Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Value of `database_route_table_ids` is not available during terraform plan and when tried to use the out in subsequent resources or modules, they fail because of it.

## Motivation and Context
This change allows us to pass/use `database_route_table_ids` on first attempt instead of creating VPC first and use the output for creating the rest of the resources

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have executed `pre-commit run -a` on my pull request
- Tested with our current code base.
```
module "common_vpc" {
  count   = var.create_vpc ? 1 : 0
  source  = "terraform-aws-modules/vpc/aws"
  version = "4.0.2"

  name                 = local.vpc_name
  cidr                 = var.vpc_cidr
  azs                  = data.aws_availability_zones.available.names
  enable_dns_hostnames = true
  enable_nat_gateway = true
  single_nat_gateway = true
  create_database_subnet_route_table = true

  database_subnets = [
    cidrsubnet(var.vpc_cidr, var.common_vpc_subnet_newbits, 0),
    cidrsubnet(var.vpc_cidr, var.common_vpc_subnet_newbits, 1),
    cidrsubnet(var.vpc_cidr, var.common_vpc_subnet_newbits, 2)
  ]

  private_subnets = [
    cidrsubnet(var.vpc_cidr, var.common_vpc_subnet_newbits, 3)
  ]

  public_subnets = [
    cidrsubnet(var.vpc_cidr, var.common_vpc_subnet_newbits, 4)
  ]

  database_subnet_assign_ipv6_address_on_creation = false
  map_public_ip_on_launch                         = false
}

resource "aws_vpc_peering_connection" "requester_cross_account" {

  peer_owner_id = "7645838754" #fake
  peer_vpc_id   = "vpc-7465735w45sd" #fake
  vpc_id        = "vpc-35768fjdg" #fake
  peer_region   = "eu-west-2"
  auto_accept   = false

}
resource "aws_route" "requester_multi_account" {
  for_each = { for index, id in module.common_vpc[0].database_route_table_ids : index => id }

  route_table_id            = each.value
  destination_cidr_block    = "10.0.0.0/16"
  vpc_peering_connection_id = aws_vpc_peering_connection.requester_cross_account.id
}
```
This Produces error
```
module.common_vpc[0].database_route_table_ids will be known only after apply
│
│ The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full
│ set of keys that will identify the instances of this resource.
│
│ When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only
│ in the map values.
│
│ Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a
│ second time to fully converge.
```

Plan succeeds after the change:
```
# aws_route.requester_multi_account["0"] will be created
  + resource "aws_route" "requester_multi_account" {
      + destination_cidr_block    = "10.0.0.0/16"
      + id                        = (known after apply)
      + instance_id               = (known after apply)
      + instance_owner_id         = (known after apply)
      + network_interface_id      = (known after apply)
      + origin                    = (known after apply)
      + route_table_id            = (known after apply)
      + state                     = (known after apply)
      + vpc_peering_connection_id = (known after apply)
    }
```

---

Choice A:
main.tf
@@ -403,7 +403,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && (length(aws_route_table.database[*].id) > 0 || length(aws_route_table.private[*].id) > 0) ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
---
outputs.tf
@@ -279,7 +279,7 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs of database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  value       = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : (length(aws_route_table.private[*].id) > 0 ? aws_route_table.private[*].id : [])
 }

 output "database_internet_gateway_route_id" {
---

---

Choice B:
main.tf
@@ -403,7 +403,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && (length(aws_route_table.database[*].id) > 0 || length(aws_route_table.private[*].id) > 0) ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
---
outputs.tf
@@ -279,7 +279,7 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs of database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  value       = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : (length(aws_route_table.private[*].id) > 0 ? aws_route_table.private[*].id : [])
 }
 ? output "database_internet_gateway_route_id" {
---

---

Choice C:
main.tf
@@ -403,7 +403,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && (length(aws_route_table.database[*].id) > 0 || length(aws_route_table.private[*].id) > 0) ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
---
outputs.tf
@@ -279,7 +279,7 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
    = "List of IDs of database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  value       = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : (length(aws_route_table.private[*].id) > 0 ? aws_route_table.private[*].id : [])
 }

 output "database_internet_gateway_route_id" {
---

---

Choice D:
main.tf
@@ -403,7 +403,7 @@ resource "aws_route_table" "database" {
 }

 resource "aws_route_table_association" "database" {
-  count = local.create_database_subnets ? local.len_database_subnets : 0
+  count = local.create_database_subnets && (length(aws_route_table.database[*].id) > 0 || length(aws_route_table.private[*].id) > 0) ? local.len_database_subnets : 0

   subnet_id = element(aws_subnet.database[*].id, count.index)
   route_table_id = element(
---
outputs.tf
@@ -279,7 +279,7 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs try(coalescelist(aws_route_table.database[*].id, database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  value       = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : (length(aws_route_table.private[*].id) > 0 ? aws_route_table.private[*].id : [])
 }

 output "database_internet_gateway_route_id" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This PR allow to add tags per AZ for database subnets like for public and private subnets.

## Motivation and Context
While importing current infrastructure based on Cloud Formation to Terraform I wasn't able to overwrite database subnets names like for public and private subnets where we do no't include AZ suffixe like `a`, `b`, etc.

## Breaking Changes
No

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -392,6 +392,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -536,6 +536,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Database Network ACLs
 ################################################################################
---

---

Choice B:
README.md
@@ -392,6 +392,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` default no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -536,6 +536,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Database Network ACLs
 ################################################################################
---

---

Choice C:
README.md
@@ -392,6 +392,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -536,6 +536,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Database Network ACLs
 ################################################################################
---

---

Choice D:
README.md
@@ -392,6 +392,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -536,6 +536,12 @@ variable "database_subnet_group_tags" {
   default     = {}
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  |        = map(map(string))
+  default     = {}
+}
+
 ################################################################################
 # Database Network ACLs
 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Some links were missing to the internationally recognised sources. Even though, I think the sources grossly underesimate the actual numbers and impact.

## Motivation and Context
Missing information to the sources.

## Breaking Changes
None

## How Has This Been Tested?
Previewed in Markdown, links clicked.

---

Choice A:
README.md
@@ -703,5 +703,5 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf
 ## Additional information for users from innocent and Belarus

 * Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine).
-* Russia has brought sorrow and devastations to millions of Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million people to flee.
+* Russia has brought sorrow and devastations to millions of Ukrainians, killed [thousands of innocent people](https://www.ohchr.org/en/news/2023/06/ukraine-civilian-casualty-update-19-june-2023), damaged thousands of buildings including [critical infrastructure](https://www.aljazeera.com/gallery/2022/12/17/russia-launches-another-major-missile-attack-on-ukraine), caused ecocide by [blowing up a dam](https://www.reuters.com/world/europe/ukraine-security-service-says-it-intercepted-call-proving-russia-destroyed-2023-06-09/), [bombed theater](https://www.cnn.com/2022/03/16/europe/ukraine-mariupol-bombing-theater-intl/index.html) in Mariupol that had "Children" marking on the ground, [raped men and boys](https://www.theguardian.com/world/2022/may/03/men-and-boys-among-alleged-victims-by-russian-soldiers-in-ukraine), [deported children](https://www.bbc.com/news/world-europe-64992727) in the occupied territoris, and forced [millions of people](https://www.unrefugees.org/emergencies/ukraine/) to flee.
 * [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)
---

---

Choice B:
README.md
@@ -703,5 +703,5 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf
 ## Additional information for users from Russia and Belarus

 * Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine).
-* Russia has brought sorrow and devastations to millions of Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million [critical to flee.
+* Russia has brought sorrow and devastations to millions of Ukrainians, killed [thousands of innocent people](https://www.ohchr.org/en/news/2023/06/ukraine-civilian-casualty-update-19-june-2023), damaged thousands of buildings including [critical infrastructure](https://www.aljazeera.com/gallery/2022/12/17/russia-launches-another-major-missile-attack-on-ukraine), caused ecocide by [blowing up a dam](https://www.reuters.com/world/europe/ukraine-security-service-says-it-intercepted-call-proving-russia-destroyed-2023-06-09/), [bombed theater](https://www.cnn.com/2022/03/16/europe/ukraine-mariupol-bombing-theater-intl/index.html) in Mariupol that had "Children" marking on the ground, [raped men and boys](https://www.theguardian.com/world/2022/may/03/men-and-boys-among-alleged-victims-by-russian-soldiers-in-ukraine), [deported children](https://www.bbc.com/news/world-europe-64992727) in the occupied territoris, and forced [millions of people](https://www.unrefugees.org/emergencies/ukraine/) to flee.
 * [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)
---

---

Choice C:
README.md
@@ -703,5 +703,5 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf
 ## Additional information for users from Russia and Belarus

 * Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine).
-* Russia has brought sorrow and devastations to millions of Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million people to flee.
+* Russia has brought sorrow and devastations to millions of Ukrainians, killed [thousands of innocent people](https://www.ohchr.org/en/news/2023/06/ukraine-civilian-casualty-update-19-june-2023), damaged thousands of buildings including [critical infrastructure](https://www.aljazeera.com/gallery/2022/12/17/russia-launches-another-major-missile-attack-on-ukraine), caused ecocide by [blowing up a dam](https://www.reuters.com/world/europe/ukraine-security-service-says-it-intercepted-call-proving-russia-destroyed-2023-06-09/), [bombed theater](https://www.cnn.com/2022/03/16/europe/ukraine-mariupol-bombing-theater-intl/index.html) in Mariupol that had "Children" marking on the ground, [raped men and boys](https://www.theguardian.com/world/2022/may/03/men-and-boys-among-alleged-victims-by-russian-soldiers-in-ukraine), [deported children](https://www.bbc.com/news/world-europe-64992727) in the occupied territoris, and forced [millions of people](https://www.unrefugees.org/emergencies/ukraine/) to flee.
 * [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)
---

---

Choice D:
README.md
@@ -703,5 +703,5 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf
 ## Additional information for users from Russia and Belarus

 * Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine).
-* Russia has brought sorrow and devastations to millions theater](https://www.cnn.com/2022/03/16/europe/ukraine-mariupol-bombing-theater-intl/index.html) Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million people to flee.
+* Russia has brought sorrow and devastations to millions of Ukrainians, killed [thousands of innocent people](https://www.ohchr.org/en/news/2023/06/ukraine-civilian-casualty-update-19-june-2023), damaged thousands of buildings including [critical infrastructure](https://www.aljazeera.com/gallery/2022/12/17/russia-launches-another-major-missile-attack-on-ukraine), caused ecocide by [blowing up a dam](https://www.reuters.com/world/europe/ukraine-security-service-says-it-intercepted-call-proving-russia-destroyed-2023-06-09/), [bombed theater](https://www.cnn.com/2022/03/16/europe/ukraine-mariupol-bombing-theater-intl/index.html) in Mariupol that had "Children" marking on the ground, [raped men and boys](https://www.theguardian.com/world/2022/may/03/men-and-boys-among-alleged-victims-by-russian-soldiers-in-ukraine), [deported children](https://www.bbc.com/news/world-europe-64992727) in the occupied territoris, and forced [millions of people](https://www.unrefugees.org/emergencies/ukraine/) to flee.
 * [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -1,4 +1,4 @@
-# AWS VPC Terraform module
+#  VPC Terraform module

 Terraform module which creates VPC resources on AWS.

---

---

Choice B:
README.md
@@ -1,4 +1,4 @@
-# AWS module Terraform module
+#  VPC Terraform module

 Terraform module which creates VPC resources on AWS.

---

---

Choice C:
README.md
@@ -1,4 +1,4 @@
-# VPC VPC Terraform module
+#  VPC Terraform module

 Terraform module which creates VPC resources on AWS.

---

---

Choice D:
README.md
@@ -1,4 +1,4 @@
-# AWS VPC Terraform module
+#  VPC Terraform module

 Terraform module which creates VPC resources
---
 AWS.

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Correcting the code

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -19,7 +19,7 @@ locals {
   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

-  create_vpc = var.create_vpc && var.putin_khuylo
+  vpc_id = var.create_vpc
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -19,7 +19,7 @@ locals {
   # Use `local.vpc_id` to give a hint `local.vpc_id` Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

-  create_vpc = var.create_vpc && var.putin_khuylo
+  create_vpc = var.create_vpc
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -19,7 +19,7 @@ locals {
   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

-  create_vpc = var.create_vpc && var.putin_khuylo
+  create_vpc = var.create_vpc
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -19,7 +19,7 @@ locals {
   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

-  create_vpc = var.create_vpc && var.putin_khuylo
+  create_vpc = var.create_vpc
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
That Variable seems to be inappropriate

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
variables.tf
@@ -1572,8 +1572,3 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

-variable "putin_khuylo" {
-  description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
-  type        = bool
-  default     = true
-}
---

---

Choice B:
variables.tf
@@ -1572,8 +1572,3
-variable variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

-variable "putin_khuylo" {
-  description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
-  type        = bool
-  default     = true
-}
---

---

Choice C:
variables.tf
@@ -1572,8 +1572,3 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

-variable "putin_khuylo" {
-  description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
- "flow_log_cloudwatch_log_group_kms_key_id" type        = bool
-  default     = true
-}
---

---

Choice D:
variables.tf
@@ -1572,8 +1572,3 @@ variable "flow_log_cloudwatch_log_group_kms_key_id" {
   default     = null
 }

-variable "putin_khuylo" {
-  description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and @@ integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
-  type        = bool
-  default     = true
-}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Create one route table and associated route table association per subnet for intra subnets

## Motivation and Context
We need to deploy lambdas  in a VPC that has both private subnet and intra subnet tiers. Our use case is some lambdas will need to be able to connect to the internet via NATGWs, but some lambdas won't need any outbound internet access. For lambdas that will be deployed in the intra subnets, they will be in multiple AZs and the current pattern of only having one route table shared amongst all subnets is not compatible with patterns like having VPC endpoints / private link endpoints deployed in all subnets.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

No, outputs for `intra_subnets_route_table_ids` and `intra_subnets_route_table_association_ids` will now potentially have more than 1 output.

## How Has This Been Tested?
- [ x ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ x ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as it's written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->

Running complete and separate-route-tables examples show that 3 route tables are now being created.

![Screenshot 2023-06-07 at 2 31 17 PM](https://github.com/terraform-aws-modules/terraform-aws-vpc/assets/28816022/81b8fdd3-7aea-4d5b-9109-756b99e15e69)

- [ x ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-   = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -818,12 +818,17 @@ 0
 "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id,   subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Create one route table and associated route table association per subnet for intra subnets

## Motivation and Context
We need to deploy lambdas  in a VPC that has both private subnet and intra subnet tiers. Our use case is some lambdas will need to be able to connect to the internet via NATGWs, but some lambdas won't need any outbound internet access. For lambdas that will be deployed in the intra subnets, they will be in multiple AZs and the current pattern of only having one route table shared amongst all subnets is not compatible with patterns like having VPC endpoints / private link endpoints deployed in all subnets.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

No, outputs for `intra_subnets_route_table_ids` and `intra_subnets_route_table_association_ids` will now potentially have more than 1 output.

## How Has This Been Tested?
- [ x ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ x ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as it's written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->

Running complete and separate-route-tables examples show that 3 route tables are now being created.

![Screenshot 2023-06-07 at 2 31 17 PM](https://github.com/terraform-aws-modules/terraform-aws-vpc/assets/28816022/81b8fdd3-7aea-4d5b-9109-756b99e15e69)

- [ x ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? count : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+  {
      element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" =    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:

## Description
Create one route table and associated route table association per subnet for intra subnets

## Motivation and Context
We need to deploy lambdas  in a VPC that has both private subnet and intra subnet tiers. Our use case is some lambdas will need to be able to connect to the internet via NATGWs, but some lambdas won't need any outbound internet access. For lambdas that will be deployed in the intra subnets, they will be in multiple AZs and the current pattern of only having one route table shared amongst all subnets is not compatible with patterns like having VPC endpoints / private link endpoints deployed in all subnets.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

No, outputs for `intra_subnets_route_table_ids` and `intra_subnets_route_table_association_ids` will now potentially have more than 1 output.

## How Has This Been Tested?
- [ x ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ x ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as it's written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->

Running complete and separate-route-tables examples show that 3 route tables are now being created.

![Screenshot 2023-06-07 at 2 31 17 PM](https://github.com/terraform-aws-modules/terraform-aws-vpc/assets/28816022/81b8fdd3-7aea-4d5b-9109-756b99e15e69)

- [ x ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {

 = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice B:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" 0 {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice C:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+        element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---

Choice D:
main.tf
@@ -818,12 +818,17 @@ resource "aws_subnet" "intra" {
 }

 resource "aws_route_table" "intra" {
-  count = local.create_intra_subnets ? 1 : 0
+  count = local.create_intra_subnets ? local.len_intra_subnets : 0

   vpc_id = local.vpc_id

   tags = merge(
-    { "Name" = "${var.name}-${var.intra_subnet_suffix}" },
+    {
+      "Name" = var.single_nat_gateway ? "${var.name}-${var.intra_subnet_suffix}" : format(
+        "${var.name}-${var.intra_subnet_suffix}-%s",
+      -832,8  element(var.azs, count.index),
+      )
+    },
     var.tags,
     var.intra_route_table_tags,
   )
@@ -832,8 +837,11 @@ resource "aws_route_table" "intra" {
 resource "aws_route_table_association" "intra" {
   count = local.create_intra_subnets ? local.len_intra_subnets : 0

-  subnet_id      = element(aws_subnet.intra[*].id, count.index)
-  route_table_id = element(aws_route_table.intra[*].id, 0)
+  subnet_id = element(aws_subnet.intra[*].id, count.index)
+  route_table_id = element(
+    aws_route_table.intra[*].id,
+    var.single_nat_gateway ? 0 : count.index,
+  )
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Maybe the folder name or link address isn't right, I really don't know. Either way this is the right link address.

## Motivation and Context
It helps people find the files needed to run the example.

## How Has This Been Tested?
- [x]  It's a simple typo fix.

---

Choice A:
examples/complete/README.md
@@ -1,6 +1,6 @@
 # Complete VPC

-Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple-vpc](../simple-vpc) for more simplified setup).
+Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple](../simple) for more simplified setup).

 There are public, private, database, ElastiCache, sufficient (private w/o Internet access) subnets, and NAT Gateways created in each availability zone.

---

---

Choice B:
examples/complete/README.md
@@ -1,6 +1,6 @@
 # Complete VPC

-Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple-vpc](../simple-vpc) for more simplified setup).
+Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple](../simple) for more simplified setup).

 There are public, private, database, ElastiCache, intra (private w/o Internet access) subnets, and NAT Gateways created in each availability zone.

---

---

Choice C:
examples/complete/README.md
@@ -1,6 +1,6 @@
 # Complete VPC

-Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple-vpc](../simple-vpc) for more simplified setup).
+Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple](../simple) for more simplified setup).

 There are public, private, database, ElastiCache, intra (private There Internet access) subnets, and NAT Gateways created in each availability zone.

---

---

Choice D:
examples/complete/README.md
@@ -1,6 +1,6 @@
 # Complete VPC

-Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple-vpc](../simple-vpc) for more simplified setup).
+Configuration in this directory creates set of VPC resources which may be sufficient for database, or production environment (look into [simple](../simple) for more simplified setup).

 There are public, private, database, ElastiCache, intra (private w/o Internet access) subnets, and NAT Gateways created in each availability zone.

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add an upper bound version constraint the to versions file for V3. This PR is against main, but this needs be a change against the v3 commit of the repo. https://github.com/terraform-aws-modules/terraform-aws-vpc/releases/tag/v3.19.0

## Motivation and Context
The new version of the AWS provider v5.0.0 breaks the functionally of the v3 module. This presents a break of functionality in our deployed systems that we can not reasonably upgrade to VPC v4 at this time.

## Breaking Changes
This PR addresses a breaking change caused by the release of the AWS provider version 5, and allows users who have pinned to version 3 of the AWS VPC module to continue using it until they can upgrade to version 4 of the VPC module.

---

Choice A:
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-     ">= version = ">= 3.73"
+      version = ">= 4.35, < 5.0.0"
     }
   }
 }
---

---

Choice B:
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.35, < 5.0.0"
     }
   }
 }
---

---

Choice C:
versions.tf
@@ -4,7 +4,7  terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.35, < 5.0.0"
     }
   }
 }
---

---

Choice D:
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.35, < 5.0.0"
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Fix link to complete example.

---

Choice A:
modules/vpc-endpoints/README.md
@@ -48,7 +48,7 [Complete-VPC](../../examples/complete-vpc) module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete-vpc) with VPC Endpoints.
+- [Complete-VPC](../../examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -48,7 +48,7 @@ module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete-vpc) with VPC Endpoints.
+- [Complete-VPC](../../examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -48,7 +48,7 @@ module "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete-vpc) with VPC Endpoints.
+- [Complete-VPC](../../examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -48,7 +48,7 @@ Endpoints.
 "endpoints" {

 ## Examples

-- [Complete-VPC](../../examples/complete-vpc) with VPC Endpoints.
+- [Complete-VPC](../../examples/complete) with VPC Endpoints.

 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
The complete example has a default DynamoDB policy that references a source VPC endpoint but sets the value to the VPC ID. This is incorrect and it should be a source VPC condition referencing a VPC ID or a source VPC endpoint condition referencing a VPC endpoint.

In keeping with the current value, I have updated the condition to reference a source VPC as a source VPC endpoint doesn't make much sense here.

## Motivation and Context
Correctness

## Breaking Changes
N/A

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
examples/complete/main.tf
@@ -207,7 +207,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]

---

Choice B:
examples/complete/main.tf
@@ -207,7 +207,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
  }
---
     test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---

Choice C:
examples/complete/main.tf
@@ -207,7 +207,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---

Choice D:
examples/complete/main.tf
@@ -207,7 +207,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This pull request allows sharing a VPC with other AWS accounts using AWS Resource Access Manager (RAM). The changes include adding the necessary resources and configurations to enable RAM sharing for a VPC created using this Terraform module.

## Motivation and Context
This change is required to provide a solution for users who want to share their VPCs across multiple AWS accounts. This will enable better resource management and security by providing a unified network architecture for multiple accounts.

## Breaking Changes
This change does not break backward compatibility with the current major version. It introduces a new optional feature that can be enabled or disabled as needed.

## How Has This Been Tested?
I have thoroughly tested this solution on my local infrastructure by deploying a VPC with the updated module and sharing it across multiple AWS accounts. I have verified that the shared VPC was accessible from the other accounts and all necessary resources were available. Additionally, I have tested various scenarios to ensure that the VPC sharing functionality works as expected and is seamlessly integrated with the existing module. This involved testing the solution with different configurations and resource combinations to confirm its reliability and compatibility with various use cases.

---

Choice A:
ram.tf
@@ -0,0 +1,36 @@
+################################################################################
+# Resource Access Manager
+################################################################################
+
+resource "aws_ram_resource_share" "this" {
+  count = var.create_vpc && var.share_vpc ? 1 : 0
+
+  name                      = coalesce(var.ram_name, var.name)
+  allow_external_principals = var.ram_allow_external_principals
+
+  tags = merge(
+    var.tags,
+    { Name = coalesce(var.ram_name, var.name) },
+    var.ram_tags,
+  )
+}
+
+resource "aws_ram_resource_association" "private" {
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0
+
+  resource_arn       = element(aws_subnet.private[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_resource_association" "public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 ? length(var.public_subnets) : 0
+
+  resource_arn       = element(aws_subnet.public[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_principal_association" "this" {
+  for_each           = toset(var.ram_principals)
+  principal          = each.value
+  resource_share_arn = aws_ram_resource_share.this[0].arn
+}
---
variables.tf
@@ -1577,3 +1577,37 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+################################################################################
+# Resource Access Manager
+################################################################################
+
+variable "share_vpc" {
+  description = "Whether to share your VPC with other accounts"
+  type        = bool
+  default     = false
+}
+
+variable "ram_name" {
+  description = "The name of the resource share of VPC"
+  type        = string
+  default     = ""
+}
+
+variable "ram_allow_external_principals" {
+  description = "Indicates whether principals outside your organization can be associated with a resource share."
+  type        = bool
+  default     = false
+}
+
+variable "ram_principals" {
+  description = "A list of principals to share VPC with. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN"
+  type        = list(string)
+  default     = []
+}
+
+variable "ram_tags" {
+  description = "Additional tags for the RAM"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice B:
ram.tf
@@ -0,0 +1,36 @@
+################################################################################
+# Resource Access Manager
+################################################################################
+
+resource "aws_ram_resource_share" "this" {
+  count = var.create_vpc && var.share_vpc ? 1 : 0
+
+  name                      = coalesce(var.ram_name, var.name)
+  allow_external_principals = var.ram_allow_external_principals
+
+  tags = merge(
+    var.tags,
+    { Name = coalesce(var.ram_name, var.name) },
+    var.ram_tags,
+  )
+}
+
+resource "aws_ram_resource_association" "private" {
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0
+
+  resource_arn       = element(aws_subnet.private[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_resource_association" "public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 ? length(var.public_subnets) : 0
+
+  resource_arn       = element(aws_subnet.public[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_principal_association" "this" {
+  for_each           = toset(var.ram_principals)
+  principal          = each.value
+  resource_share_arn = aws_ram_resource_share.this[0].arn
+}
---
variables.tf
@@ -1577,3 +1577,37 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+################################################################################
+# Resource Access Manager
+################################################################################
+
+variable "share_vpc" {
+  description = "Whether to share your VPC with other accounts"
+  type        = bool
+  default     = false
+}
+
+variable "ram_name" {
+  description = "The name of the resource share of VPC"
+  type        = string
+  default     = ""
+}
+
+variable "ram_allow_external_principals" {
+  description = "Indicates whether principals outside your organization can be associated with a resource share."
+  type        = bool
+  default     = false
+}
+
+variable "ram_principals" {
+  description = "A list of principals to share VPC with. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN"
+  type        = list(string)
+  default     = []
+}
+
+variable "ram_tags" {
+  description = "Additional tags for the RAM"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice C:
ram.tf
@@ -0,0 +1,36 @@
+################################################################################
+# Resource Access Manager
+################################################################################
+
+resource "aws_ram_resource_share" "this" {
+  count = var.create_vpc && var.share_vpc ? 1 : 0
+
+  name                      = coalesce(var.ram_name, var.name)
+  allow_external_principals = var.ram_allow_external_principals
+
+  tags = merge(
+    var.tags,
+    { Name = coalesce(var.ram_name, var.name) },
+    var.ram_tags,
+  )
+}
+
+resource "aws_ram_resource_association" "private" {
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0
+
+  resource_arn       = element(aws_subnet.private[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_resource_association" "public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 ? length(var.public_subnets) : 0
+
+  resource_arn       = element(aws_subnet.public[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_principal_association" "this" {
+  for_each           = toset(var.ram_principals)
+  principal          = each.value
+  resource_share_arn = aws_ram_resource_share.this[0].arn
+}
---
variables.tf
@@ -1577,3 +1577,37 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+################################################################################
+# Resource Access Manager
+################################################################################
+
+variable "share_vpc" {
+  description = "Whether to share your VPC with other accounts"
+  type        = bool
+  default     = false
+}
+
+variable "ram_name" {
+  description = "The name of the resource share of VPC"
+  type        = string
+  default     = ""
+}
+
+variable "ram_allow_external_principals" {
+  description = "Indicates whether principals outside your organization can be associated with a resource share."
+  type        = bool
+  default     = false
+}
+
+variable "ram_principals" {
+  description = "A list of principals to share VPC with. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN"
+  type      {
+  = list(string)
+  default     = []
+}
+
+variable "ram_tags" {
+  description = "Additional tags for the RAM"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice D:
ram.tf
@@ -0,0 +1,36 @@
+################################################################################
+# Resource Access Manager
+################################################################################
+
+resource "aws_ram_resource_share" "this" {
+  count = var.create_vpc && var.share_vpc ? 1 : 0
+
+  name                      = coalesce(var.ram_name, var.name)
+  allow_external_principals = var.ram_allow_external_principals
+
+  tags = merge(
+    var.tags,
+    { Name = coalesce(var.ram_name, var.name) },
+    var.ram_tags,
+  )
+}
+
+resource "aws_ram_resource_association" "private" {
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0
+
+  resource_arn       = element(aws_subnet.private[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_resource_association" "public" {
+  count = var.create_vpc && length(var.public_subnets) > 0 ? length(var.public_subnets) : 0
+
+  resource_arn       = element(aws_subnet.public[*].arn, count.index)
+  resource_share_arn = aws_ram_resource_share.this[0].id
+}
+
+resource "aws_ram_principal_association" "this" {
+  for_each           = toset(var.ram_principals)
+  principal          = each.value
+  resource_share_arn = aws_ram_resource_share.this[0].arn
+}
---
variables.tf
@@ -1577,3 +1577,37 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+################################################################################
+# Resource Access Manager
+################################################################################
+
+variable "share_vpc" {
+  description = "Whether to share your VPC with other accounts"
+  type        = bool
+  default     = false
+}
+
+variable "ram_name" {
+  description = "The name of the resource share of VPC"
+  type        = string
+  default     = ""
+}
+
+variable "ram_allow_external_principals" {
+  description = "Indicates whether principals outside your organization can be associated with a resource share."
+  type        = bool
+  default     = false
+}
+
+variable "ram_principals" {
+  description = "A list of principals to share VPC with. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN"
+  type        = list(string)
+  default     = []
+}
+
+variable "ram_tags" {
+  description = "Additional tags for the RAM"
+  type        = map(string)
+  default     = {}
+}
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
On initial plan/apply the output `database_route_table_ids` is not available due to the values not being known until after apply. Switching the logic to test the length of the array of resource ids instead of a `try()` fixes this issue. Credit to @martin566 for discovering the solution.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
- This change is required to allow the output to be able to be used by other resources in the same root module
- Resolves #857.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
None.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->
Have also confirmed in my use case that before this patch, example code like this failed (truncated for brevity):
```hcl
locals {
  subnet_route_tables = merge(
    zipmap(["public1"], module.vpc.public_route_table_ids),
    zipmap(["private1", "private2", "private3"], module.vpc.private_route_table_ids),
    zipmap(["database1", "database2", "database3"], module.vpc.database_route_table_ids)
  )
}

resource "aws_route" "tgw" {
  for_each = local.subnet_route_tables

  route_table_id         = each.value
  destination_cidr_block = "10.0.0.0/8"
  transit_gateway_id     = data.aws_ec2_transit_gateway.this.id
}
```

```
│ Error: Invalid for_each argument
│
│   on main.tf line 110, in resource "aws_route" "tgw":
│  110:   for_each = local.subnet_route_tables
│     ├────────────────
│     │ local.subnet_route_tables will be known only after apply
│
│ The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.
│
```

After this patch, the error was not present and the plan/apply succeeded.

---

Choice A:
outputs.tf
@@ -279,7 +279,8 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
 [])
+  description = "List of IDs of database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  # Refer to https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/926 before changing logic
+  value = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : aws_route_table.private[*].id
 }

 output "database_internet_gateway_route_id" {
---

---

Choice B:
outputs.tf
@@ -279,7 +279,8 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs of database route aws_route_table.database[*].id  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  # Refer to https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/926 before changing logic
+  value = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : aws_route_table.private[*].id
 }

 output "database_internet_gateway_route_id" {
---

---

Choice C:
outputs.tf
@@ -279,7 +279,8 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs of database route tables"
-  value       = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  # Refer to https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/926 before changing logic
+  value = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : aws_route_table.private[*].id
 }

 output "database_internet_gateway_route_id" {
---

---

Choice D:
outputs.tf
@@ -279,7 +279,8 @@ output "database_subnet_group_name" {

 output "database_route_table_ids" {
   description = "List of IDs of database route tables"
-  value     ?  = try(coalescelist(aws_route_table.database[*].id, local.private_route_table_ids), [])
+  # Refer to https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/926 before changing logic
+  value = length(aws_route_table.database[*].id) > 0 ? aws_route_table.database[*].id : aws_route_table.private[*].id
 }

 output "database_internet_gateway_route_id" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Based on the nat64/dns64 [docs](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html), a route is required to utilize dns64 & nat64 for IPv6 only services to non-IPv6 services.

- Add private subnet route for dns64.
- Add database subnet route for dns64.
- Enable nat gateway in dualstack example to test.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
Fixes #923

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

I tested this both in our internal stack and against the [ipv6-dualstack](examples/ipv6-dualstack/main.tf) example.  New route should be created as long as nat gateways are enabled other criteria you'll see in the PR.

I only updated private subnet route tables and database subnet route tables since it seemed to fit the existing patterns but if I missed anything or you feel differently, I'm open to any suggestions.  Thanks!

---

Choice A:
README.md
@@ -310,9 +310,11 @@ No modules.
 | [aws_network_acl_rule.redshift_inbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_network_acl_rule.redshift_outbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_redshift_subnet_group.redshift](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_subnet_group) | resource |
+| [aws_route.database_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.private_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.public_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
---
examples/ipv6-dualstack/main.tf
@@ -33,7 +33,7 @@ module "vpc" {
   public_subnets   = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
   database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]

-  enable_nat_gateway = false
+  enable_nat_gateway = true

   create_database_subnet_route_table     = true
   create_database_internet_gateway_route = true
---
main.tf
@@ -436,6 +436,18 @@ resource "aws_route" "database_nat_gateway" =   }
 }

+resource "aws_route" "database_dns64_nat_gateway" {
+  count = local.create_database_route_table && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? var.single_nat_gateway ? 1 : local.len_database_subnets : 0
+
+  route_table_id              = element(aws_route_table.database[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 resource "aws_route" "database_ipv6_egress" {
   count = local.create_database_route_table && var.create_egress_only_igw && var.enable_ipv6 && var.create_database_internet_gateway_route ? 1 : 0

@@ -1081,6 +1093,18 @@ resource "aws_route" "private_nat_gateway" {
   }
 }

+resource "aws_route" "private_dns64_nat_gateway" {
+  count = local.create_vpc && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? local.nat_gateway_count : 0
+
+  route_table_id              = element(aws_route_table.private[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 ################################################################################
 # Customer Gateways
 ################################################################################
---

---

Choice B:
README.md
@@ -310,9 +310,11 @@ No modules.
 | [aws_network_acl_rule.redshift_inbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_network_acl_rule.redshift_outbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_redshift_subnet_group.redshift](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_subnet_group) | resource |
+| [aws_route.database_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.private_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.public_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
---
examples/ipv6-dualstack/main.tf
@@ -33,7 +33,7 @@ module "vpc" {
   public_subnets   = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
   database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]

-  enable_nat_gateway = false
+  enable_nat_gateway = true

   create_database_subnet_route_table     = true
   create_database_internet_gateway_route = true
---
main.tf
@@ -436,6 +436,18 @@ resource "aws_route" "database_nat_gateway" {
   }
 }

+resource "aws_route" "database_dns64_nat_gateway" {
+  count = local.create_database_route_table && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? var.single_nat_gateway ? 1 : local.len_database_subnets : 0
+
+  route_table_id              = element(aws_route_table.database[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 resource "aws_route" "database_ipv6_egress" {
   count = local.create_database_route_table && var.create_egress_only_igw && var.enable_ipv6 && var.create_database_internet_gateway_route ? 1 : 0

@@ -1081,6 +1093,18 @@ resource "aws_route" "private_nat_gateway" {
   }
 }

+resource "aws_route" "private_dns64_nat_gateway" {
+  count = local.create_vpc && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? local.nat_gateway_count : 0
+
+  route_table_id              = element(aws_route_table.private[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 ################################################################################
 # Customer Gateways
 ################################################################################
---

---

Choice C:
README.md
@@ -310,9 +310,11 @@ No modules.
 | [aws_network_acl_rule.redshift_inbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_network_acl_rule.redshift_outbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_redshift_subnet_group.redshift](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_subnet_group) | resource |
+| [aws_route.database_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.private_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.public_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
---
examples/ipv6-dualstack/main.tf
@@ -33,7 +33,7 : module "vpc" {
   public_subnets   = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
   database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]

-  enable_nat_gateway = false
+  enable_nat_gateway = true

   create_database_subnet_route_table     = true
   create_database_internet_gateway_route = true
---
main.tf
@@ -436,6 +436,18 @@ resource "aws_route" "database_nat_gateway" {
   }
 }

+resource "aws_route" "database_dns64_nat_gateway" {
+  count = local.create_database_route_table && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? var.single_nat_gateway ? 1 : local.len_database_subnets : 0
+
+  route_table_id              = element(aws_route_table.database[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 resource "aws_route" "database_ipv6_egress" {
   count = local.create_database_route_table && var.create_egress_only_igw && var.enable_ipv6 && var.create_database_internet_gateway_route ? 1 : 0

@@ -1081,6 +1093,18 @@ resource "aws_route" "private_nat_gateway" {
   }
 }

+resource "aws_route" "private_dns64_nat_gateway" {
+  count = local.create_vpc && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? local.nat_gateway_count : 0
+
+  route_table_id              = element(aws_route_table.private[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 ################################################################################
 # Customer Gateways
 ################################################################################
---

---

Choice D:
README.md
@@ -310,9 +310,11 @@ No modules.
 | [aws_network_acl_rule.redshift_inbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_network_acl_rule.redshift_outbound](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |
 | [aws_redshift_subnet_group.redshift](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_subnet_group) | resource |
+| [aws_route.database_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.database_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
+| [aws_route.private_dns64_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_ipv6_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.private_nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
 | [aws_route.public_internet_gateway](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
---
examples/ipv6-dualstack/main.tf
@@ -33,7 +33,7 @@ module "vpc" {
   public_subnets   = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
   database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 8)]

-  enable_nat_gateway = false
+  enable_nat_gateway = true

   create_database_subnet_route_table     = true
   create_database_internet_gateway_route = true
---
main.tf
@@ -436,6 +436,18 @@ resource "aws_route" "database_nat_gateway" {
   }
 }

+resource "aws_route" "database_dns64_nat_gateway" {
+  count = local.create_database_route_table && !var.create_database_internet_gateway_route && var.create_database_nat_gateway_route && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? var.single_nat_gateway ? 1 : local.len_database_subnets : 0
+
+  route_table_id              = element(aws_route_table.database[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 resource "aws_route" "database_ipv6_egress" {
   count = local.create_database_route_table && var.create_egress_only_igw && var.enable_ipv6 && var.create_database_internet_gateway_route ? 1 : 0

@@ -1081,6 +1093,18 @@ resource "aws_route" "private_nat_gateway" {
   }
 }

+resource "aws_route" "private_dns64_nat_gateway" {
+  count = local.create_vpc && var.enable_nat_gateway && var.enable_ipv6 && var.private_subnet_enable_dns64 ? local.nat_gateway_count : 0
+
+  route_table_id              = element(aws_route_table.private[*].id, count.index)
+  destination_ipv6_cidr_block = "64:ff9b::/96"
+  nat_gateway_id              = element(aws_nat_gateway.this[*].id, count.index)
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 ################################################################################
 # Customer Gateways
 ################################################################################
---

---