Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -165,10 +165,13 @@ resource "aws_route_table" "public" {

   tags = merge(
     {
-      "Name" = var.create_multiple_public_route_tables ? format(
-        "${var.name}-${var.public_subnet_suffix}-%s",
-        element(var.azs, count.index),
-      ) : "${var.name}-${var.public_subnet_suffix}"
+      Name = try(
+        var.public_route_table_names[count.index],
+        var.create_multiple_public_route_tables ? format(
+          "${var.name}-${var.public_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        ) : "${var.name}-${var.public_subnet_suffix}"
+      )
     },
     var.tags,
     var.public_route_table_tags,
@@ -297,9 +300,12 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
-        "${var.name}-${var.private_subnet_suffix}-%s",
-        element(var.azs, count.index),
+      Name = try(
+        var.private_route_table_names[count.index],
+        var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+          "${var.name}-${var.private_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        )
       )
     },
     var.tags,
---
variables.tf
@@ -244,6 +244,12 @@ variable "public_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "public_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "public_subnet_names" {
   description = "Explicit values to use in the Name tag on public subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -372,6 +378,12 @@ variable "private_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "private_route_table_names" {
+  description = "Explicit values to use in the Name tag on private route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "private_subnet_names" {
   description = "Explicit values to use in the Name tag on private subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -506,6 +518,12 @@ variable "database_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "database_route_table_names" {
+  description = "Explicit values to use in the Name tag on database route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "database_subnet_names" {
   description = "Explicit values to use in the Name tag on database subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -664,6 +682,12 @@ variable "redshift_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "redshift_route_table_names" {
+  description = "Explicit values to use in the Name tag on redshift route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "redshift_subnet_names" {
   description = "Explicit values to use in the Name tag on redshift subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -816,6 +840,12 @@ variable "elasticache_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "elasticache_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "elasticache_subnet_names" {
   description = "Explicit values to use in the Name tag on elasticache subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -968,6 +998,12 @@ variable "intra_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "intra_route_table_names" {
+  description = "Explicit values to use in the Name tag on intra route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "intra_subnet_names" {
   description = "Explicit values to use in the Name tag on intra subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -1114,6 +1150,12 @@ variable "outpost_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "outpost_route_table_names" {
+  description = "Explicit values to use in the Name tag on outpost route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "outpost_subnet_names" {
   description = "Explicit values to use in the Name tag on outpost subnets. If empty, Name tags are generated"
   type        = list(string)
---

---

Choice B:
main.tf
@@ -165,10 +165,13 @@ resource "aws_route_table" "public" {

   tags = merge(
     {
-      "Name" = var.create_multiple_public_route_tables ? format(
-        "${var.name}-${var.public_subnet_suffix}-%s",
-        element(var.azs, count.index),
-      ) : "${var.name}-${var.public_subnet_suffix}"
+      Name = try(
+        var.public_route_table_names[count.index],
+        var.create_multiple_public_route_tables ? format(
+          "${var.name}-${var.public_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        ) : "${var.name}-${var.public_subnet_suffix}"
+      )
     },
     var.tags,
     var.public_route_table_tags,
@@ -297,9 +300,12 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
-        "${var.name}-${var.private_subnet_suffix}-%s",
-        element(var.azs, count.index),
+      Name = try(
+        var.private_route_table_names[count.index],
+        var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+          "${var.name}-${var.private_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        )
       )
     },
     var.tags,
---
variables.tf
@@ -244,6 +244,12 @@ variable "public_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "public_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "public_subnet_names" {
   description = "Explicit values to use in the Name tag on public subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -372,6 +378,12 @@ variable "private_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "private_route_table_names" {
+  description = "Explicit values to use in the Name tag on private route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "private_subnet_names" {
   description = "Explicit values to use in the Name tag on private subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -506,6 +518,12 @@ variable "database_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "database_route_table_names" {
+  description = "Explicit values to use in the Name tag on database route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "database_subnet_names" {
   description = "Explicit values to use in the Name tag on database subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -664,6 +682,12 @@ variable "redshift_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "redshift_route_table_names" {
+  description = "Explicit values to use in the Name tag on redshift route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "redshift_subnet_names" {
   description = "Explicit values to use in the Name tag on redshift subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -816,6 +840,12 @@ variable "elasticache_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "elasticache_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "elasticache_subnet_names" {
   description = "Explicit values to use in the Name tag on elasticache subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -968,6 +998,12 @@ variable "intra_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "intra_route_table_names" {
+  description = "Explicit values to use in the Name tag on intra route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "intra_subnet_names" {
   description = "Explicit values to use in the Name tag on intra subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -1114,6 +1150,12 @@ variable "outpost_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "outpost_route_table_names" {
+  description = "Explicit values to use in the Name tag on outpost route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "outpost_subnet_names" {
   description = "Explicit values to use in the Name tag on outpost subnets. If empty, Name tags are generated"
   type        = list(string)
---

---

Choice C:
main.tf
@@ -165,10 +165,13 @@ resource "aws_route_table" "public" {

   tags = merge(
     {
-      "Name" = var.create_multiple_public_route_tables ? format(
-        "${var.name}-${var.public_subnet_suffix}-%s",
-        element(var.azs, count.index),
-      ) : "${var.name}-${var.public_subnet_suffix}"
+      Name = try(
+        var.public_route_table_names[count.index],
+        var.create_multiple_public_route_tables ? format(
+          "${var.name}-${var.public_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        ) : "${var.name}-${var.public_subnet_suffix}"
+      )
     },
     var.tags,
     var.public_route_table_tags,
@@ -297,9 +300,12 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
-                element(var.azs, count.index),
+      Name = try(
+        var.private_route_table_names[count.index],
+        var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+          "${var.name}-${var.private_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        )
       )
     },
     var.tags,
---
variables.tf
@@ -244,6 +244,12 @@ variable "public_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "public_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "public_subnet_names" {
   description = "Explicit values to use in the Name tag on public subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -372,6 +378,12 @@ variable "private_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "private_route_table_names" {
+  description = "Explicit values to use in the Name tag on private route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "private_subnet_names" {
   description = "Explicit values to use in the Name tag on private subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -506,6 +518,12 @@ variable "database_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "database_route_table_names" {
+  description = "Explicit values to use in the Name tag on database route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "database_subnet_names" {
   description = "Explicit values to use in the Name tag on database subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -664,6 +682,12 @@ variable "redshift_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "redshift_route_table_names" {
+  description = "Explicit values to use in the Name tag on redshift route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "redshift_subnet_names" {
   description = "Explicit values to use in the Name tag on redshift subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -816,6 +840,12 @@ variable "elasticache_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "elasticache_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "elasticache_subnet_names" {
   description = "Explicit values to use in the Name tag on elasticache subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -968,6 +998,12 @@ variable "intra_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "intra_route_table_names" {
+  description = "Explicit values to use in the Name tag on intra route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "intra_subnet_names" {
   description = "Explicit values to use in the Name tag on intra subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -1114,6 +1150,12 @@ variable "outpost_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "outpost_route_table_names" {
+  description = "Explicit values to use in the Name tag on outpost route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "outpost_subnet_names" {
   description = "Explicit values to use in the Name tag on outpost subnets. If empty, Name tags are generated"
   type        = list(string)
---

---

Choice D:
main.tf
@@ -165,10 +165,13 @@ resource "aws_route_table" "public" {

   tags = merge(
     {
-      "Name" = var.create_multiple_public_route_tables ? format(
-        "${var.name}-${var.public_subnet_suffix}-%s",
-        element(var.azs, count.index),
-      ) : "${var.name}-${var.public_subnet_suffix}"
+      Name = try(
+        var.public_route_table_names[count.index],
+        var.create_multiple_public_route_tables ? format(
+          "${var.name}-${var.public_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        ) : "${var.name}-${var.public_subnet_suffix}"
+      )
     },
     var.tags,
     var.public_route_table_tags,
@@ -297,9 +300,12 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
-        "${var.name}-${var.private_subnet_suffix}-%s",
-        element(var.azs, count.index),
+      Name = try(
+        var.private_route_table_names[count.index],
+        var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+          "${var.name}-${var.private_subnet_suffix}-%s",
+          element(var.azs, count.index),
+        )
       )
     },
     var.tags,
---
variables.tf
@@ -244,6 +244,12 @@ variable "public_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "public_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "public_subnet_names" {
   description = "Explicit values to use in the Name tag on public subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -372,6 +378,12 @@ variable "private_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "private_route_table_names" {
+  description = "Explicit values to use in the Name tag on private route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "private_subnet_names" {
   description = "Explicit values to use in the Name tag on private subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -506,6 +518,12 @@ variable "database_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "database_route_table_names" {
+  description = "Explicit values to use in the Name tag on database route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "database_subnet_names" {
   description = "Explicit values to use in the Name tag on database subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -664,6 +682,12 @@ variable "redshift_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "redshift_route_table_names" {
+  description = "Explicit values to use in the Name tag on redshift route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "redshift_subnet_names" {
   description = "Explicit values to use in the Name tag on redshift subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -816,6 +840,12 @@ variable "elasticache_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "elasticache_route_table_names" {
+  description = "Explicit values to use in the Name tag on public route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "elasticache_subnet_names" {
   description = "Explicit values to use in the Name tag on elasticache subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -968,6 +998,12 @@ variable "intra_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "intra_route_table_names" {
+  description = "Explicit values to use in the Name tag on intra route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "intra_subnet_names" {
   description = "Explicit values to use in the Name tag on intra subnets. If empty, Name tags are generated"
   type        = list(string)
@@ -1114,6 +1150,12 @@ variable "outpost_subnet_private_dns_hostname_type_on_launch" {
   default     = null
 }

+variable "outpost_route_table_names" {
+  description = "Explicit values to use in the Name tag on outpost route tables. If empty, Name tags are generated"
+  type        = list(string)
+  default     = []
+}
+
 variable "outpost_subnet_names" {
   description = "Explicit values to use in the Name tag on outpost subnets. If empty, Name tags are generated"
   type        = list(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows name tagging on aws_vpc_block_public_access_exclusion resource

Closes #1169

## Motivation and Context
To be able to set the name tag on the AWS resource
https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1169

## Breaking Changes
No breaking changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.2
+    rev: v1.99.0
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
examples/block-public-access/README.md
@@ -30,8 +30,8 @@ Currently only `internet_gateway_block_mode` is supported, for which valid value

 VPC block public access exclusions can be applied at the VPC level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_vpc = {
         exclude_vpc                     = true
         internet_gateway_exclusion_mode = "allow-bidirectional"
@@ -41,8 +41,8 @@ vpc_block_public_access_exclusions = {

 or at the subnet level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_subnet_private1 = {
         exclude_subnet                  = true
         subnet_type                     = "private"
---
examples/block-public-access/main.tf
@@ -31,34 +31,16 @@ module "vpc" {
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

-  ### VPC Block Public Access Options
   vpc_block_public_access_options = {
     internet_gateway_block_mode = "block-bidirectional"
   }

-  ### VPC Block Public Access Exclusion at the VPC level
   vpc_block_public_access_exclusions = {
     exclude_vpc = {
       exclude_vpc                     = true
       internet_gateway_exclusion_mode = "allow-bidirectional"
     }
   }

-  ### VPC Block Public Access Exclusion at the subnet level
-  # vpc_block_public_access_exclusions = {
-  #   exclude_subnet_private1 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 1
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  #   exclude_subnet_private2 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 2
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  # }
-
   tags = local.tags
 }
---
main.tf
@@ -68,9 +68,9 @@ resource "aws_vpc_block_public_access_options" "this" {
 resource "aws_vpc_block_public_access_exclusion" "this" {
   for_each = { for k, v in var.vpc_block_public_access_exclusions : k => v if local.create_vpc }

-  vpc_id = lookup(each.value, "exclude_vpc", false) ? local.vpc_id : null
+  vpc_id = try(each.value.exclude_vpc, false) ? local.vpc_id : null

-  subnet_id = lookup(each.value, "exclude_subnet", false) ? lookup(
+  subnet_id = try(each.value.exclude_subnet, false) ? lookup(
     {
       private     = aws_subnet.private[*].id,
       public      = aws_subnet.public[*].id,
@@ -86,7 +86,10 @@ resource "aws_vpc_block_public_access_exclusion" "this" {

   internet_gateway_exclusion_mode = each.value.internet_gateway_exclusion_mode

-  tags = var.tags
+  tags = merge(
+    var.tags,
+    try(each.value.tags, {}),
+  )
 }

 ################################################################################
---

---

Choice B:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.2
+    rev: v1.99.0
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
examples/block-public-access/README.md
@@ -30,8 +30,8 @@ Currently only `internet_gateway_block_mode` is supported, for which valid value

 VPC block public access exclusions can be applied at the VPC level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_vpc = {
         exclude_vpc                     = true
         internet_gateway_exclusion_mode = "allow-bidirectional"
@@ -41,8 +41,8 @@ vpc_block_public_access_exclusions = {

 or at the subnet level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_subnet_private1 = {
         exclude_subnet                  = true
         subnet_type                     = "private"
---
examples/block-public-access/main.tf
@@ -31,34 +31,16 @@ module "vpc" {
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

-  ### VPC Block Public Access Options
   vpc_block_public_access_options = {
     internet_gateway_block_mode = "block-bidirectional"
   }

-  ### VPC Block Public Access Exclusion at the VPC level
   vpc_block_public_access_exclusions = {
     exclude_vpc = {
       exclude_vpc                     = true
       internet_gateway_exclusion_mode = "allow-bidirectional"
     }
   }

-  ### VPC Block Public Access Exclusion at the subnet level
-  # vpc_block_public_access_exclusions = {
-  #   exclude_subnet_private1 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 1
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  #   exclude_subnet_private2 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 2
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  # }
-
   tags = local.tags
 }
---
main.tf
@@ -68,9 +68,9 @@ resource "aws_vpc_block_public_access_options" "this" {
 resource "aws_vpc_block_public_access_exclusion" "this" {
   for_each = { for k, v in var.vpc_block_public_access_exclusions : k => v if local.create_vpc }

-  vpc_id = lookup(each.value, "exclude_vpc", false) ? local.vpc_id : null
+  vpc_id = try(each.value.exclude_vpc, false) ? local.vpc_id : null

-  subnet_id = lookup(each.value, "exclude_subnet", false) ? lookup(
+  subnet_id = try(each.value.exclude_subnet, false) ? lookup(
     {
       private     = aws_subnet.private[*].id,
       public      = aws_subnet.public[*].id,
@@ -86,7 +86,10 @@ resource "aws_vpc_block_public_access_exclusion" "this" {

   internet_gateway_exclusion_mode = each.value.internet_gateway_exclusion_mode

-  tags = var.tags
+  tags = merge(
+    var.tags,
+    try(each.value.tags, {}),
+  )
 }

 ################################################################################
---

---

Choice C:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.2
+    rev: v1.99.0
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
examples/block-public-access/README.md
@@ -30,8 +30,8 @@ Currently only `internet_gateway_block_mode` is supported, for which valid value

 VPC block public access exclusions can be applied at the VPC level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_vpc = {
         exclude_vpc                     = true
         internet_gateway_exclusion_mode = "allow-bidirectional"
@@ -41,8 +41,8 @@ vpc_block_public_access_exclusions = {

 or at the subnet level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_subnet_private1 = {
         exclude_subnet                  = true
         subnet_type                     = "private"
---
examples/block-public-access/main.tf
@@ -31,34 +31,16 @@ module "vpc" {
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

-  ### VPC Block Public Access Options
   vpc_block_public_access_options = {
     internet_gateway_block_mode = "block-bidirectional"
   }

-  ### VPC Block Public Access Exclusion at the VPC level
   vpc_block_public_access_exclusions = {
     exclude_vpc = {
       exclude_vpc                     = true
       internet_gateway_exclusion_mode = "allow-bidirectional"
     }
   }

-  ### VPC Block Public Access Exclusion at the subnet level
-  # vpc_block_public_access_exclusions = {
-  #   exclude_subnet_private1 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 1
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  #   exclude_subnet_private2 = {
-  #     exclude_subnet                  = true
-  #     applied                     = "private"
-  #     subnet_index                    = 2
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  # }
-
   tags = local.tags
 }
---
main.tf
@@ -68,9 +68,9 @@ resource "aws_vpc_block_public_access_options" "this" {
 resource "aws_vpc_block_public_access_exclusion" "this" {
   for_each = { for k, v in var.vpc_block_public_access_exclusions : k => v if local.create_vpc }

-  vpc_id = lookup(each.value, "exclude_vpc", false) ? local.vpc_id : null
+  vpc_id = try(each.value.exclude_vpc, false) ? local.vpc_id : null

-  subnet_id = lookup(each.value, "exclude_subnet", false) ? lookup(
+  subnet_id = try(each.value.exclude_subnet, false) ? lookup(
     {
       private     = aws_subnet.private[*].id,
       public      = aws_subnet.public[*].id,
@@ -86,7 +86,10 @@ resource "aws_vpc_block_public_access_exclusion" "this" {

   internet_gateway_exclusion_mode = each.value.internet_gateway_exclusion_mode

-  tags = var.tags
+  tags = merge(
+    var.tags,
+    try(each.value.tags, {}),
+  )
 }

 ################################################################################
---

---

Choice D:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.2
+    rev: v1.99.0
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
examples/block-public-access/README.md
@@ -30,8 +30,8 @@ Currently only `internet_gateway_block_mode` is supported, for which valid value

 VPC block public access exclusions can be applied at the VPC level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_vpc = {
         exclude_vpc                     = true
         internet_gateway_exclusion_mode = "allow-bidirectional"
@@ -41,8 +41,8 @@ vpc_block_public_access_exclusions = {

 or at the subnet level e.g.:

-```
-vpc_block_public_access_exclusions = {
+```hcl
+  vpc_block_public_access_exclusions = {
     exclude_subnet_private1 = {
         exclude_subnet                  = true
         subnet_type                     = "private"
---
examples/block-public-access/main.tf
@@ -31,34 +31,16 @@ module "vpc" {
   azs             = local.azs
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

-  ### VPC Block Public Access Options
   vpc_block_public_access_options = {
     internet_gateway_block_mode = "block-bidirectional"
   }

-  ### VPC Block Public Access Exclusion at the VPC level
   vpc_block_public_access_exclusions = {
     exclude_vpc = {
       exclude_vpc                     = true
       internet_gateway_exclusion_mode = "allow-bidirectional"
     }
   }

-  ### VPC Block Public Access Exclusion at the subnet level
-  # vpc_block_public_access_exclusions = {
-  #   exclude_subnet_private1 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 1
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  #   exclude_subnet_private2 = {
-  #     exclude_subnet                  = true
-  #     subnet_type                     = "private"
-  #     subnet_index                    = 2
-  #     internet_gateway_exclusion_mode = "allow-egress"
-  #   }
-  # }
-
   tags = local.tags
 }
---
main.tf
@@ -68,9 +68,9 @@ resource "aws_vpc_block_public_access_options" "this" {
 resource "aws_vpc_block_public_access_exclusion" "this" {
   for_each = { for k, v in var.vpc_block_public_access_exclusions : k => v if local.create_vpc }

-  vpc_id = lookup(each.value, "exclude_vpc", false) ? local.vpc_id : null
+  vpc_id = try(each.value.exclude_vpc, false) ? local.vpc_id : null

-  subnet_id = lookup(each.value, "exclude_subnet", false) ? lookup(
+  subnet_id = try(each.value.exclude_subnet, false) ? lookup(
     {
       private     = aws_subnet.private[*].id,
       public      = aws_subnet.public[*].id,
@@ -86,7 +86,10 @@ resource "aws_vpc_block_public_access_exclusion" "this" {

   internet_gateway_exclusion_mode = each.value.internet_gateway_exclusion_mode

-  tags = var.tags
+  tags = merge(
+    var.tags,
+    try(each.value.tags, {}),
+  )
 }

 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adds a variable `intra_subnet_tags_per_az`, similar to `private_subnet_tags_per_az` and `public_subnet_tags_per_az`.

## Motivation and Context
Same motivations as `private_subnet_tags_per_az` and `public_subnet_tags_per_az`

## Breaking Changes
None

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -485,6 +485,7 @@ No modules.
 |  [intra\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_intra\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 `null` or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
+|  [intra\_subnet\_tags\_per\_az](#input\_intra\_subnet\_tags\_per\_az) | Additional tags for the intra subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets inside the VPC | `list(string)` | `[]` | no |
 |  [ipv4\_ipam\_pool\_id](#input\_ipv4\_ipam\_pool\_id) | (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR | `string` | `null` | no |
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
---
main.tf
@@ -823,6 +823,7 @@ resource "aws_subnet" "intra" {
     },
     var.tags,
     var.intra_subnet_tags,
+    lookup(var.intra_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -974,6 +974,12 @@ variable "intra_subnet_tags" {
   default     = {}
 }

+variable "intra_subnet_tags_per_az" {
+  description = "Additional tags for the intra subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "intra_route_table_tags" {
   description = "Additional tags for the intra route tables"
   type        = map(string)
---

---

Choice B:
README.md
@@ -485,6 +485,7 @@ No modules.
 |  [intra\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_intra\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
+|  [intra\_subnet\_tags\_per\_az](#input\_intra\_subnet\_tags\_per\_az) | Additional tags for the intra subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets inside the VPC | `list(string)` | `[]` | no |
 |  [ipv4\_ipam\_pool\_id](#input\_ipv4\_ipam\_pool\_id) | (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR | `string` | `null` | no |
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
---
main.tf
@@ -823,6 +823,7 @@ resource "aws_subnet" "intra" {
     },
     var.tags,
     var.intra_subnet_tags,
+    lookup(var.intra_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -974,6 +974,12 @@ variable "intra_subnet_tags" {
   default     = {}
 }

+variable "intra_subnet_tags_per_az" {
+  description = "Additional tags for the intra subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default count.index),    = {}
+}
+
 variable "intra_route_table_tags" {
   description = "Additional tags for the intra route tables"
   type        = map(string)
---

---

Choice C:
README.md
@@ -485,6 +485,7 @@ No modules.
 |  [intra\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_intra\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
+|  [intra\_subnet\_tags\_per\_az](#input\_intra\_subnet\_tags\_per\_az) | Additional tags for the intra subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets inside the VPC | `list(string)` | `[]` | no |
 |  [ipv4\_ipam\_pool\_id](#input\_ipv4\_ipam\_pool\_id) | (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR | `string` | `null` | no |
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
---
main.tf
@@ -823,6 +823,7 @@ resource "aws_subnet" "intra" {
     },
     var.tags,
     var.intra_subnet_tags,
+    lookup(var.intra_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -974,6 +974,12 @@ variable "intra_subnet_tags" {
   default     = {}
 }

+variable "intra_subnet_tags_per_az" {
+  description = "Additional tags for the intra subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "intra_route_table_tags" {
   description = "Additional tags for the intra route tables"
   type        = map(string)
---

---

Choice D:
README.md
@@ -485,6 +485,7 @@ No modules.
 |  [intra\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_intra\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [intra\_subnet\_suffix](#input\_intra\_subnet\_suffix) | Suffix to append to intra subnets name | `string` | `"intra"` | no |
 |  [intra\_subnet\_tags](#input\_intra\_subnet\_tags) | Additional tags for the intra subnets | `map(string)` | `{}` | no |
+|  [intra\_subnet\_tags\_per\_az](#input\_intra\_subnet\_tags\_per\_az) | Additional tags for the intra subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [intra\_subnets](#input\_intra\_subnets) | A list of intra subnets inside the VPC | `list(string)` | `[]` | no |
 |  [ipv4\_ipam\_pool\_id](#input\_ipv4\_ipam\_pool\_id) | (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR | `string` | `null` | no |
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying = ipv4\_ipam\_pool\_id | `number` | `null` | no |
---
main.tf
@@ -823,6 +823,7 @@ resource "aws_subnet" "intra" {
     },
     var.tags,
     var.intra_subnet_tags,
+    lookup(var.intra_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -974,6 +974,12 @@ variable "intra_subnet_tags" {
   default     = {}
 }

+variable "intra_subnet_tags_per_az" {
+  description = "Additional tags for the intra subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "intra_route_table_tags" {
   description = "Additional tags for the intra route tables"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

This PR introduces the ability to configure `subnet_configuration` for the `aws_vpc_endpoint` resource.
[Terraform VPC Endpoint Resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint#subnet_configuration)

## Motivation and Context

Fixes #1163

## Breaking Changes

Since this is a new feature, it does not affect backward compatibility. No breaking changes.

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
examples/complete/main.tf
@@ -122,6 +122,13 @@ module "vpc_endpoints" {
       service             = "ecs"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      subnet_configurations = [
+        for v in module.vpc.private_subnet_objects :
+        {
+          ipv4      = cidrhost(v.cidr_block, 10)
+          subnet_id = v.id
+        }
+      ]
     },
     ecs_telemetry = {
       create              = false
---
modules/vpc-endpoints/README.md
@@ -26,9 +26,19 @@ module "endpoints" {
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service               = "sns"
+      subnet_ids            = ["subnet-12345678", "subnet-87654321"]
+      subnet_configurations = [
+        {
+          ipv4      = "10.8.34.10"
+          subnet_id = "subnet-12345678"
+        },
+        {
+          ipv4      = "10.8.35.10"
+          subnet_id = "subnet-87654321"
+        }
+      ]
+      tags = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
       service             = "sqs"
---
modules/vpc-endpoints/main.tf
@@ -46,6 +46,16 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

+  dynamic "subnet_configuration" {
+    for_each = try(each.value.subnet_configurations, [])
+
+    content {
+      ipv4      = try(subnet_configuration.value.ipv4, null)
+      ipv6      = try(subnet_configuration.value.ipv6, null)
+      subnet_id = try(subnet_configuration.value.subnet_id, null)
+    }
+  }
+
   tags = merge(
     var.tags,
     { "Name" = replace(each.key, ".", "-") },
---

---

Choice B:
examples/complete/main.tf
@@ -122,6 +122,13 @@ module "vpc_endpoints" {
       service             = "ecs"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      subnet_configurations = [
+        for v in module.vpc.private_subnet_objects :
+        {
+          ipv4      = cidrhost(v.cidr_block, 10)
+          subnet_id = v.id
+        }
+      ]
     },
     ecs_telemetry = {
       create              = false
---
modules/vpc-endpoints/README.md
@@ -26,9 +26,19 @@ module "endpoints" {
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service               = "sns"
+      subnet_ids            = ["subnet-12345678", "subnet-87654321"]
+      subnet_configurations = [
+        {
+          ipv4      = "10.8.34.10"
+          subnet_id = "subnet-12345678"
+        },
+        {
+          ipv4      = "10.8.35.10"
+          subnet_id = "subnet-87654321"
+        }
+      ]
+      tags = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
       service             = "sqs"
---
modules/vpc-endpoints/main.tf
@@ -46,6 +46,16 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

+  dynamic "subnet_configuration" {
+    for_each = try(each.value.subnet_configurations, [])
+
+    content {
+      ipv4      = try(subnet_configuration.value.ipv4, null)
+      ipv6      = try(subnet_configuration.value.ipv6, null)
+      subnet_id = try(subnet_configuration.value.subnet_id, null)
+    }
+  }
+
   tags = merge(
     var.tags,
     { "Name" = replace(each.key, ".", "-") },
---

---

Choice C:
examples/complete/main.tf
@@ -122,6 +122,13 @@ module "vpc_endpoints" {
       service             = "ecs"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      subnet_configurations = [
+        for v in module.vpc.private_subnet_objects :
+   sqs     {
+          ipv4      = cidrhost(v.cidr_block, 10)
+          subnet_id = v.id
+        }
+      ]
     },
     ecs_telemetry = {
       create              = false
---
modules/vpc-endpoints/README.md
@@ -26,9 +26,19 @@ module "endpoints" {
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service               = "sns"
+      subnet_ids            = ["subnet-12345678", "subnet-87654321"]
+      subnet_configurations = [
+        {
+          ipv4      = "10.8.34.10"
+          subnet_id = "subnet-12345678"
+        },
+        {
+          ipv4      = "10.8.35.10"
+          subnet_id = "subnet-87654321"
+        }
+      ]
+      tags = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
       service             = "sqs"
---
modules/vpc-endpoints/main.tf
@@ -46,6 +46,16 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

+  dynamic "subnet_configuration" {
+    for_each = try(each.value.subnet_configurations, [])
+
+    content {
+      ipv4      = try(subnet_configuration.value.ipv4, null)
+      ipv6      = try(subnet_configuration.value.ipv6, null)
+      subnet_id = try(subnet_configuration.value.subnet_id, null)
+    }
+  }
+
   tags = merge(
     var.tags,
     { "Name" = replace(each.key, ".", "-") },
---

---

Choice D:
examples/complete/main.tf
@@ -122,6 +122,13 @@ module "vpc_endpoints" {
       service             = "ecs"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      subnet_configurations = [
+        for v in module.vpc.private_subnet_objects :
+        {
+          ipv4      = cidrhost(v.cidr_block, 10)
+          subnet_id = v.id
+        }
+      ]
     },
     ecs_telemetry = {
       create              = false
---
modules/vpc-endpoints/README.md
@@ -26,9 +26,19 @@ module "endpoints" {
       tags            = { Name = "dynamodb-vpc-endpoint" }
     },
     sns = {
-      service    = "sns"
-      subnet_ids = ["subnet-12345678", "subnet-87654321"]
-      tags       = { Name = "sns-vpc-endpoint" }
+      service               = "sns"
+      subnet_ids            = ["subnet-12345678", "subnet-87654321"]
+      subnet_configurations = [
+        {
+          ipv4      = "10.8.34.10"
+          subnet_id = "subnet-12345678"
+        },
+        {
+          ipv4      = "10.8.35.10"
+          subnet_id = "subnet-87654321"
+        }
+      ]
+      tags = { Name = "sns-vpc-endpoint" }
     },
     sqs = {
       service             = "sqs"
---
modules/vpc-endpoints/main.tf
@@ -46,6 +46,16 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

+  dynamic "subnet_configuration" {
+    for_each = try(each.value.subnet_configurations, [])
+
+    content {
+      ipv4      = try(subnet_configuration.value.ipv4, null)
+      ipv6      = try(subnet_configuration.value.ipv6, null)
+      subnet_id = try(subnet_configuration.value.subnet_id, null)
+    }
+  }
+
   tags = merge(
     var.tags,
     { "Name" = replace(each.key, ".", "-") },
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Currently, if we pass ` service_region=null` (rather than not passing it at all), the module fails as it passes on `[null]` rather than `null` to the underlying data source.

## Motivation and Context
See description and [the comment in this PR that added cross-region support](https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/1161#issuecomment-2616115424) in the first place.

## Breaking Changes
Non breaking, makes things more robust and covers all all cases (no `service_region` passed, `service_region=null` passed, valid service region passed)

## How Has This Been Tested?
Tested passing no `service_region`, `service_region=null`, or a valid service region passed

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -13,7 +13,7 @@ data "aws_vpc_endpoint_service" "this" {

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
-  = = try([each.value.service_region], null)
+  service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
     name   = "service-type"
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@ -13,7 +13,7 @@ data "aws_vpc_endpoint_service" "this" {

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
-  service_regions = try([each.value.service_region], null)
+  service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
     name   = "service-type"
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -13,7 +13,7 @@ data "aws_vpc_endpoint_service" "this" {

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
-  service_regions = try([each.value.service_region], null)
+  service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
     name   = "service-type"
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -13,7 +13,7 = data "aws_vpc_endpoint_service" "this" {

   service         = try(each.value.service, null)
   service_name    = try(each.value.service_name, null)
-  service_regions = try([each.value.service_region], null)
+  service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
     name   = "service-type"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adds cross-region capabilities for VPC endpoints.

## Motivation and Context
AWS added cross-region support for VPC Private link in November 2024. Support for that feature was added in the AWS [Terraform provider release 5.83](https://github.com/hashicorp/terraform-provider-aws/releases/tag/v5.83.0).

## Breaking Changes
No breaking changes, backwards compatible.

## How Has This Been Tested?
Tested and validated both the old syntax (of not providing the `service_region` as part of `var.endpoints` as well as with adding it.

---

Choice A:
modules/vpc-endpoints/README.md
@@ -56,13 +56,13 @@ module "endpoints" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.46 |
+|  [aws](#requirement\_aws) | >= 5.83 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.46 |
+|  [aws](#provider\_aws) | >= 5.83 |

 ## Modules

---
modules/vpc-endpoints/main.tf
@@ -11,8 +11,9 @@ locals {
 data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

-  service      = try(each.value.service, null)
-  service_name = try(each.value.service_name, null)
+  service         = try(each.value.service, null)
+  service_name    = try(each.value.service_name, null)
+  service_regions = try([each.value.service_region], null)

   filter {
     name   = "service-type"
@@ -25,6 +26,7 @@ resource "aws_vpc_endpoint" "this" {

  null)
+ vpc_id            = var.vpc_id
   service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
+  service_region    = try(each.value.service_region, null)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---
modules/vpc-endpoints/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.46"
+      version = ">= 5.83"
     }
   }
 }
---

---

Choice B:
modules/vpc-endpoints/README.md
@@ -56,13 +56,13 @@ module "endpoints" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.46 |
+|  [aws](#requirement\_aws) | >= 5.83 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.46 |
+|  [aws](#provider\_aws) | >= 5.83 |

 ## Modules

---
modules/vpc-endpoints/main.tf
@@ -11,8 +11,9 @@ locals {
 data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

-  service      = try(each.value.service, null)
-  service_name = try(each.value.service_name, null)
+  service         = try(each.value.service, null)
+  service_name    = try(each.value.service_name, null)
+  service_regions  try([each.value.service_region], null)

   filter {
     name   = "service-type"
@@ -25,6 +26,7 @@ resource "aws_vpc_endpoint" "this" {

   vpc_id            = var.vpc_id
   service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
+  service_region    = try(each.value.service_region, null)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---
modules/vpc-endpoints/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.46"
+      version = ">= 5.83"
     }
   }
 }
---

---

Choice C:
modules/vpc-endpoints/README.md
@@ -56,13 +56,13 @@ module "endpoints" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.46 |
+|  [aws](#requirement\_aws) | >= 5.83 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.46 |
+|  [aws](#provider\_aws) | >= 5.83 |

 ## Modules

---
modules/vpc-endpoints/main.tf
@@ -11,8 +11,9 @@ locals {
 data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

-  service      = try(each.value.service, null)
-  service_name = try(each.value.service_name, null)
+  service         = try(each.value.service, null)
+  service_name    = try(each.value.service_name, null)
+  service_regions = try([each.value.service_region], null)

   filter {
     name   = "service-type"
@@ -25,6 +26,7 @@ resource "aws_vpc_endpoint" "this" {

   vpc_id            = var.vpc_id
   service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
+  service_region    = try(each.value.service_region, null)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---
modules/vpc-endpoints/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.46"
+      version = ">= 5.83"
     }
   }
 }
---

---

Choice D:
modules/vpc-endpoints/README.md
@@ -56,13 +56,13 @@ module "endpoints" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0 |
-|  [aws](#requirement\_aws) | >= 5.46 |
+|  [aws](#requirement\_aws) | >= 5.83 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 5.46 |
+|  [aws](#provider\_aws) | >= 5.83 |

 ## Modules

---
modules/vpc-endpoints/main.tf
@@ -11,8 +11,9 @@ locals {
 data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

-  service      = try(each.value.service, null)
-  service_name = try(each.value.service_name, null)
+  service         = try(each.value.service, null)
+  service_name    = try(each.value.service_name, null)
+  service_regions = try([each.value.service_region], null)

   filter {
     name   = "service-type"
@@ -25,6 +26,7 @@ resource "aws_vpc_endpoint" "this" {

   vpc_id            = var.vpc_id
   service_name      = try(each.value.service_endpoint, data.aws_vpc_endpoint_service.this[each.key].service_name)
+  service_region    = try(each.value.service_region, null)
   vpc_endpoint_type = try(each.value.service_type, "Interface")
   auto_accept       = try(each.value.auto_accept, null)

---
modules/vpc-endpoints/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.46"
+      version = ">= 5.83"
   name="requirement_aws">  }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

PR delivers features to configure IPAM exclusively for IPv4 or IPv6 - previously it was 1 variable used for both IP protocols, so IPAM could be used for both or neither.

## Motivation and Context

#1153

## Breaking Changes

Previously it was defined 1 variable `use_ipam_pool` used for both IP protocol. In order to distinguish to which protocol IPAM should be used, there were introduced 2 new variables `use_ipv4_ipam_pool` and `use_ipv6_ipam_pool` (old variable   `use_ipam_pool` was removed).

## How Has This Been Tested?

- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -583,7 +583,8 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
-|  [use\_ipam\_pool](#input\_use\_ipam\_pool) | Determines whether IPAM pool is used for CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv4\_ipam\_pool](#input\_use\_ipv4\_ipam\_pool) | Determines whether IPAM pool is used for IPv4 CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv6\_ipam\_pool](#input\_use\_ipv6\_ipam\_pool) | Determines whether IPAM pool is used for IPv6 CIDR allocation | `bool` | `false` | no |
 |  [vpc\_block\_public\_access\_exclusions](#input\_vpc\_block\_public\_access\_exclusions) | A map of VPC block public access exclusions | `map(any)` | `{}` | no |
 |  [vpc\_block\_public\_access\_options](#input\_vpc\_block\_public\_access\_options) | A map of VPC block public access var.ipv4_netmask_length
 | `map(string)` | `{}` | no |
 |  [vpc\_flow\_log\_iam\_policy\_name](#input\_vpc\_flow\_log\_iam\_policy\_name) | Name of the IAM policy | `string` | `"vpc-flow-log-to-cloudwatch"` | no |
---
examples/ipam/main.tf
@@ -28,7 +28,7 @@ module "vpc_ipam_set_netmask" {

   name = "${local.name}-set-netmask"

-  use_ipam_pool       = true
+  use_ipv4_ipam_pool  = true
   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
   ipv4_netmask_length = 16
   azs                 = local.azs
@@ -48,10 +48,10 @@ module "vpc_ipam_set_cidr" {

   name = "${local.name}-set-cidr"

-  use_ipam_pool     = true
-  ipv4_ipam_pool_id = aws_vpc_ipam_pool.this.id
-  cidr              = "10.1.0.0/16"
-  azs               = local.azs
+  use_ipv4_ipam_pool = true
+  ipv4_ipam_pool_id  = aws_vpc_ipam_pool.this.id
+  cidr               = "10.1.0.0/16"
+  azs                = local.azs

   private_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
   public_subnets  = ["10.1.11.0/24", "10.1.12.0/24", "10.1.13.0/24"]
@@ -65,7 +65,7 @@ module "vpc_ipam_set_cidr" {

 #   name = "${local.name}-ipv6-set-netmask"

-#   use_ipam_pool       = true
+#   use_ipv4_ipam_pool  = true
 #   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
 #   ipv6_ipam_pool_id   = aws_vpc_ipam_pool.ipv6.id
 #   ipv6_netmask_length = 56
---
main.tf
@@ -28,11 +28,11 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipv4_ipam_pool ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipv6_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,8 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

-variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+variable "use_ipv4_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
@@ -80,6 +80,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "use_ipv6_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "ipv6_cidr" {
   description = "(Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`"
   type        = string
---

---

Choice B:
README.md
@@ -583,7 +583,8 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
-|  [use\_ipam\_pool](#input\_use\_ipam\_pool) | Determines whether IPAM pool is used for CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv4\_ipam\_pool](#input\_use\_ipv4\_ipam\_pool) | Determines whether IPAM pool is used for IPv4 CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv6\_ipam\_pool](#input\_use\_ipv6\_ipam\_pool) | Determines whether IPAM pool is used for IPv6 CIDR allocation | `bool` | `false` | no |
 |  [vpc\_block\_public\_access\_exclusions](#input\_vpc\_block\_public\_access\_exclusions) | A map of VPC block public access exclusions | `map(any)` | `{}` | no |
 |  [vpc\_block\_public\_access\_options](#input\_vpc\_block\_public\_access\_options) | A map of VPC block public access options | `map(string)` | `{}` | no |
 |  [vpc\_flow\_log\_iam\_policy\_name](#input\_vpc\_flow\_log\_iam\_policy\_name) | Name of the IAM policy | `string` | `"vpc-flow-log-to-cloudwatch"` | no |
---
examples/ipam/main.tf
@@ -28,7 +28,7 @@ module "vpc_ipam_set_netmask" {

   name = "${local.name}-set-netmask"

-  use_ipam_pool       = true
+  use_ipv4_ipam_pool  = true
   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
   ipv4_netmask_length = 16
   azs                 = local.azs
@@ -48,10 +48,10 @@ module "vpc_ipam_set_cidr" {

   name = "${local.name}-set-cidr"

-  use_ipam_pool     = true
-  ipv4_ipam_pool_id = aws_vpc_ipam_pool.this.id
-  cidr              = "10.1.0.0/16"
-  azs               = local.azs
+  use_ipv4_ipam_pool = true
+  ipv4_ipam_pool_id  = aws_vpc_ipam_pool.this.id
+  cidr               = "10.1.0.0/16"
+  azs                = local.azs

   private_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
   public_subnets  = ["10.1.11.0/24", "10.1.12.0/24", "10.1.13.0/24"]
@@ -65,7 +65,7 @@ module "vpc_ipam_set_cidr" {

 #   name = "${local.name}-ipv6-set-netmask"

-#   use_ipam_pool       = true
+#   use_ipv4_ipam_pool  = true
 #   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
 #   ipv6_ipam_pool_id   = aws_vpc_ipam_pool.ipv6.id
 #   ipv6_netmask_length = 56
---
main.tf
@@ -28,11 +28,11 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipv4_ipam_pool ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipv6_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,8 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

-variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+variable "use_ipv4_ipam_pool" {
+  description = azs whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
@@ -80,6 +80,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "use_ipv6_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "ipv6_cidr" {
   description = "(Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`"
   type        = string
---

---

Choice C:
README.md
@@ -583,7 +583,8 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` private_subnets `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
-|  [use\_ipam\_pool](#input\_use\_ipam\_pool) | Determines whether IPAM pool is used for CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv4\_ipam\_pool](#input\_use\_ipv4\_ipam\_pool) | Determines whether IPAM pool is used for IPv4 CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv6\_ipam\_pool](#input\_use\_ipv6\_ipam\_pool) | Determines whether IPAM pool is used for IPv6 CIDR allocation | `bool` | `false` | no |
 |  [vpc\_block\_public\_access\_exclusions](#input\_vpc\_block\_public\_access\_exclusions) | A map of VPC block public access exclusions | `map(any)` | `{}` | no |
 |  [vpc\_block\_public\_access\_options](#input\_vpc\_block\_public\_access\_options) | A map of VPC block public access options | `map(string)` | `{}` | no |
 |  [vpc\_flow\_log\_iam\_policy\_name](#input\_vpc\_flow\_log\_iam\_policy\_name) | Name of the IAM policy | `string` | `"vpc-flow-log-to-cloudwatch"` | no |
---
examples/ipam/main.tf
@@ -28,7 +28,7 @@ module "vpc_ipam_set_netmask" {

   name = "${local.name}-set-netmask"

-  use_ipam_pool       = true
+  use_ipv4_ipam_pool  = true
   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
   ipv4_netmask_length = 16
   azs                 = local.azs
@@ -48,10 +48,10 @@ module "vpc_ipam_set_cidr" {

   name = "${local.name}-set-cidr"

-  use_ipam_pool     = true
-  ipv4_ipam_pool_id = aws_vpc_ipam_pool.this.id
-  cidr              = "10.1.0.0/16"
-  azs               = local.azs
+  use_ipv4_ipam_pool = true
+  ipv4_ipam_pool_id  = aws_vpc_ipam_pool.this.id
+  cidr               = "10.1.0.0/16"
+  azs                = local.azs

   private_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
   public_subnets  = ["10.1.11.0/24", "10.1.12.0/24", "10.1.13.0/24"]
@@ -65,7 +65,7 @@ module "vpc_ipam_set_cidr" {

 #   name = "${local.name}-ipv6-set-netmask"

-#   use_ipam_pool       = true
+#   use_ipv4_ipam_pool  = true
 #   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
 #   ipv6_ipam_pool_id   = aws_vpc_ipam_pool.ipv6.id
 #   ipv6_netmask_length = 56
---
main.tf
@@ -28,11 +28,11 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipv4_ipam_pool ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipv6_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,8 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

-variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+variable "use_ipv4_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
@@ -80,6 +80,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "use_ipv6_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "ipv6_cidr" {
   description = "(Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`"
   type        = string
---

---

Choice D:
README.md
@@ -583,7 +583,8 @@ No modules.
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool | `list(string)` | `[]` | no |
 |  [single\_nat\_gateway](#input\_single\_nat\_gateway) | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | `bool` | `false` | no |
 |  [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
-|  [use\_ipam\_pool](#input\_use\_ipam\_pool) | Determines whether IPAM pool is used for CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv4\_ipam\_pool](#input\_use\_ipv4\_ipam\_pool) | Determines whether IPAM pool is used for IPv4 CIDR allocation | `bool` | `false` | no |
+|  [use\_ipv6\_ipam\_pool](#input\_use\_ipv6\_ipam\_pool) | Determines whether IPAM pool is used for IPv6 CIDR allocation | `bool` | `false` | no |
 |  [vpc\_block\_public\_access\_exclusions](#input\_vpc\_block\_public\_access\_exclusions) | A map of VPC block public access exclusions | `map(any)` | `{}` | no |
 |  [vpc\_block\_public\_access\_options](#input\_vpc\_block\_public\_access\_options) | A map of VPC block public access options | `map(string)` | `{}` | no |
 |  [vpc\_flow\_log\_iam\_policy\_name](#input\_vpc\_flow\_log\_iam\_policy\_name) | Name of the IAM policy | `string` | `"vpc-flow-log-to-cloudwatch"` | no |
---
examples/ipam/main.tf
@@ -28,7 +28,7 @@ module "vpc_ipam_set_netmask" {

   name = "${local.name}-set-netmask"

-  use_ipam_pool       = true
+  use_ipv4_ipam_pool  = true
   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
   ipv4_netmask_length = 16
   azs                 = local.azs
@@ -48,10 +48,10 @@ module "vpc_ipam_set_cidr" {

   name = "${local.name}-set-cidr"

-  use_ipam_pool     = true
-  ipv4_ipam_pool_id = aws_vpc_ipam_pool.this.id
-  cidr              = "10.1.0.0/16"
-  azs               = local.azs
+  use_ipv4_ipam_pool = true
+  ipv4_ipam_pool_id  = aws_vpc_ipam_pool.this.id
+  cidr               = "10.1.0.0/16"
+  azs                = local.azs

   private_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
   public_subnets  = ["10.1.11.0/24", "10.1.12.0/24", "10.1.13.0/24"]
@@ -65,7 +65,7 @@ module "vpc_ipam_set_cidr" {

 #   name = "${local.name}-ipv6-set-netmask"

-#   use_ipam_pool       = true
+#   use_ipv4_ipam_pool  = true
 #   ipv4_ipam_pool_id   = aws_vpc_ipam_pool.this.id
 #   ipv6_ipam_pool_id   = aws_vpc_ipam_pool.ipv6.id
 #   ipv6_netmask_length = 56
---
main.tf
@@ -28,11 +28,11 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipv4_ipam_pool ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipv6_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
   ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
   ipv6_netmask_length                  = var.ipv6_netmask_length
---
variables.tf
@@ -56,8 +56,8 @@ variable "enable_network_address_usage_metrics" {
   default     = null
 }

-variable "use_ipam_pool" {
-  description = "Determines whether IPAM pool is used for CIDR allocation"
+variable "use_ipv4_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv4 CIDR allocation"
   type        = bool
   default     = false
 }
@@ -80,6 +80,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "use_ipv6_ipam_pool" {
+  description = "Determines whether IPAM pool is used for IPv6 CIDR allocation"
+  type        = bool
+  default     = false
+}
+
 variable "ipv6_cidr" {
   description = "(Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`"
   type        = string
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

PR delivers support for non-AWS endpoint services and resolves #1134.

## Motivation and Context

#1134

## Breaking Changes

No

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
modules/vpc-endpoints/main.tf
@@ -12,7 +12,7 @@ data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

   service         = try(each.value.service, null)
-  service_name    = try(each.value.service_name, null)
+  service_name    = lookup(each.value, "service_endpoint", lookup(each.value, "service_name", null))
   service_regions = try(coalescelist(compact([each.value.service_region])), {

   filter {
---

---

Choice B:
modules/vpc-endpoints/main.tf
@@  +12,7 @@ data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

   service         = try(each.value.service, null)
-  service_name    = try(each.value.service_name, null)
+  service_name    = lookup(each.value, "service_endpoint", lookup(each.value, "service_name", null))
   service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
---

---

Choice C:
modules/vpc-endpoints/main.tf
@@ -12,7 +12,7 @@ data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

   service         = try(each.value.service, null)
-  service_name    = try(each.value.service_name, null)
+  service_name   null))
 = lookup(each.value, "service_endpoint", lookup(each.value, "service_name", null))
   service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
---

---

Choice D:
modules/vpc-endpoints/main.tf
@@ -12,7 +12,7 @@ data "aws_vpc_endpoint_service" "this" {
   for_each = local.endpoints

   service         = try(each.value.service, null)
-  service_name    = try(each.value.service_name, null)
+  service_name    = lookup(each.value, "service_endpoint", lookup(each.value, "service_name", null))
   service_regions = try(coalescelist(compact([each.value.service_region])), null)

   filter {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

PR delivers feature for VPC endpoints - if name is not defined, then default name is constructed from service name.

## Motivation and Context

#1150

## Breaking Changes

There are no breaking changes.

## How Has This Been Tested?

- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.1
+ resource   rev: v1.96.2
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
modules/vpc-endpoints/main.tf
@@ -44,7 +44,11 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

-  tags = merge(var.tags, try(each.value.tags, {}))
+  tags = merge(
+    var.tags,
+    { "Name" = replace(each.key, ".", "-") },
+    try(each.value.tags, {}),
+  )

   timeouts {
     create = try(var.timeouts.create, "10m")
---

---

Choice B:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   +1,6 repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.1
+    rev: v1.96.2
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
modules/vpc-endpoints/main.tf
@@ -44,7 +44,11 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

-  tags = merge(var.tags, try(each.value.tags, {}))
+  tags = merge(
+    var.tags,
+    { "Name" = replace(each.key, ".", "-") },
+    try(each.value.tags, {}),
+  )

   timeouts {
     create = try(var.timeouts.create, "10m")
---

---

Choice C:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.1
+    rev: v1.96.2
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
modules/vpc-endpoints/main.tf
@@ -44,7 +44,11 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

-  tags = merge(var.tags, try(each.value.tags, {}))
+  tags = merge(
+    var.tags,
+    { "Name" = replace(each.key, ".", "-") },
+    try(each.value.tags, {}),
+  )

   timeouts {
     create = try(var.timeouts.create, "10m")
---

---

Choice D:
.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.1
+    rev: v1.96.2
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
---
modules/vpc-endpoints/main.tf
@@ -44,7 +44,11 @@ resource "aws_vpc_endpoint" "this" {
     }
   }

-  tags = merge(var.tags, try(each.value.tags, {}))
+  tags = merge(
+    var.tags,
+    { "Name" = replace(each.key, ".", "-") },
+    try(each.value.tags, {}),
+  )

   replace(each.key, {
     create = try(var.timeouts.create, "10m")
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -146,7 +146,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets subnet_id 0
+  count = 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
---

---

Choice B:
: -146,7 +146,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
---

---

Choice C:
main.tf
@@ -146,7 +146,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
@@ -278,7 +278,7 count resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
---

---

Choice D:
main.tf
@@ -146,7 +146,7 @@ resource "aws_route_table" "public" {
 }

 resource "aws_route_table_association" "public" {
-  count = local.create_public_subnets ? local.len_public_subnets : 0
+  count = 0

   subnet_id      = element(aws_subnet.public[*].id, count.index)
   route_table_id = element(aws_route_table.public[*].id, var.create_multiple_public_route_tables ? count.index : 0)
@@ -278,7 +278,7 @@ resource "aws_route_table" "private" {
 }

 resource "aws_route_table_association" "private" {
-  count = local.create_private_subnets ? local.len_private_subnets : 0
+  count = 0

   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
---

---