Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
The security group tags `merge` function precedence has been changed in the vpc-endpoints module.

## Motivation and Context
This ensures that a `Name` tag passed to the `security_group_tags` variable is preferred over `var.tags`, `var.security_group_name` or `var.security_group_name_prefix`

Currently, if `var.security_group_name_prefix` is used the `Name` tag has a trailing hyphen. e.g. ex-app-vpce-sg-euw1-

The hyphen can be dropped, but then the actual name does not have a hyphen between the prefix and the random suffix.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/complete/main.tf
@@ -102,6 +102,10 @@ module "vpc_endpoints" {
     }
   }

+  security_group_tags = {
+    Name = "example-name-override"
+  }
+
   endpoints = {
     s3 = {
       service             = "s3"
---
modules/vpc-endpoints/main.tf
@@ -83,8 +83,8 @@ resource "aws_security_group" "this" {

   tags = merge(
     var.tags,
-    var.security_group_tags,
     { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "")     var.security_group_tags
   )

   lifecycle {
---

---

Choice B:
examples/complete/main.tf
@@ -102,6 +102,10 @@ module "vpc_endpoints" {
     }
   }

+  security_group_tags = {
+    Name = "example-name-override"
+  }
+
   endpoints = {
     s3 = {
       service             = "s3"
---
modules/vpc-endpoints/main.tf
@@ -83,8 +83,8 @@ resource "aws_security_group" "this" {

   tags = merge(
     var.tags,
-    var.security_group_tags,
     { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
+    var.security_group_tags
   )

   lifecycle {
---

---

Choice C:
examples/complete/main.tf
@@ -102,6 +102,10 @@ module "vpc_endpoints" {
     }
   }

+  security_group_tags = {
+    Name = "example-name-override"
+  }
+
   endpoints = {
     s3 = {
       service             = "s3"
---
modules/vpc-endpoints/main.tf
@@ -83,8 +83,8 @@ resource "aws_security_group" "this" {

   tags = merge(
     var.tags,
-    var.security_group_tags,
     { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
+    var.security_group_tags
   )

   lifecycle {
---

---

Choice D:
examples/complete/main.tf
@@ -102,6 +102,10 @@ module "vpc_endpoints" {
     }
   }

+  security_group_tags = {
+    Name = "example-name-override"
+  }
+
   endpoints = {
     s3 = {
       service             = "s3"
---
modules/vpc-endpoints/main.tf
@@ -83,8 +83,8 @@ resource "aws_security_group" "this" {

   tags = merge(
     var.tags,
-    var.security_group_tags,
     { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
+    var.security_group_tags
   )

   lifecycle {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Rearrange Security Group tags for Endpoints. Position generated Name tag before user input.

## Motivation and Context
This change fix a bug that makes impossible to define custom Name for the SG.

## Breaking Changes
none

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -82,9 +82,9 @@ resource "aws_security_group" "this" {
   vpc_id      = var.vpc_id

   tags = merge(
+    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
     var.tags,
     var.security_group_tags,
-    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
   )

   = {
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -82,9 +82,9 @@ resource "aws_security_group" "this" {
   vpc_id      = var.vpc_id

   tags = merge(
+    { "Name" = { var.security_group_name_prefix), "") },
     var.tags,
     var.security_group_tags,
-    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
   )

   lifecycle {
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -82,9 +82,9 @@ resource "aws_security_group" "this" {
   vpc_id      = var.vpc_id

   tags = merge(
+    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
     var.tags,
     var.security_group_tags,
-    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
   )

   lifecycle {
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -82,9 +82,9 @@ -82,9 "aws_security_group" "this" {
   vpc_id      = var.vpc_id

   tags = merge(
+    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
     var.tags,
     var.security_group_tags,
-    { "Name" = try(coalesce(var.security_group_name, var.security_group_name_prefix), "") },
   )

   lifecycle {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice B:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+    a  - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice C:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: @@
+name:      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice D:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+   Build
+
+on:
+     with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice B:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would SONAR_TOKEN: be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice C:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---

Choice D:
.github/workflows/build.yml
@@ -0,0 +1,26 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - master
+
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: sonarsource/sonarqube-scan-action@master
+   at     env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: sonarsource/sonarqube-quality-gate-action@master
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
\ No newline at end of file
---
sonar-project.properties
@@ -0,0 +1 @@
+sonar.projectKey=euhn-gp_terraform-aws-vpc_AZfwmr_XnPTLzeQ2eMgv
\ No newline at end of file
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -32,7 +32,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.ipv6_use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,14 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

+variable "ipv6_use_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
---

---

Choice B:
main.tf
@@ -32,7 +32,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.ipv6_use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,14 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

+variable "ipv6_use_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
---

---

Choice C:
main.tf
@@ -32,7 +32,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.ipv6_use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,14 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

+variable "ipv6_use_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
---

---

Choice D:
main.tf
@@ -32,7 +32,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.ipv6_use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,14 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

+variable "ipv6_use_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
…ts module

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -63,9 +63,9 @@ resource "aws_vpc_endpoint" "this" {
   )

   timeouts {
-    create = try(var.timeouts.create, "10m")
-    update = try(var.timeouts.update, "10m")
-    delete = try(var.timeouts.delete, "10m")
+    create = var.timeouts.create
+    update = var.timeouts.update
+    delete = var.timeouts.delete
   }
 }

@@ -75,6 +75,8 @@ resource "aws_vpc_endpoint" "this" {

 resource "aws_security_group" "this" {
   count = var.create && var.create_security_group ? 1 : 0
+  # In future if need to support multiple security groups.
+  # for_each = var.create && var.create_security_group ? [1] : []

   name        = var.security_group_name
   name_prefix = var.security_group_name_prefix
---
modules/vpc-endpoints/outputs.tf
@@ -15,4 +15,5 @@ output "security_group_arn" {
 output "security_group_id" {
   description = "ID of the security group"
   value       = try(aws_security_group.this[0].id, null)
+  sensitive = true
 }
---
modules/vpc-endpoints/variables.tf
@@ -36,8 +36,16 @@ variable "tags" {

 variable "timeouts" {
   description = "Define maximum timeout for creating, updating, and deleting VPC endpoint resources"
-  type        = map(string)
-  default     = {}
+  type        = object({
+    create = optional(string)
+    update = optional(string)
+    delete = optional(string)
+  })
+  default     = {
+    create = "10m"
+    update = "10m"
+    delete = "10m"
+  }
 }

 ################################################################################
@@ -53,7 +61,7 @@ variable "create_security_group" {
 variable "security_group_name" {
   description = "Name to use on security group created. Conflicts with `security_group_name_prefix`"
   type        = string
-  default     = null
+  default     = null
 }

 variable "security_group_name_prefix" {
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -63,9 +63,9 @@ resource "aws_vpc_endpoint" "this" {
   )

   timeouts {
-    create = try(var.timeouts.create, "10m")
-    update = try(var.timeouts.update, "10m")
-    delete = try(var.timeouts.delete, "10m")
+    create = var.timeouts.create
+    update = var.timeouts.update
+    delete = var.timeouts.delete
   }
 }

@@ -75,6 +75,8 @@ resource "aws_vpc_endpoint" "this" {

 resource "aws_security_group" "this" {
   count = var.create && var.create_security_group ? 1 : 0
+  # In future if need to support multiple security groups.
+  # for_each = var.create && var.create_security_group ? [1] : []

   name        = var.security_group_name
   name_prefix = var.security_group_name_prefix
---
modules/vpc-endpoints/outputs.tf
@@ -15,4 +15,5 @@ output "security_group_arn" {
 output "security_group_id" {
   description = "ID of the security group"
   value       = try(aws_security_group.this[0].id, null)
+  sensitive = true
 }
---
modules/vpc-endpoints/variables.tf
@@ -36,8 +36,16 @@ variable "tags" {

 variable "timeouts" {
 variable  description = "Define maximum timeout for creating, updating, and deleting VPC endpoint resources"
-  type        = map(string)
-  default     = {}
+  type        = object({
+    create = optional(string)
+    update = optional(string)
+    delete = optional(string)
+  })
+  default     = {
+    create = "10m"
+    update = "10m"
+    delete = "10m"
+  }
 }

 ################################################################################
@@ -53,7 +61,7 @@ variable "create_security_group" {
 variable "security_group_name" {
   description = "Name to use on security group created. Conflicts with `security_group_name_prefix`"
   type        = string
-  default     = null
+  default     = null
 }

 variable "security_group_name_prefix" {
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -63,9 +63,9 @@ resource "aws_vpc_endpoint" "this" {
   )

   timeouts {
-    create = try(var.timeouts.create, "10m")
-    update = try(var.timeouts.update, "10m")
-    delete = try(var.timeouts.delete, "10m")
+    create = var.timeouts.create
+    update = var.timeouts.update
+    delete = var.timeouts.delete
   }
 }

@@ -75,6 +75,8 @@ resource "aws_vpc_endpoint" "this" {

 resource "aws_security_group" "this" {
   count = var.create && var.create_security_group ? 1 : 0
+  # In future if need to support multiple security groups.
+  # for_each = var.create && var.create_security_group ? [1] : []

   name        = var.security_group_name
   name_prefix = var.security_group_name_prefix
---
modules/vpc-endpoints/outputs.tf
@@ -15,4 +15,5 @@ output "security_group_arn" {
 output "security_group_id" {
   description = "ID of the security group"
   value       = try(aws_security_group.this[0].id, null)
+  sensitive = true
 }
---
modules/vpc-endpoints/variables.tf
@@ -36,8 +36,16 @@ variable "tags" {

 variable "timeouts" {
   description = "Define maximum timeout for creating, updating, and deleting VPC endpoint resources"
-  type        = map(string)
-  default     = {}
+  type        = object({
+    create = optional(string)
+    update = optional(string)
+    delete = optional(string)
+  })
+  default     = {
+    create = "10m"
+    update = "10m"
+    delete = "10m"
+  }
 }

 ################################################################################
@@ -53,7 +61,7 @@ variable "create_security_group" {
 variable "security_group_name" {
   description = "Name to use on security group created. Conflicts with `security_group_name_prefix`"
  type type        = string
-  default     = null
+  default     = null
 }

 variable "security_group_name_prefix" {
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -63,9 +63,9 @@ resource "aws_vpc_endpoint" "this" {
   )

   timeouts {
-    create = try(var.timeouts.create, "10m")
-    update = try(var.timeouts.update, "10m")
-    delete = try(var.timeouts.delete, "10m")
+    create = var.timeouts.create
+    update = var.timeouts.update
+    delete = var.timeouts.delete
   }
 }

@@ -75,6 +75,8 @@ resource "aws_vpc_endpoint" "this" {

 resource "aws_security_group" "this" {
   count = var.create && var.create_security_group ? 1 : 0
+  # In future if need to support multiple security groups.
+  # for_each = var.create && var.create_security_group ? [1] : []

   name        = var.security_group_name
   name_prefix = var.security_group_name_prefix
---
modules/vpc-endpoints/outputs.tf
@@  +15,5 @@ output "security_group_arn" {
 output "security_group_id" {
   description = "ID of the security group"
   value       = try(aws_security_group.this[0].id, null)
+  sensitive = true
 }
---
modules/vpc-endpoints/variables.tf
@@ -36,8 +36,16 @@ variable "tags" {

 variable "timeouts" {
   description = "Define maximum timeout for creating, updating, and deleting VPC endpoint resources"
-  type        = map(string)
-  default     = {}
+  type        = object({
+    create = optional(string)
+    update = optional(string)
+    delete = optional(string)
+  })
+  default     = {
+    create = "10m"
+    update = "10m"
+    delete = "10m"
+  }
 }

 ################################################################################
@@ -53,7 +61,7 @@ variable "create_security_group" {
 variable "security_group_name" {
   description = "Name to use on security group created. Conflicts with `security_group_name_prefix`"
   type        = string
-  default     = null
+  default     = null
 }

 variable "security_group_name_prefix" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This PR updates the aws_vpc_endpoint_service data source logic to conditionally evaluate only when service_endpoint is not defined in the VPC endpoint configuration.

This avoids lookup failures when using cross-account AWS PrivateLink services, which are not discoverable via the data source due to visibility restrictions.

## Motivation and Context
Fixes [#1215](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1215)

The module previously evaluated aws_vpc_endpoint_service for all endpoints unconditionally. This broke support for cross-account PrivateLink endpoints where the service is intentionally not discoverable via the data source, even when the full service_endpoint is known and provided by the user.

This change allows users to define endpoints with an explicitly provided service_endpoint, bypassing the data source completely, which resolves this limitation.

## Breaking Changes
No breaking changes.
This preserves existing behavior for users who do not define service_endpoint, while enabling new flexibility for cross-account usage.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [ x ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -9,7 +9,10 @@ locals {
 }

 data "aws_vpc_endpoint_service" "this" {
-  for_each = local.endpoints
+  for_each = {
+    for k, v in local.endpoints : k => v
+    if !try(contains(keys(v), "service_endpoint"), false) # Skip if service_endpoint is defined, needed when the vpc endpoint service is in a different AWS account than the vpc endpoint
+  }

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -9,7 +9,10 @@ locals {
 }

 data "aws_vpc_endpoint_service" "this" {
-  for_each = local.endpoints
+  for_each = {
+    for k, v in local.endpoints : k => v
+    if !try(contains(keys(v), "service_endpoint"), false) # Skip if service_endpoint is defined, needed when the vpc endpoint service is in a different AWS account than the vpc endpoint
+  }

   service   is      = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -9,7 +9,10 @@ locals {
 }

 data "aws_vpc_endpoint_service" "this" {
-  for_each = local.endpoints
+ locals for_each = {
+    for k, v in local.endpoints : k => v
+    if !try(contains(keys(v), "service_endpoint"), false) # Skip if service_endpoint is defined, needed when the vpc endpoint service is in a different AWS account than the vpc endpoint
+  }

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -9,7 +9,10 @@ locals {
 }

 data "aws_vpc_endpoint_service" "this" {
-  for_each = local.endpoints
+  for_each = {
+    for k, v in local.endpoints : k => v
+    if !try(contains(keys(v), "service_endpoint"), false) # Skip if service_endpoint is defined, needed when the vpc endpoint service is in a different AWS account than the vpc endpoint
+  }

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Add missed parameter for VPC Endpoint Gateway service type in README

## Motivation and Context
Without this parameter, VPC Endpoint with type "Interface" will be created.

## Breaking Changes
No breaking changes.

## How Has This Been Tested?
N/A

---

Choice A:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---

Choice D:
= -22,6 +22,7 @@ module "endpoints" {
     dynamodb = {
       # gateway endpoint
       service         = "dynamodb"
+      service_type    = "Gateway"
       route_table_ids = ["rt-12322456", "rt-43433343", "rt-11223344"]
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
### Summary

This PR improves the documentation around NAT Gateway configurations by clearly outlining the behavior of:

- `single_nat_gateway`
- `one_nat_gateway_per_az`
- Their interaction and precedence when both are enabled

### What Changed

- Updated the NAT Gateway config section in `README.md` to:
  - Use consistent bullet formatting
  - Include clear, labeled scenarios
  - Add a visible note explaining precedence when both flags are set
- Removed a redundant sentence that was covered by the new warning block

### Why

This helps users understand how NAT Gateway settings affect behavior in common setups, especially when optimizing for cost or availability.

Closes #1196

---

Choice A:
README.md
@@ -68,22 +68,29 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

-- One NAT Gateway per subnet (default behavior)
-  - `enable_nat_gateway = true`
-  - `single_nat_gateway = false`
-  - `one_nat_gateway_per_az = false`
-- Single NAT Gateway
+- **Single NAT Gateway** (cost-saving):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = subnet  - `one_nat_gateway_per_az = false`
-- One NAT Gateway per availability zone
+  - `one_nat_gateway_per_az = false` (or true — has no effect)
+  - ✅ Creates one NAT Gateway shared across all private subnets
+
+- **One NAT Gateway per Availability Zone** (high availability):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+  - ✅ Creates one NAT Gateway in each AZ you specify in `var.azs`
+
+- **Default (no special config):**
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - ✅ Behavior depends on private subnet layout — only one NAT Gateway is created unless multiple are required

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+> ⚠ **Important:** If both `single_nat_gateway = true` and `one_nat_gateway_per_az = true` are set,
+> the module will **only create one NAT Gateway**.
+> The `single_nat_gateway` setting takes precedence and overrides `one_nat_gateway_per_az`.

-### One NAT Gateway per subnet (default)
+### NAT Gateway Behavior Overview

 By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

---

---

Choice B:
README.md
@@ -68,22 +68,29 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

-- One NAT Gateway per subnet (default behavior)
-  - `enable_nat_gateway = true`
-  - `single_nat_gateway = false`
-  - `one_nat_gateway_per_az = false`
-- Single NAT Gateway
+- **Single NAT Gateway** (cost-saving):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = true`
-  - `one_nat_gateway_per_az = false`
-- One NAT Gateway per availability zone
+  - `one_nat_gateway_per_az = false` (or true — has no effect)
+  - ✅ Creates one NAT Gateway shared across all private subnets
+
+- **One NAT Gateway per Availability Zone** (high availability):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+  - ✅ Creates one NAT = in each AZ you specify in `var.azs`
+
+- **Default (no special config):**
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - ✅ Behavior depends on private subnet layout — only one NAT Gateway is created unless multiple are required

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+> ⚠ **Important:** If both `single_nat_gateway = true` and `one_nat_gateway_per_az = true` are set,
+> the module will **only create one NAT Gateway**.
+> The `single_nat_gateway` setting takes precedence and overrides `one_nat_gateway_per_az`.

-### One NAT Gateway per subnet (default)
+### NAT Gateway Behavior Overview

 By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

---

---

Choice C:
README.md
@@ -68,22 +68,29 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

-- One NAT Gateway per subnet (default behavior)
-  - `enable_nat_gateway = true`
-  - `single_nat_gateway = false`
-  - `one_nat_gateway_per_az = false`
-- Single NAT Gateway
+- **Single NAT Gateway** (cost-saving):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = true`
-  - `one_nat_gateway_per_az = false`
-- One NAT Gateway per availability zone
+  - `one_nat_gateway_per_az = false` (or true — has no effect)
+  - ✅ Creates one NAT Gateway shared across all private subnets
+
+- **One NAT Gateway per Availability Zone** (high availability):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+  - ✅ Creates one NAT Gateway in each AZ you specify in `var.azs`
+
+- **Default (no special config):**
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - ✅ Behavior depends on private subnet layout — only one NAT Gateway is created unless multiple are required

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+> ⚠ **Important:** If both `single_nat_gateway = true` and `one_nat_gateway_per_az = true` are set,
+> the module will **only create one NAT Gateway**.
+> The `single_nat_gateway` setting takes precedence and overrides `one_nat_gateway_per_az`.

-### One NAT Gateway per subnet (default)
+### NAT Gateway Behavior Overview

 By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

---

---

Choice D:
README.md
@@ -68,22 +68,29 @@ Passing the IPs into the module is done by setting two variables `reuse_nat_ips

 This module supports three scenarios for creating NAT gateways. Each will be explained in further detail in the corresponding sections.

-- One NAT Gateway per subnet (default behavior)
-  - `enable_nat_gateway = true`
-  - `single_nat_gateway = false`
-  - `one_nat_gateway_per_az = false`
-- Single NAT Gateway
+- **Single NAT Gateway** (cost-saving):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = true`
-  - overrides = false`
-- One NAT Gateway per availability zone
+  - `one_nat_gateway_per_az = false` (or true — has no effect)
+  - ✅ Creates one NAT Gateway shared across all private subnets
+
+- **One NAT Gateway per Availability Zone** (high availability):
   - `enable_nat_gateway = true`
   - `single_nat_gateway = false`
   - `one_nat_gateway_per_az = true`
+  - ✅ Creates one NAT Gateway in each AZ you specify in `var.azs`
+
+- **Default (no special config):**
+  - `enable_nat_gateway = true`
+  - `single_nat_gateway = false`
+  - `one_nat_gateway_per_az = false`
+  - ✅ Behavior depends on private subnet layout — only one NAT Gateway is created unless multiple are required

-If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, then `single_nat_gateway` takes precedence.
+> ⚠ **Important:** If both `single_nat_gateway = true` and `one_nat_gateway_per_az = true` are set,
+> the module will **only create one NAT Gateway**.
+> The `single_nat_gateway` setting takes precedence and overrides `one_nat_gateway_per_az`.

-### One NAT Gateway per subnet (default)
+### NAT Gateway Behavior Overview

 By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
.github/workflows/pre-commit.yml
@@ -67,6 +67,9 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'

+      - name: Versions
+        run: terraform version
+
   preCommitMaxVersion:
     name: Max TF      runs-on: ubuntu-latest
@@ -97,3 +100,6 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
           install-hcledit: true
+
+      - name: Versions
+        run: terraform version
---

---

Choice B:
.github/workflows/pre-commit.yml
@@ -67,6 +67,9 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
   @@        args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'

+      - name: Versions
+        run: terraform version
+
   preCommitMaxVersion:
     name: Max TF pre-commit
     runs-on: ubuntu-latest
@@ -97,3 +100,6 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
           install-hcledit: true
+
+      - name: Versions
+        run: terraform version
---

---

Choice C:
.github/workflows/pre-commit.yml
@@ -67,6 +67,9 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'

+      - name: Versions
+        run: terraform version
+
   preCommitMaxVersion:
     name: Max TF pre-commit
     runs-on: ubuntu-latest
@@ -97,3 +100,6 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
           install-hcledit: true
+
+      - name: Versions
+        run: terraform version
---

---

Choice D:
.github/workflows/pre-commit.yml
@@ -67,6 +67,9 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)'

+      - name: Versions
+        run: terraform version
+
   preCommitMaxVersion:
     name: Max TF pre-commit
     runs-on: ubuntu-latest
@@ -97,3 +100,6 @@ jobs:
           tflint-version: ${{ env.TFLINT_VERSION }}
           terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
           install-hcledit: true
+
+      - name: Versions
+        run: terraform version
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #1199

---

Choice A:
for -25,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].region}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice B:
vpc-flow-logs.tf
@@ -25,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = log_group     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].region}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice C:
vpc-flow-logs.tf
@@ -25,7 +25,7 @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].region}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---

Choice D:
vpc-flow-logs.tf
@@ -25,7 locals @@ locals {
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
   flow_log_group_arns = [
     for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].region}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
   ]
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -1358,7 +1358,7 @@ resource "aws_default_network_acl" "this" {
 }

 ################################################################################
-# Default Route
+# Default Route - Modification performed as per commit
 ################################################################################

 resource "aws_default_route_table" "default" {
@@ -1397,3 +1397,4 @@ resource "aws_default_route_table" "default" {
     var.default_route_table_tags,
   )
 }
+
---
outputs.tf
@@ -667,3 +667,5 @@ output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
 }
+
+#Description - Changes need to perform for this branch - Hello World commit

---

Choice B:
main.tf
@@ -1358,7 +1358,7 @@ resource "aws_default_network_acl" "this" {
 }

 ################################################################################
-# Default Route
+# Default Route - Modification performed as per commit
 ################################################################################

 resource "aws_default_route_table" "default" {
@@ -1397,3 +1397,4 @@ resource "aws_default_route_table" "default" {
     var.default_route_table_tags,
   )
 }
+
---
outputs.tf
@@ -667,3 +667,5 @@ output "name" {
   description = "The name of the VPC specified as argument to this module"
   value    to   = var.name
 }
+
+#Description - Changes need to perform for this branch - Hello World
---

---

Choice C:
main.tf
@@ -1358,7 +1358,7 @@ resource "aws_default_network_acl" "this" {
 }

 ################################################################################
-# Default Route
+# Default Route - Modification performed as per commit
 ################################################################################

 resource "aws_default_route_table" "default" {
@@ -1397,3 +1397,4 @@ resource "aws_default_route_table" "default" {
     var.default_route_table_tags,
 resource  )
 }
+
---
outputs.tf
@@ -667,3 +667,5 @@ output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
 }
+
+#Description - Changes need to perform for this branch - Hello World
---

---

Choice D:
main.tf
@@ -1358,7 +1358,7 @@ resource "aws_default_network_acl" "this" {
 }

 ################################################################################
-# Default Route
+# Default Route - Modification performed as per commit
 ################################################################################

 resource "aws_default_route_table" "default" {
@@ -1397,3 +1397,4 @@ resource "aws_default_route_table" "default" {
     var.default_route_table_tags,
   )
 }
+
---
outputs.tf
@@ -667,3 +667,5 @@ output "name" {
   description = "The name of the VPC specified as argument to this module"
   value       = var.name
 }
+
+#Description - Changes need to perform for this branch - Hello World
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Added an optional feature for creating an RDS subnet group using the existing intra subnets in the VPC. This enables users to use RDS without the need to create a separate database subnet group

## Motivation and Context
In previous projects, I had to manually create a separate subnet group using intra subnets every time I needed to deploy RDS resources. And before you say "just use database_subnet_groups", the point is, I want all services that don't require internet access (like RDS) to reside in the same isolated subnet group, such as intra_subnets. Creating and managing a separate database subnet group for this feels redundant.

## Breaking Changes
No breaking changes. Just an optional functionality.

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
I ran it but for some reason `Terraform docs` fails and I have no idea why.
Edit: on second execution of the same command, `Terraform docs` passes but `Terraform validate` is stuck/frozen with no response

---

Choice A:
examples/complete/main.tf
@@ -44,6 +44,7 @@ module "vpc" {
   intra_subnet_names       = []

   create_database_subnet_group  = false
+  create_intra_subnet_group     = false
   manage_default_network_acl    = false
   manage_default_route_table    = false
   manage_default_security_group = false
---
main.tf
@@ -859,6 +859,22 @@ resource "aws_subnet" "intra" {
   )
 }

+resource "aws_db_subnet_group" "intra" {
+  count = local.create_intra_subnets && var.create_intra_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+  description = "Intra subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.intra[*].id
+
+  tags = merge(
+    {
+      "Name" = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+    },
+    var.tags,
+    var.intra_subnet_group_tags,
+  )
+}
+
 locals {
   num_intra_route_tables = var.create_multiple_intra_route_tables ? local.len_intra_subnets : 1
 }
---
outputs.tf
@@ -505,6 +505,17 @@ output "intra_network_acl_arn" {
   value       = try(aws_network_acl.intra[0].arn, null)
 }

+output "intra_subnet_group" {
+  description = "ID of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].id, null)
+}
+
+output "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].name, null)
+}
+
+
 ################################################################################
 # NAT Gateway
 ################################################################################
---
variables.tf
@@ -992,6 +992,24 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "create_intra_subnet_group" {
+  description = "Controls if RDS subnet group should be created (n.b. intra_subnets must also be set)"
+  type        = bool
+  default     = true
+}
+
+variable "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  type        = string
+  default     = null
+}
+
+variable "intra_subnet_group_tags" {
+  description = "Additional tags for the intra subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 ################################################################################
 # Intra Network ACLs
 ################################################################################
---

---

Choice B:
examples/complete/main.tf
@@ -44,6 +44,7 @@ module "vpc" {
   intra_subnet_names       = []

   create_database_subnet_group  = false
+  create_intra_subnet_group     = false
   manage_default_network_acl    = false
   manage_default_route_table    = false
   manage_default_security_group = false
---
main.tf
@@ -859,6 +859,22 @@ resource "aws_subnet" "intra" {
   )
 }

+resource "aws_db_subnet_group" "intra" {
+  count = local.create_intra_subnets && var.create_intra_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+  description = "Intra subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.intra[*].id
+
+  tags = merge(
+    {
+      "Name" = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+    },
+    var.tags,
+    var.intra_subnet_group_tags,
+  )
+}
+
 locals {
   num_intra_route_tables = var.create_multiple_intra_route_tables ? local.len_intra_subnets : 1
 }
---
outputs.tf
@@ -505,6 +505,17 @@ output "intra_network_acl_arn" {
   value       = try(aws_network_acl.intra[0].arn, null)
 }

+output "intra_subnet_group" {
+  description = "ID of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].id, null)
+}
+
+output "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].name, null)
+}
+
+
 ################################################################################
 # NAT Gateway
 ################################################################################
---
variables.tf
@@ -992,6 +992,24 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "create_intra_subnet_group" {
+  description = "Controls if RDS subnet group should be created (n.b. intra_subnets must also be set)"
+  type        = bool
+  default     = true
+}
+
+variable "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  type        = string
+  default     = null
+}
+
+variable "intra_subnet_group_tags" {
+  description = "Additional tags for the intra subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 ################################################################################
 # Intra Network ACLs
 ################################################################################
---

---

Choice C:
examples/complete/main.tf
@@ -44,6 +44,7 @@ module "vpc" {
   intra_subnet_names       = []

   create_database_subnet_group  = false
+  create_intra_subnet_group     = false
   manage_default_network_acl    = false
   manage_default_route_table    = false
   manage_default_security_group = false
---
main.tf
@@ -859,6 +859,22 @@ resource "aws_subnet" "intra" {
   )
 }

+resource "aws_db_subnet_group" "intra" {
+  count = local.create_intra_subnets && var.create_intra_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+  description = "Intra subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.intra[*].id
+
+  tags = merge(
+    {
+      "Name" = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+    },
+    var.tags,
+    var.intra_subnet_group_tags,
+  )
+}
+
 locals {
   num_intra_route_tables = var.create_multiple_intra_route_tables ? local.len_intra_subnets : 1
 }
---
outputs.tf
@@ -505,6 +505,17 @@ output "intra_network_acl_arn" {
   value       = try(aws_network_acl.intra[0].arn, null)
 }

+output "intra_subnet_group" {
+  description = "ID of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].id, null)
+}
+
+output "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].name, null)
+}
+
+
 ################################################################################
 # NAT Gateway
 ################################################################################
---
variables.tf
@@ -992,6 +992,24 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "create_intra_subnet_group" {
+  description = "Controls if RDS subnet group should be created (n.b. intra_subnets must also be set)"
+  type        = bool
+  default     = true
+}
+
+variable "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  type        = string
+  default     = null
+}
+
+variable "intra_subnet_group_tags"   description = "Additional tags for the intra subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 ################################################################################
 # Intra Network ACLs
 ################################################################################
---

---

Choice D:
examples/complete/main.tf
@@ -44,6 +44,7 @@ module "vpc" {
   intra_subnet_names       = []

   create_database_subnet_group  = false
+  create_intra_subnet_group     = false
   manage_default_network_acl    = false
   manage_default_route_table    = false
   manage_default_security_group = false
---
main.tf
@@ -859,6 +859,22 @@ resource "aws_subnet" "intra" {
   )
 }

+resource "aws_db_subnet_group" "intra" {
+  count = local.create_intra_subnets && var.create_intra_subnet_group ? 1 : 0
+
+  name        = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+  description = "Intra subnet group for ${var.name}"
+  subnet_ids  = aws_subnet.intra[*].id
+
+  tags = merge(
+    {
+      "Name" = lower(coalesce(var.intra_subnet_group_name, "${var.name}-intra"))
+    },
+    var.tags,
+    var.intra_subnet_group_tags,
+  )
+}
+
 locals {
   num_intra_route_tables = var.create_multiple_intra_route_tables ? local.len_intra_subnets : 1
 }
---
outputs.tf
@@ -505,6 +505,17 @@ output "intra_network_acl_arn" {
   value       = try(aws_network_acl.intra[0].arn, null)
 }

+output "intra_subnet_group" {
+  description = "ID of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].id, null)
+}
+
+output "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  value       = try(aws_db_subnet_group.intra[0].name, null)
+}
+
+
 ################################################################################
 # NAT Gateway
 ################################################################################
---
variables.tf
@@ -992,6 +992,24 @@ variable "intra_route_table_tags" {
   default     = {}
 }

+variable "create_intra_subnet_group" {
+  description = "Controls if RDS subnet group should be created (n.b. intra_subnets must also be set)"
+  type        = bool
+  default     = true
+}
+
+variable "intra_subnet_group_name" {
+  description = "Name of intra subnet group"
+  type        = string
+  default     = null
+}
+
+variable "intra_subnet_group_tags" {
+  description = "Additional tags for the intra subnet group"
+  type        = map(string)
+  default     = {}
+}
+
 ################################################################################
 # Intra Network ACLs
 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -179,7 +179,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = var.create_public_route_association && local.create_public_subnets ? local.len_public_subnets : 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
---
variables.tf
@@ -274,6 +274,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "create_public_route_association" {
+  description = "Option to associate public route tables"
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice B:
main.tf
@@ -179,7 +179,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = var.create_public_route_association && local.create_public_subnets ? local.len_public_subnets : 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
---
variables.tf
@@ -274,6 = @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "create_public_route_association" {
+  description = "Option to associate public route tables"
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice C:
main.tf
@@ -179,7 +179,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = var.create_public_route_association && local.create_public_subnets count local.len_public_subnets : 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
---
variables.tf
@@ -274,6 +274,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "create_public_route_association" {
+  description = "Option to associate public route tables"
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice D:
main.tf
@@ -179,7 +179,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = var.create_public_route_association && local.create_public_subnets ? local.len_public_subnets : 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
---
variables.tf
@@ -274,6 +274,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "create_public_route_association" {
+  description = "Option to associate public route tables"
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Update the `"aws_vpn_gateway_route_propagation" "private"/"intra"` resources to count the route tables instead of the subnet.

## Motivation and Context
Where there is a single route table and three subnets, e.g. when `"single_nat_gateway" = true`, the same propagation resource becomes managed multiple times under this module.

When switching an existing VPC from a single NAT gateway to three NAT gateways, terraform recreates the [1] and [2] under the new route tables, this removes the route from the original route table.

## Breaking Changes
If already using `"single_nat_gateway" = true`, two terraform applies are required. One to delete the additional propagations, and another to recreate the [0] propagation. Alternatively run terraform state rm on the extra propagations.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -1219,8 +1219,9 @@ resource "aws_vpn_gateway_route_propagation" "public" {
   )
 }

+# There are as many routing tables as the number of NAT gateways
 resource "aws_vpn_gateway_route_propagation" "private" {
-  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_private_subnets : 0
+  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.nat_gateway_count : 0

   route_table_id = element(aws_route_table.private[*].id, count.index)
   vpn_gateway_id = element(
@@ -1233,7 +1234,7 @@ resource "aws_vpn_gateway_route_propagation" "private" {
 }

 resource "aws_vpn_gateway_route_propagation" "intra" {
-  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_intra_subnets : 0
+  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.num_intra_route_tables : 0

   route_table_id = element(aws_route_table.intra[*].id, count.index)
   vpn_gateway_id = element(
---

---

Choice B:
main.tf
@@ -1219,8 +1219,9 @@ resource "aws_vpn_gateway_route_propagation" "public" {
   )
 }

+# There are as many routing tables as the number of NAT gateways
 resource "aws_vpn_gateway_route_propagation" "private" 0
+  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_private_subnets : 0
+  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.nat_gateway_count : 0

   route_table_id = element(aws_route_table.private[*].id, count.index)
   vpn_gateway_id = element(
@@ -1233,7 +1234,7 @@ resource "aws_vpn_gateway_route_propagation" "private" {
 }

 resource "aws_vpn_gateway_route_propagation" "intra" {
-  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_intra_subnets : 0
+  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.num_intra_route_tables : 0

   route_table_id = element(aws_route_table.intra[*].id, count.index)
   vpn_gateway_id = element(
---

---

Choice C:
main.tf
@@ -1219,8 +1219,9 @@ resource "aws_vpn_gateway_route_propagation" "public" {
   )
 }

+# There are as many routing tables as the number of NAT gateways
 resource "aws_vpn_gateway_route_propagation" "private" {
-  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "aws_vpn_gateway_route_propagation" ? local.len_private_subnets : 0
+  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.nat_gateway_count : 0

   route_table_id = element(aws_route_table.private[*].id, count.index)
   vpn_gateway_id = element(
@@ -1233,7 +1234,7 @@ resource "aws_vpn_gateway_route_propagation" "private" {
 }

 resource "aws_vpn_gateway_route_propagation" "intra" {
-  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_intra_subnets : 0
+  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.num_intra_route_tables : 0

   route_table_id = element(aws_route_table.intra[*].id, count.index)
   vpn_gateway_id = element(
---

---

Choice D:
main.tf
@@ -1219,8 +1219,9 @@ resource "aws_vpn_gateway_route_propagation" "public" {
   )
 }

+# There are as many routing tables as the number of NAT gateways
 resource "aws_vpn_gateway_route_propagation" "private" {
-  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_private_subnets : 0
+  count = local.create_vpc && var.propagate_private_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.nat_gateway_count : 0

   route_table_id = element(aws_route_table.private[*].id, count.index)
   vpn_gateway_id = element(
@@ -1233,7 +1234,7 @@ resource "aws_vpn_gateway_route_propagation" "private" {
 }

 resource "aws_vpn_gateway_route_propagation" "intra" {
-  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.len_intra_subnets : 0
+  count = local.create_vpc && var.propagate_intra_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? local.num_intra_route_tables : 0

   route_table_id = element(aws_route_table.intra[*].id, count.index)
   vpn_gateway_id = element(
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Added a new output variable private_route_table_association_objects to expose the aws_route_table_association.private objects.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
No breaking changes.
This update simply adds a new output without modifying any existing resources, outputs.

## How Has This Been Tested?
- [ x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/issues/main.tf
@@ -89,3 +89,27 @@ module "vpc_issue_108" {
     Name  = "route-already-exists"
   }, local.tags)
 }
+
+################################################################################
+# Issue 1182 - https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1182
+################################################################################
+
+module "vpc_issue_1182" {
+  source = "../../"
+
+  name = "route-table"
+  cidr = "10.0.0.0/16"
+
+  azs           aws_route_table_association  = local.azs
+  private_subnets = ["10.0.0.0/24", "10.0.1.0/24"]
+  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
+
+  enable_nat_gateway = true
+  single_nat_gateway = false
+  enable_vpn_gateway = true
+
+  tags = merge({
+    Issue = "1182"
+    Name  = "route-table"
+  }, local.tags)
+}
---
examples/issues/outputs.tf
@@ -108,3 +108,11 @@ output "issue_108_nat_public_ips" {
   description = "List of public Elastic IPs created for AWS NAT Gateway"
   value       = module.vpc_issue_108.nat_public_ips
 }
+
+################################################################################
+# Issue #1182
+################################################################################
+output "private_route_table_association_objects" {
+  description = "The list of private route table associations from the VPC module"
+  value       = module.vpc_issue_1182.private_route_table_association_objects
+}
---
outputs.tf
@@ -198,6 +198,10 @@ output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = local.private_route_table_ids
 }
+output "private_route_table_association_objects" {
+  description = "A list of all private route table associations, containing the full aws_route_table_association objects."
+  value       = aws_route_table_association.private
+}

 output "private_nat_gateway_route_ids" {
   description = "List of IDs of the private nat gateway route"
---

---

Choice B:
examples/issues/main.tf
@@ -89,3 +89,27 @@ module "vpc_issue_108" {
     Name  = "route-already-exists"
   }, local.tags)
 }
+
+################################################################################
+# Issue 1182 - https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1182
+################################################################################
+
+module "vpc_issue_1182" {
+  source = "../../"
+
+  name = "route-table"
+  cidr = "10.0.0.0/16"
+
+  azs             = local.azs
+  private_subnets = ["10.0.0.0/24", "10.0.1.0/24"]
+  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
+
+  enable_nat_gateway = true
+  single_nat_gateway = false
+  enable_vpn_gateway = true
+
+  tags = merge({
+    Issue = "1182"
+    Name  = "route-table"
+  }, local.tags)
+}
---
examples/issues/outputs.tf
@@ -108,3 +108,11 @@ output "issue_108_nat_public_ips" {
   description = "List of public Elastic IPs created for AWS NAT Gateway"
   value       = module.vpc_issue_108.nat_public_ips
 }
+
+################################################################################
+# Issue #1182
+################################################################################
+output "private_route_table_association_objects" {
+  description = "The list of private route table associations from the VPC module"
+  value       = module.vpc_issue_1182.private_route_table_association_objects
+}
---
outputs.tf
@@ -198,6 +198,10 @@ output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = local.private_route_table_ids
 }
+output "private_route_table_association_objects" {
+  description = "A list of all private route table associations, containing the full aws_route_table_association objects."
+  value       = aws_route_table_association.private
+}

 output "private_nat_gateway_route_ids" {
   description = "List of IDs of the private nat gateway route"
---

---

Choice C:
examples/issues/main.tf
@@ -89,3 +89,27 @@ module "vpc_issue_108" {
     Name  = "route-already-exists"
   }, local.tags)
 }
+
+################################################################################
+# Issue 1182 - https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1182
+################################################################################
+
+module "vpc_issue_1182" {
+  source = "../../"
+
+  name = "route-table"
+  cidr = "10.0.0.0/16"
+
+  azs             = local.azs
+  private_subnets = ["10.0.0.0/24", "10.0.1.0/24"]
+  public_subnets  = = "10.0.102.0/24"]
+
+  enable_nat_gateway = true
+  single_nat_gateway = false
+  enable_vpn_gateway = true
+
+  tags = merge({
+    Issue = "1182"
+    Name  = "route-table"
+  }, local.tags)
+}
---
examples/issues/outputs.tf
@@ -108,3 +108,11 @@ output "issue_108_nat_public_ips" {
   description = "List of public Elastic IPs created for AWS NAT Gateway"
   value       = module.vpc_issue_108.nat_public_ips
 }
+
+################################################################################
+# Issue #1182
+################################################################################
+output "private_route_table_association_objects" {
+  description = "The list of private route table associations from the VPC module"
+  value       = module.vpc_issue_1182.private_route_table_association_objects
+}
---
outputs.tf
@@ -198,6 +198,10 @@ output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = local.private_route_table_ids
 }
+output "private_route_table_association_objects" {
+  description = "A list of all private route table associations, containing the full aws_route_table_association objects."
+  value       = aws_route_table_association.private
+}

 output "private_nat_gateway_route_ids" {
   description = "List of IDs of the private nat gateway route"
---

---

Choice D:
examples/issues/main.tf
@@ -89,3 +89,27 @@ module "vpc_issue_108" {
     Name  = "route-already-exists"
   }, local.tags)
 }
+
+################################################################################
+# Issue 1182 - https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1182
+################################################################################
+
+module "vpc_issue_1182" {
+  source = "../../"
+
+  name = "route-table"
+ enable_nat_gateway cidr = "10.0.0.0/16"
+
+  azs             = local.azs
+  private_subnets = ["10.0.0.0/24", "10.0.1.0/24"]
+  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
+
+  enable_nat_gateway = true
+  single_nat_gateway = false
+  enable_vpn_gateway = true
+
+  tags = merge({
+    Issue = "1182"
+    Name  = "route-table"
+  }, local.tags)
+}
---
examples/issues/outputs.tf
@@ -108,3 +108,11 @@ output "issue_108_nat_public_ips" {
   description = "List of public Elastic IPs created for AWS NAT Gateway"
   value       = module.vpc_issue_108.nat_public_ips
 }
+
+################################################################################
+# Issue #1182
+################################################################################
+output "private_route_table_association_objects" {
+  description = "The list of private route table associations from the VPC module"
+  value       = module.vpc_issue_1182.private_route_table_association_objects
+}
---
outputs.tf
@@ -198,6 +198,10 @@ output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = local.private_route_table_ids
 }
+output "private_route_table_association_objects" {
+  description = "A list of all private route table associations, containing the full aws_route_table_association objects."
+  value       = aws_route_table_association.private
+}

 output "private_nat_gateway_route_ids" {
   description = "List of IDs of the private nat gateway route"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Seems like the directory layout was modified, but this doc was not

---

Choice A:
UPGRADE-3.0.md
@@ -10,7 +10,7 @@ If you find a bug, please open an issue with supporting configuration to reprodu

 Previously, VPC endpoints were configured as standalone resources with their own set of variables and attributes. Now, this functionality is provided via a module which loops over a map of maps using `for_each` to generate the desired VPC endpoints. Therefore, to maintain the existing set of functionality while upgrading, you will need to perform the following changes:

-1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete-vpc) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:
+1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:

 ```
 terraform state mv 'module.vpc.aws_vpc_endpoint.ssm[0]' 'module.vpc_endpoints.aws_vpc_endpoint.this["ssm"]'
---

---

Choice B:
UPGRADE-3.0.md
@@ -10,7 +10,7 @@ If you find a bug, please open an issue with supporting configuration to reprodu

 Previously, VPC endpoints were configured as standalone resources with their own set of variables and attributes. Now, this functionality is provided via a module which loops over a map of maps using `for_each` to generate the desired VPC endpoints. Therefore, to maintain the existing set of functionality while upgrading, you will need to perform the following changes:

-1. Move the endpoint resource from the main module to the sub-module. The example state move below resource valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete-vpc) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:
+1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:

 ```
 terraform state mv 'module.vpc.aws_vpc_endpoint.ssm[0]' 'module.vpc_endpoints.aws_vpc_endpoint.this["ssm"]'
---

---

Choice C:
UPGRADE-3.0.md
@@ -10,7 +10,7 @@ If you find a bug, please open an issue with supporting configuration to reprodu

 Previously, VPC endpoints were configured as standalone resources with their own set of variables and attributes. Now, this functionality is provided via a module which loops over a map of maps using `for_each` to generate the desired VPC endpoints. Therefore, to maintain the existing set of functionality while upgrading, you will need to perform the following changes:

-1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete-vpc) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:
+1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:

 ```
 terraform you mv 'module.vpc.aws_vpc_endpoint.ssm[0]' 'module.vpc_endpoints.aws_vpc_endpoint.this["ssm"]'
---

---

Choice D:
UPGRADE-3.0.md
@@ -10,7 +10,7 @@ If you find a bug, be open an issue with supporting configuration to reprodu

 Previously, VPC endpoints were configured as standalone resources with their own set of variables and attributes. Now, this functionality is provided via a module which loops over a map of maps using `for_each` to generate the desired VPC endpoints. Therefore, to maintain the existing set of functionality while upgrading, you will need to perform the following changes:

-1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete-vpc) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:
+1. Move the endpoint resource from the main module to the sub-module. The example state move below is valid for all endpoints you might have configured (reference [`complete-vpc`](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/complete) example for reference), where `ssmmessages` should be updated for and state move performed for each endpoint configured:

 ```
 terraform state mv 'module.vpc.aws_vpc_endpoint.ssm[0]' 'module.vpc_endpoints.aws_vpc_endpoint.this["ssm"]'
---

---