc_endpoint.dynamodb.*.id, [""])[0]
---

---

Choice C:
README.md
@@ -1182,6 +1182,7 @@ No modules.
 |  [vpc\_endpoint\_rekognition\_dns\_entry](#output\_vpc\_endpoint\_rekognition\_dns\_entry) | The DNS entries for the VPC Endpoint for Rekognition. |
 |  [vpc\_endpoint\_rekognition\_id](#output\_vpc\_endpoint\_rekognition\_id) | The ID of VPC endpoint for Rekognition |
 |  [vpc\_endpoint\_rekognition\_network\_interface\_ids](#output\_vpc\_endpoint\_rekognition\_network\_interface\_ids) | One or more network interfaces for the VPC Endpoint for Rekognition. |
+|  [vpc\_endpoint\_s3\_dns\_entry](#output\_vpc\_endpoint\_s3\_dns\_entry) | The DNS entries for the VPC endpoint for S3. |
 |  [vpc\_endpoint\_s3\_id](#output\_vpc\_endpoint\_s3\_id) | The ID of VPC endpoint for S3 |
 |  [vpc\_endpoint\_s3\_pl\_id](#output\_vpc\_endpoint\_s3\_pl\_id) | The prefix list for the S3 VPC endpoint. |
 |  [vpc\_endpoint\_sagemaker\_api\_dns\_entry](#output\_vpc\_endpoint\_sagemaker\_api\_dns\_entry) | The DNS entries for the VPC Endpoint for SageMaker API. |
---
outputs.tf
@@ -523,6 +523,11 @@ output "vpc_endpoint_s3_pl_id" {
   value       = concat(aws_vpc_endpoint.s3.*.prefix_list_id, [""])[0]
 }

+output "vpc_endpoint_s3_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint for S3."
+  value       = flatten(aws_vpc_endpoint.s3.*.dns_entry)
+}
+
 output "vpc_endpoint_dynamodb_id" {
   description = "The ID of VPC endpoint for DynamoDB"
   value       = concat(aws_vpc_endpoint.dynamodb.*.id, [""])[0]
---

---

Choice D:
README.md
@@ -1182,6 +1182,7 @@ No modules.
 |  [vpc\_endpoint\_rekognition\_dns\_entry](#output\_vpc\_endpoint\_rekognition\_dns\_entry) | The DNS entries for the VPC Endpoint for Rekognition. |
 |  [vpc\_endpoint\_rekognition\_id](#output\_vpc\_endpoint\_rekognition\_id) | The ID of VPC endpoint for Rekognition |
 |  [vpc\_endpoint\_rekognition\_network\_interface\_ids](#output\_vpc\_endpoint\_rekognition\_network\_interface\_ids) | One or more network interfaces for the VPC Endpoint for Rekognition. |
+|  [vpc\_endpoint\_s3\_dns\_entry](#output\_vpc\_endpoint\_s3\_dns\_entry) | The DNS entries for the VPC endpoint for S3. |
 |  [vpc\_endpoint\_s3\_id](#output\_vpc\_endpoint\_s3\_id) | The ID of VPC endpoint for S3 |
 |  [vpc\_endpoint\_s3\_pl\_id](#output\_vpc\_endpoint\_s3\_pl\_id) | The prefix list for the S3 VPC endpoint. |
 |  [vpc\_endpoint\_sagemaker\_api\_dns\_entry](#output\_vpc\_endpoint\_sagemaker\_api\_dns\_entry) | The DNS entries for the VPC Endpoint for SageMaker API. |
---
outputs.tf
@@ -523,6 +523,11 @@ output "vpc_endpoint_s3_pl_id" {
   value       = concat(aws_vpc_endpoint.s3.*.prefix_list_id, [""])[0]
 }

+output "vpc_endpoint_s3_dns_entry" {
+  description = "The DNS entries for the VPC Endpoint [vpc\_endpoint\_s3\_pl\_id](#output\_vpc\_endpoint\_s3\_pl\_id) S3."
+  value       = flatten(aws_vpc_endpoint.s3.*.dns_entry)
+}
+
 output "vpc_endpoint_dynamodb_id" {
   description = "The ID of VPC endpoint for DynamoDB"
   value       = concat(aws_vpc_endpoint.dynamodb.*.id, [""])[0]
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add the availability of the rds-data api endpoint inside vpc

## Motivation and Context
I really need rds-data api in my projects

## Breaking Changes
No breaking changes

## How Has This Been Tested?
Tested locally

---

Choice A:
README.md
@@ -363,6 +363,7 @@ No modules.
 | [aws_vpc_endpoint.monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.qldb_session](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint.rds_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rekognition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.sagemaker_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
@@ -719,6 +720,7 @@ No modules.
 |  [enable\_public\_s3\_endpoint](#input\_enable\_public\_s3\_endpoint) | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 |  [enable\_qldb\_session\_endpoint](#input\_enable\_qldb\_session\_endpoint) | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rds\_endpoint](#input\_enable\_rds\_endpoint) | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+|  [enable\_rds\_data\_endpoint](#input\_enable\_rds\_data\_endpoint) | Should be true if you want to provision an RDS-DATA endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rekognition\_endpoint](#input\_enable\_rekognition\_endpoint) | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_s3\_endpoint](#input\_enable\_s3\_endpoint) | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_sagemaker\_api\_endpoint](#input\_enable\_sagemaker\_api\_endpoint) | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -845,6 +847,9 @@ No modules.
 |  [rds\_endpoint\_private\_dns\_enabled](#input\_rds\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 |  [rds\_endpoint\_security\_group\_ids](#input\_rds\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 |  [rds\_endpoint\_subnet\_ids](#input\_rds\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_private\_dns\_enabled](#input\_rds\_data\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint | `bool` | `false` | no |
+|  [rds\_data\_endpoint\_security\_group\_ids](#input\_rds\_data\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_subnet\_ids](#input\_rds\_data\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` omitted, no |
 |  [redshift\_dedicated\_network\_acl](#input\_redshift\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 |  [redshift\_inbound\_acl\_rules](#input\_redshift\_inbound\_acl\_rules) | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -2081,6 +2081,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1456,6 +1456,28 @@ resource "aws_vpc_endpoint" "rds" {
   tags                = local.vpce_tags
 }

+###########################
+# VPC Endpoint for RDS-DATA
+###########################
+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+  tags                = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice B:
README.md
@@ -363,6 +363,7 @@ No modules.
 | [aws_vpc_endpoint.monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.qldb_session](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint.rds_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rekognition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.sagemaker_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
@@ -719,6 +720,7 @@ No modules.
 |  [enable\_public\_s3\_endpoint](#input\_enable\_public\_s3\_endpoint) | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 |  [enable\_qldb\_session\_endpoint](#input\_enable\_qldb\_session\_endpoint) | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rds\_endpoint](#input\_enable\_rds\_endpoint) | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+|  [enable\_rds\_data\_endpoint](#input\_enable\_rds\_data\_endpoint) | Should be true if you want to provision an RDS-DATA endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rekognition\_endpoint](#input\_enable\_rekognition\_endpoint) | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_s3\_endpoint](#input\_enable\_s3\_endpoint) | Should be true if you in to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_sagemaker\_api\_endpoint](#input\_enable\_sagemaker\_api\_endpoint) | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -845,6 +847,9 @@ No modules.
 |  [rds\_endpoint\_private\_dns\_enabled](#input\_rds\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 |  [rds\_endpoint\_security\_group\_ids](#input\_rds\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 |  [rds\_endpoint\_subnet\_ids](#input\_rds\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_private\_dns\_enabled](#input\_rds\_data\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint | `bool` | `false` | no |
+|  [rds\_data\_endpoint\_security\_group\_ids](#input\_rds\_data\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_subnet\_ids](#input\_rds\_data\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 |  [redshift\_dedicated\_network\_acl](#input\_redshift\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 |  [redshift\_inbound\_acl\_rules](#input\_redshift\_inbound\_acl\_rules) | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -2081,6 +2081,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1456,6 +1456,28 @@ resource "aws_vpc_endpoint" "rds" {
   tags                = local.vpce_tags
 }

+###########################
+# VPC Endpoint for RDS-DATA
+###########################
+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+  tags                = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice C:
README.md
@@ -363,6 +363,7 @@ No modules.
 | [aws_vpc_endpoint.monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.qldb_session](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint.rds_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rekognition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.sagemaker_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
@@ -719,6 +720,7 @@ No modules.
 |  [enable\_public\_s3\_endpoint](#input\_enable\_public\_s3\_endpoint) | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 |  [enable\_qldb\_session\_endpoint](#input\_enable\_qldb\_session\_endpoint) | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rds\_endpoint](#input\_enable\_rds\_endpoint) | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+|  [enable\_rds\_data\_endpoint](#input\_enable\_rds\_data\_endpoint) | Should be true if more want to provision an RDS-DATA endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rekognition\_endpoint](#input\_enable\_rekognition\_endpoint) | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_s3\_endpoint](#input\_enable\_s3\_endpoint) | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_sagemaker\_api\_endpoint](#input\_enable\_sagemaker\_api\_endpoint) | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -845,6 +847,9 @@ No modules.
 |  [rds\_endpoint\_private\_dns\_enabled](#input\_rds\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 |  [rds\_endpoint\_security\_group\_ids](#input\_rds\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 |  [rds\_endpoint\_subnet\_ids](#input\_rds\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_private\_dns\_enabled](#input\_rds\_data\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint | `bool` | `false` | no |
+|  [rds\_data\_endpoint\_security\_group\_ids](#input\_rds\_data\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_subnet\_ids](#input\_rds\_data\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 |  [redshift\_dedicated\_network\_acl](#input\_redshift\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 |  [redshift\_inbound\_acl\_rules](#input\_redshift\_inbound\_acl\_rules) | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -2081,6 +2081,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1456,6 +1456,28 @@ resource "aws_vpc_endpoint" "rds" {
   tags                = local.vpce_tags
 }

+###########################
+# VPC Endpoint for RDS-DATA
+###########################
+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+  tags                = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---

Choice D:
README.md
@@ -363,6 +363,7 @@ No modules.
 | [aws_vpc_endpoint.monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.qldb_session](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint.rds_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.rekognition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint.sagemaker_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
@@ -719,6 +720,7 @@ No modules.
 |  [enable\_public\_s3\_endpoint](#input\_enable\_public\_s3\_endpoint) | Whether to enable S3 VPC Endpoint for public subnets | `bool` | `true` | no |
 |  [enable\_qldb\_session\_endpoint](#input\_enable\_qldb\_session\_endpoint) | Should be true if you want to provision an QLDB Session endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rds\_endpoint](#input\_enable\_rds\_endpoint) | Should be true if you want to provision an RDS endpoint to the VPC | `bool` | `false` | no |
+|  [enable\_rds\_data\_endpoint](#input\_enable\_rds\_data\_endpoint) | Should be true if you want to provision an RDS-DATA endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_rekognition\_endpoint](#input\_enable\_rekognition\_endpoint) | Should be true if you want to provision a Rekognition endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_s3\_endpoint](#input\_enable\_s3\_endpoint) | Should be true if you want to provision an S3 endpoint to the VPC | `bool` | `false` | no |
 |  [enable\_sagemaker\_api\_endpoint](#input\_enable\_sagemaker\_api\_endpoint) | Should be true if you want to provision a SageMaker API endpoint to the VPC | `bool` | `false` | no |
@@ -845,6 +847,9 @@ No modules.
 |  [rds\_endpoint\_private\_dns\_enabled](#input\_rds\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS endpoint | `bool` | `false` | no |
 |  [rds\_endpoint\_security\_group\_ids](#input\_rds\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS endpoint | `list(string)` | `[]` | no |
 |  [rds\_endpoint\_subnet\_ids](#input\_rds\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_private\_dns\_enabled](#input\_rds\_data\_endpoint\_private\_dns\_enabled) | Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint | `bool` | `false` | no |
+|  [rds\_data\_endpoint\_security\_group\_ids](#input\_rds\_data\_endpoint\_security\_group\_ids) | The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint | `list(string)` | `[]` | no |
+|  [rds\_data\_endpoint\_subnet\_ids](#input\_rds\_data\_endpoint\_subnet\_ids) | The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
 |  [redshift\_dedicated\_network\_acl](#input\_redshift\_dedicated\_network\_acl) | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | `bool` | `false` | no |
 |  [redshift\_inbound\_acl\_rules](#input\_redshift\_inbound\_acl\_rules) | Redshift subnets inbound network ACL rules | `list(map(string))` |
[
  {
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_action": "allow",
    "rule_number": 100,
    "to_port": 0
  }
]
 | no |
---
variables.tf
@@ -2081,6 +2081,30 @@ variable "rds_endpoint_private_dns_enabled" {
   default     = false
 }

+variable "enable_rds_data_endpoint" {
+  description = "Should be true if you want to provision an RDS-DATA endpoint to the VPC"
+  type        = bool
+  default     = false
+}
+
+variable "rds_data_endpoint_security_group_ids" {
+  description = "The ID of one or more security groups to associate with the network interface for RDS-DATA endpoint"
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_subnet_ids" {
+  description = "The ID of one or more subnets in which to create a network interface for RDS-DATA endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used."
+  type        = list(string)
+  default     = []
+}
+
+variable "rds_data_endpoint_private_dns_enabled" {
+  description = "Whether or not to associate a private hosted zone with the specified VPC for RDS-DATA endpoint"
+  type        = bool
+  default     = false
+}
+
 variable "enable_codedeploy_endpoint" {
   description = "Should be true if you want to provision an CodeDeploy endpoint to the VPC"
   type        = bool
---
vpc-endpoints.tf
@@ -1456,6 +1456,28 @@ resource "aws_vpc_endpoint" "rds" {
   tags                = local.vpce_tags
 }

+###########################
+# VPC Endpoint for RDS-DATA
+###########################
+data "aws_vpc_endpoint_service" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  service = "rds-data"
+}
+
+resource "aws_vpc_endpoint" "rds_data" {
+  count = var.create_vpc && var.enable_rds_data_endpoint ? 1 : 0
+
+  vpc_id            = local.vpc_id
+  service_name      = data.aws_vpc_endpoint_service.rds_data[0].service_name
+  vpc_endpoint_type = "Interface"
+
+  security_group_ids  = var.rds_data_endpoint_security_group_ids
+  subnet_ids          = coalescelist(var.rds_data_endpoint_subnet_ids, aws_subnet.private.*.id)
+  private_dns_enabled = var.rds_data_endpoint_private_dns_enabled
+  tags                = local.vpce_tags
+}
+
 #############################
 # VPC Endpoint for CodeDeploy
 #############################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
When the change of endpoint type was added to s3 and ddb - the routing was configured for most other subnet types but not database.

## Motivation and Context
Allows database instances to access S3 directly w/o going over egress paths

## Breaking Changes
None

## How Has This Been Tested?
We have tested this in a 500+ account deployment

---

Choice A:
vpc-endpoints.tf
@@ -35,6 +35,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_s3" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_s3" {
+  count = var.create_vpc && var.enable_s3_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.s3[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_s3" {
   count = var.create_vpc && var.enable_s3_endpoint && length(var.intra_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? 1 : 0

@@ -86,6 +93,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_dynamodb" {
+  count = var.create_vpc && var.enable_dynamodb_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? && || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.dynamodb[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint && length(var.intra_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? 1 : 0

---

---

Choice B:
vpc-endpoints.tf
@@ -35,6 +35,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_s3" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_s3" {
+  count = var.create_vpc && var.enable_s3_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.s3[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_s3" {
   count = var.create_vpc && var.enable_s3_endpoint && length(var.intra_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? 1 : 0

@@ -86,6 +93,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_dynamodb" {
+  count = var.create_vpc && var.enable_dynamodb_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.dynamodb[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint && length(var.intra_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? 1 : 0

---

---

Choice C:
vpc-endpoints.tf
@@ -35,6 +35,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_s3" {
     = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_s3" {
+  count = var.create_vpc && var.enable_s3_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.s3[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_s3" {
   count = var.create_vpc && var.enable_s3_endpoint && length(var.intra_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? 1 : 0

@@ -86,6 +93,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_dynamodb" {
+  count = var.create_vpc && var.enable_dynamodb_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.dynamodb[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint && length(var.intra_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? 1 : 0

---

---

Choice D:
vpc-endpoints.tf
@@ -35,6 0
+
+ @@ resource "aws_vpc_endpoint_route_table_association" "private_s3" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_s3" {
+  count = var.create_vpc && var.enable_s3_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.s3[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_s3" {
   count = var.create_vpc && var.enable_s3_endpoint && length(var.intra_subnets) > 0 && var.s3_endpoint_type == "Gateway" ? 1 : 0

@@ -86,6 +93,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
   route_table_id  = element(aws_route_table.private.*.id, count.index)
 }

+resource "aws_vpc_endpoint_route_table_association" "database_dynamodb" {
+  count = var.create_vpc && var.enable_dynamodb_endpoint && var.create_database_subnet_route_table && length(var.database_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? var.single_nat_gateway || var.create_database_internet_gateway_route ? 1 : length(var.database_subnets) : 0
+
+  vpc_endpoint_id = aws_vpc_endpoint.dynamodb[0].id
+  route_table_id  = element(aws_route_table.database.*.id, 0)
+}
+
 resource "aws_vpc_endpoint_route_table_association" "intra_dynamodb" {
   count = var.create_vpc && var.enable_dynamodb_endpoint && length(var.intra_subnets) > 0 && var.dynamodb_endpoint_type == "Gateway" ? 1 : 0

---

---