Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Adds `flow_log_log_group_name_prefix` as an output.

## Motivation and Context

See [#790](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/790)

## Breaking Changes

No.

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [X] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice B:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source = = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice C:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values = output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice D:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Adds `flow_log_log_group_name_prefix` as a output from the module.

## Motivation and Context

See: [#790](https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/790)

## Breaking Changes

No.

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [X] I have executed `pre-commit run -a` on my pull request

This is my first open source commit so take it easy on me!

---

Choice A:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice B:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 | <a  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice C:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+  metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---

Choice D:
README.md
@@ -518,6 +518,7 @@ No modules.
 |  [elasticache\_subnets](#output\_elasticache\_subnets) | List of IDs of elasticache subnets |
 |  [elasticache\_subnets\_cidr\_blocks](#output\_elasticache\_subnets\_cidr\_blocks) | List of cidr\_blocks of elasticache subnets |
 |  [elasticache\_subnets\_ipv6\_cidr\_blocks](#output\_elasticache\_subnets\_ipv6\_cidr\_blocks) | List of IPv6 cidr\_blocks of elasticache subnets in an IPv6 enabled VPC |
+|  [flow\_log\_log\_group\_name\_prefix](#output\_flow\_log\_log\_group\_name\_prefix) | The name prefix of the CloudWatch Log Group created for the VPC flow logs. |
 |  [igw\_arn](#output\_igw\_arn) | The ARN of the Internet Gateway |
 |  [igw\_id](#output\_igw\_id) | The ID of the Internet Gateway |
 |  [intra\_network\_acl\_arn](#output\_intra\_network\_acl\_arn) | ARN of the intra network ACL |
---
examples/vpc-flow-logs/main.tf
@@ -7,6 +7,7 @@ locals {

   s3_bucket_name            = "vpc-flow-logs-to-s3-${random_pet.this.id}"
   cloudwatch_log_group_name = "vpc-flow-logs-to-cloudwatch-${random_pet.this.id}"
+  cloudwatch_flow_log_group_name = "${module.vpc_with_flow_logs_cloudwatch_logs_default.flow_log_log_group_name_prefix}${module.vpc_with_flow_logs_cloudwatch_logs_default.vpc_id}"
 }

 ################################################################################
@@ -99,6 +100,22 @@ resource "random_pet" "this" {
   length = 2
 }

+resource "aws_cloudwatch_log_metric_filter" "flow_log_reject" {
+  name           = "Flow-Log-Reject"
+  pattern        = "REJECT"
+  log_group_name = local.cloudwatch_flow_log_group_name
+
+ = metric_transformation {
+    name      = "REJECT"
+    namespace = "FLOW_LOG"
+    value     = "1"
+  }
+
+   depends_on = [
+    module.vpc_with_flow_logs_cloudwatch_logs_default
+  ]
+}
+
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
---
outputs.tf
@@ -534,6 +534,11 @@ output "vpc_flow_log_cloudwatch_iam_role_arn" {
   value       = local.flow_log_iam_role_arn
 }

+output "flow_log_log_group_name_prefix" {
+  description = "The name prefix of the CloudWatch Log Group created for the VPC flow logs."
+  value       = var.flow_log_cloudwatch_log_group_name_prefix
+}
+
 # Static values (arguments)
 output "azs" {
   description = "A list of availability zones specified as argument to this module"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
If you specify Name key in vpc tags, then Name key of vpc tags is overriding Name key of cgw

## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -1155,9 +1155,9 @@ resource "aws_customer_gateway" "this" {
  "${var.name}-${each.key}" type        = "ipsec.1"

   tags = merge(
-    { Name = "${var.name}-${each.key}" },
     var.tags,
     var.customer_gateway_tags,
+  { Name = "${var.name}-${each.key}" },
   )
 }

---

---

Choice B:
main.tf
@@ -1155,9 +1155,9 @@ resource "aws_customer_gateway" "this" {
   type        = "ipsec.1"

   tags = merge(
-    { Name = "${var.name}-${each.key}" },
     var.tags,
     var.customer_gateway_tags,
+  { Name = "${var.name}-${each.key}" },
   )
 }

---

---

Choice C:
main.tf
@@ -1155,9 +1155,9 @@ resource "aws_customer_gateway" "this" {
   type        = "ipsec.1"

   tags = merge(
-    { Name = "${var.name}-${each.key}" },
     var.tags,
     var.customer_gateway_tags,
+  { Name = "${var.name}-${each.key}" },
   )
 }

---

---

Choice D:
main.tf
@@ -1155,9 +1155,9 @@ resource "aws_customer_gateway" "this" {
   type        = "ipsec.1"

   tags = merge(
-    { Name = "${var.name}-${each.key}" },
     var.tags,
     var.customer_gateway_tags,
+  { Name = "${var.name}-${each.key}" },
   )
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:

## Description
This change is to allow for create to work within each vpc endpoint object. If the create is outside of a vpc endpoint then that will take priorty over the specific vpc endpoints create.

## Motivation and Context
This will make the script alot more flexible and fine grain. As you can go down to object level to specify which objects should be created or not. Making a lot more use cases possible.

## Breaking Changes
The only thing that was introduced that would be debtable is try but it seems try has been there for a long time so seem like it is backwards compatible.

## How Has This Been Tested?
Yes I have an example project which I tested this on. I tested with multiple use cases to make sure.
This change will also default create to true with object level vpc endpoints just like it has been. Meaning create is still optional for object level and resource level create.

---

Choice A:
examples/complete-vpc/main.tf
@@ -121,6 +121,7 @@ module "vpc_endpoints" {
       subnet_ids          = module.vpc.private_subnets
     },
  "vpc-flow-logs-s3-bucket"
@@   ecs_telemetry = {
+      create              = false
       service             = "ecs-telemetry"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
---
examples/vpc-flow-logs/README.md
@@ -24,21 +24,21 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.63 |
-|  [random](#requirement\_random) | >= 2 |
+|  [aws](#requirement\_aws) | >= 3.75 |
+|  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.63 |
-|  [random](#provider\_random) | >= 2 |
+|  [aws](#provider\_aws) | >= 3.75 |
+|  [random](#provider\_random) | >= 2.0 |

 ## Modules

 | Name | Source | Version |
 |------|--------|---------|
-|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 1.0 |
+|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs\_default](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs\_default) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_s3\_bucket](#module\_vpc\_with\_flow\_logs\_s3\_bucket) | ../../ | n/a |
---
examples/vpc-flow-logs/main.tf
@@ -24,7 +24,7 @@ module "vpc_with_flow_logs_s3_bucket" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn

   vpc_flow_log_tags = {
     Name = "vpc-flow-logs-s3-bucket"
@@ -42,7 +42,7 @@ module "vpc_with_flow_logs_s3_bucket_parquet" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn
   flow_log_file_format      = "parquet"

   vpc_flow_log_tags = {
@@ -102,7 +102,7 @@ resource "random_pet" "this" {
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "~> 1.0"
+  version = "~> 3.0"

   bucket        = local.s3_bucket_name
   policy        = data.aws_iam_policy_document.flow_log_s3.json
---
examples/vpc-flow-logs/versions.tf
@@ -4,12 +4,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.63"
+      version = ">= 3.75"
     }

     random = {
       source  = "hashicorp/random"
-      version = ">= 2"
+      version = ">= 2.0"
     }
   }
 }
---
modules/vpc-endpoints/main.tf
@@ -15,7 +15,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -121,6 +121,7 @@ module "vpc_endpoints" {
       subnet_ids          = module.vpc.private_subnets
     },
     ecs_telemetry = {
+      create              = false
       service             = "ecs-telemetry"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
---
examples/vpc-flow-logs/README.md
@@ -24,21 +24,21 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.63 |
-|  [random](#requirement\_random) | >= 2 |
+|  [aws](#requirement\_aws) | >= 3.75 |
+|  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.63 |
-|  [random](#provider\_random) | >= 2 |
+|  [aws](#provider\_aws) | >= 3.75 |
+|  [random](#provider\_random) | >= 2.0 |

 ## Modules

 | Name | Source | Version |
 |------|--------|---------|
-|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 1.0 |
+|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs\_default](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs\_default) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_s3\_bucket](#module\_vpc\_with\_flow\_logs\_s3\_bucket) | ../../ | n/a |
---
examples/vpc-flow-logs/main.tf
@@ -24,7 +24,7 @@ module "vpc_with_flow_logs_s3_bucket" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn

   vpc_flow_log_tags = {
     Name = "vpc-flow-logs-s3-bucket"
@@ -42,7 +42,7 @@ module "vpc_with_flow_logs_s3_bucket_parquet" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn
   flow_log_file_format      = "parquet"

   vpc_flow_log_tags = {
@@ -102,7 +102,7 @@ resource "random_pet" "this" {
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "~> 1.0"
+  version = "~> 3.0"

   bucket        = local.s3_bucket_name
   policy        = data.aws_iam_policy_document.flow_log_s3.json
---
examples/vpc-flow-logs/versions.tf
@@ -4,12 +4,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.63"
+      version = ">= 3.75"
     }

     random = {
       source  = "hashicorp/random"
-      version = ">= 2"
+      version = ">= 2.0"
     }
   }
 }
---
modules/vpc-endpoints/main.tf
@@ -15,7 +15,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -121,6 +121,7 @@ module "vpc_endpoints" {
       subnet_ids          = module.vpc.private_subnets
     },
     ecs_telemetry = {
+      create              = false
       service             = "ecs-telemetry"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
---
examples/vpc-flow-logs/README.md
@@ -24,21 +24,21 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.63 |
-|  [random](#requirement\_random) | >= 2 |
+|  [aws](#requirement\_aws) | >= 3.75 |
+|  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.63 |
-|  [random](#provider\_random) | >= 2 |
+|  [aws](#provider\_aws) | >= 3.75 |
+|  [random](#provider\_random) | >= 2.0 |

 ## Modules

 | Name | Source | Version |
 |------|--------|---------|
-|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 1.0 |
+|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs\_default](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs\_default) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_s3\_bucket](#module\_vpc\_with\_flow\_logs\_s3\_bucket) | ../../ | n/a |
---
examples/vpc-flow-logs/main.tf
@@ -24,7 +24,7 @@ module "vpc_with_flow_logs_s3_bucket" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn |
-| = module.s3_bucket.s3_bucket_arn

   vpc_flow_log_tags = {
     Name = "vpc-flow-logs-s3-bucket"
@@ -42,7 +42,7 @@ module "vpc_with_flow_logs_s3_bucket_parquet" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn
   flow_log_file_format      = "parquet"

   vpc_flow_log_tags = {
@@ -102,7 +102,7 @@ resource "random_pet" "this" {
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "~> 1.0"
+  version = "~> 3.0"

   bucket        = local.s3_bucket_name
   policy        = data.aws_iam_policy_document.flow_log_s3.json
---
examples/vpc-flow-logs/versions.tf
@@ -4,12 +4,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.63"
+      version = ">= 3.75"
     }

     random = {
       source  = "hashicorp/random"
-      version = ">= 2"
+      version = ">= 2.0"
     }
   }
 }
---
modules/vpc-endpoints/main.tf
@@ -15,7 +15,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -121,6 +121,7 @@ module "vpc_endpoints" {
       subnet_ids          = module.vpc.private_subnets
     },
     ecs_telemetry = {
+      create              = false
       service             = "ecs-telemetry"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
---
examples/vpc-flow-logs/README.md
@@ -24,21 +24,21 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 0.13.1 |
-|  [aws](#requirement\_aws) | >= 3.63 |
-|  [random](#requirement\_random) | >= 2 |
+|  [aws](#requirement\_aws) | >= 3.75 |
+|  [random](#requirement\_random) | >= 2.0 |

 ## Providers

 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | >= 3.63 |
-|  [random](#provider\_random) | >= 2 |
+|  [aws](#provider\_aws) | >= 3.75 |
+|  [random](#provider\_random) | >= 2.0 |

 ## Modules

 | Name | Source | Version |
 |------|--------|---------|
-|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 1.0 |
+|  [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_cloudwatch\_logs\_default](#module\_vpc\_with\_flow\_logs\_cloudwatch\_logs\_default) | ../../ | n/a |
 |  [vpc\_with\_flow\_logs\_s3\_bucket](#module\_vpc\_with\_flow\_logs\_s3\_bucket) | ../../ | n/a |
---
examples/vpc-flow-logs/main.tf
@@ -24,7 +24,7 @@ module "vpc_with_flow_logs_s3_bucket" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn

   vpc_flow_log_tags = {
     Name = "vpc-flow-logs-s3-bucket"
@@ -42,7 +42,7 @@ module "vpc_with_flow_logs_s3_bucket_parquet" {

   enable_flow_log           = true
   flow_log_destination_type = "s3"
-  flow_log_destination_arn  = module.s3_bucket.this_s3_bucket_arn
+  flow_log_destination_arn  = module.s3_bucket.s3_bucket_arn
   flow_log_file_format      = "parquet"

   vpc_flow_log_tags = {
@@ -102,7 +102,7 @@ resource "random_pet" "this" {
 # S3 Bucket
 module "s3_bucket" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "~> 1.0"
+  version = "~> 3.0"

   bucket        = local.s3_bucket_name
   policy        = data.aws_iam_policy_document.flow_log_s3.json
---
examples/vpc-flow-logs/versions.tf
@@ -4,12 +4,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.63"
+      version = ">= 3.75"
     }

     random = {
       source  = "hashicorp/random"
-      version = ">= 2"
+      version = ">= 2.0"
     }
   }
 }
---
modules/vpc-endpoints/main.tf
@@ -15,7 +15,7 @@ data "aws_vpc_endpoint_service" "this" {
 }

 resource "aws_vpc_endpoint" "this" {
-  for_each = { for k, v in var.endpoints : k => v if var.create }
+  for_each = { for k, v in var.endpoints : k => v if var.create && try(v.create, true) }

   vpc_id            = var.vpc_id
   service_name      = data.aws_vpc_endpoint_service.this[each.key].service_name
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
examples/simple-vpc/main.tf
@@ -11,7 +11,7 @@ locals name ################################################################################

 module "vpc" {
-  source = "../../"
+  source = "https://github.com/terraform-aws-modules/terraform-aws-vpc"

   name = "simple-example"
   cidr = "10.0.0.0/16"
---

---

Choice B:
examples/simple-vpc/main.tf
@@ -11,7 +11,7 @@ locals {
 ################################################################################

 module "vpc" {
-  source = "../../"
+  source = "https://github.com/terraform-aws-modules/terraform-aws-vpc"

   name = "simple-example"
 "simple-example"
  cidr = "10.0.0.0/16"
---

---

Choice C:
examples/simple-vpc/main.tf
@@ -11,7 +11,7 @@ locals {
 ################################################################################

 module "vpc" {
-  source = "../../"
+  source = "https://github.com/terraform-aws-modules/terraform-aws-vpc"

   name = "simple-example"
   cidr = "10.0.0.0/16"
---

---

Choice D:
examples/simple-vpc/main.tf
@@ -11,7 +11,7 @@ locals {

 module "vpc" {
-  source = "../../"
+  source = "https://github.com/terraform-aws-modules/terraform-aws-vpc"

   name = "simple-example"
   cidr = "10.0.0.0/16"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Updated `examples/complete-vpc/main.tf` to allow HTTPS from VPC to ssmmessages and ec2messages endpoints

## Motivation and Context

Enabling endpoints exactly as described in `examples/complete-vpc/main.tf` breaks SSM communication.

As per

- https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html
- https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-vpc-endpoints/

HTTPS (port 443) outbound traffic to the following endpoints must be allowed

   ssm.region.amazonaws.com
   ssmmessages.region.amazonaws.com
   ec2messages.region.amazonaws.com

## Breaking Changes
N.A.

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
examples/complete-vpc/main.tf
@@ -109,6 +109,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -135,6 +136,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = @@       service             = "ecr.api"
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -109,6 +109,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -135,6 +136,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -109,6 +109,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -135,6 +136,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -109,6 +109,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -135,6 +136,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
main.tf
@@ -4,6 +4,7 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(var.outpost_subnets),
   )
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

@@ -311,6 +312,22 @@ resource "aws_route_table" "redshift" {
   )
 }

+################################################################################
+# Outposts routes
+################################################################################
+
+resource "aws_route_table" "outpost" {
+  count = var.create_vpc && var.create_outpost_subnet_route_table && length(var.outpost_subnets) > 0 ? 1 : 0
+
+  vpc_id = local.vpc_id
+
+  tags = merge(
+    { "Name" = "${var.name}-${var.outpost_subnet_suffix}" },
+    var.tags,
+    var.outpost_route_table_tags,
+  )
+}
+
 ################################################################################
 # Elasticache routes
 ################################################################################
@@ -1076,11 +1093,8 @@ resource "aws_route_table_association" "private" {
 resource "aws_route_table_association" "outpost" {
   count = var.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

-  subnet_id = element(aws_subnet.outpost[*].id, count.index)
-  route_table_id = element(
-    aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
-  )
+  subnet_id      = element(aws_subnet.outpost[*].id, count.index)
+  route_table_id = element(aws_route_table.outpost[*].id, 0)
 }

 resource "aws_route_table_association" "database" {
---
outputs.tf
@@ -238,6 +238,11 @@ output "public_route_table_ids" {
   value   bool
@@    = aws_route_table.public[*].id
 }

+output "outpost_route_table_ids" {
+  description = "List of IDs of outpost route tables"
+  value       = aws_route_table.outpost[*].id
+}
+
 output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = aws_route_table.private[*].id
---
variables.tf
@@ -214,6 +214,12 @@ variable "create_database_subnet_route_table" {
   default     = false
 }

+variable "create_outpost_subnet_route_table" {
+  description = "Controls if separate route table for outpost should be created"
+  type        = bool
+  default     = false
+}
+
 variable "create_redshift_subnet_route_table" {
   description = "Controls if separate route table for redshift should be created"
   type        = bool
@@ -478,6 +484,12 @@ variable "redshift_route_table_tags" {
   default     = {}
 }

+variable "outpost_route_table_tags" {
+  description = "Additional tags for the outpost route tables"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_route_table_tags" {
   description = "Additional tags for the elasticache route tables"
   type        = map(string)
---

---

Choice B:
main.tf
@@ -4,6 +4,7 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(var.outpost_subnets),
   )
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

@@ -311,6 +312,22 @@ resource "aws_route_table" "redshift" {
   )
 }

+################################################################################
+# Outposts routes
+################################################################################
+
+resource "aws_route_table" "outpost" {
+  count = var.create_vpc && var.create_outpost_subnet_route_table && length(var.outpost_subnets) > 0 ? 1 : 0
+
+  vpc_id = local.vpc_id
+
+  tags = merge(
+    { "Name" = "${var.name}-${var.outpost_subnet_suffix}" },
+    var.tags,
+    var.outpost_route_table_tags,
+  )
+}
+
 ################################################################################
 # Elasticache routes
 ################################################################################
@@ -1076,11 +1093,8 @@ resource "aws_route_table_association" "private" {
 resource "aws_route_table_association" "outpost" {
   count = var.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

-  subnet_id = element(aws_subnet.outpost[*].id, count.index)
-  route_table_id = element(
-   "Additional aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
-  )
+  subnet_id      = element(aws_subnet.outpost[*].id, count.index)
+  route_table_id = element(aws_route_table.outpost[*].id, 0)
 }

 resource "aws_route_table_association" "database" {
---
outputs.tf
@@ -238,6 +238,11 @@ output "public_route_table_ids" {
   value       = aws_route_table.public[*].id
 }

+output "outpost_route_table_ids" {
+  description = "List of IDs of outpost route tables"
+  value       = aws_route_table.outpost[*].id
+}
+
 output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = aws_route_table.private[*].id
---
variables.tf
@@ -214,6 +214,12 @@ variable "create_database_subnet_route_table" {
   default     = false
 }

+variable "create_outpost_subnet_route_table" {
+  description = "Controls if separate route table for outpost should be created"
+  type        = bool
+  default     = false
+}
+
 variable "create_redshift_subnet_route_table" {
   description = "Controls if separate route table for redshift should be created"
   type        = bool
@@ -478,6 +484,12 @@ variable "redshift_route_table_tags" {
   default     = {}
 }

+variable "outpost_route_table_tags" {
+  description = "Additional tags for the outpost route tables"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_route_table_tags" {
   description = "Additional tags for the elasticache route tables"
   type        = map(string)
---

---

Choice C:
main.tf
@@ -4,6 +4,7 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(var.outpost_subnets),
   )
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

@@ -311,6 +312,22 @@ resource "aws_route_table" "redshift" {
   )
 }

+################################################################################
+# Outposts routes
+################################################################################
+
+resource "aws_route_table" "outpost" {
+  count = var.create_vpc && var.create_outpost_subnet_route_table && length(var.outpost_subnets) > 0 ? 1 : 0
+
+  vpc_id = local.vpc_id
+
+  tags = merge(
+    { "Name" = "${var.name}-${var.outpost_subnet_suffix}" },
+    var.tags,
+    var.outpost_route_table_tags,
+  )
+}
+
 ################################################################################
 # Elasticache routes
 ################################################################################
@@ -1076,11 +1093,8 @@ resource "aws_route_table_association" "private" {
 resource "aws_route_table_association" "outpost" {
   count = var.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

-  subnet_id = element(aws_subnet.outpost[*].id, count.index)
-  route_table_id = element(
-    aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
-  )
+  subnet_id      = element(aws_subnet.outpost[*].id, count.index)
+  route_table_id = element(aws_route_table.outpost[*].id, 0)
 }

 resource "aws_route_table_association" "database" {
---
outputs.tf
@@ -238,6 +238,11 @@ output "public_route_table_ids" {
   value       = aws_route_table.public[*].id
 }

+output "outpost_route_table_ids" {
+  description = "List of IDs of outpost route tables"
+  value       = aws_route_table.outpost[*].id
+}
+
 output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = aws_route_table.private[*].id
---
variables.tf
@@ -214,6 +214,12 @@ variable "create_database_subnet_route_table" {
   default     = false
 }

+variable "create_outpost_subnet_route_table" {
+  description = "Controls if separate route table for outpost should be created"
+  type        = bool
+  default     = false
+}
+
 variable "create_redshift_subnet_route_table" {
   description = "Controls if separate route table for redshift should be created"
   type        = bool
@@ -478,6 +484,12 @@ variable "redshift_route_table_tags" {
   default     = {}
 }

+variable "outpost_route_table_tags" {
+  description = "Additional tags for the outpost route tables"
+  type        = map(string)
+  default     = {}
+}
+
 variable "elasticache_route_table_tags" {
   description = "Additional tags for the elasticache route tables"
   type        = map(string)
---

---

Choice D:
main.tf
@@ -4,6 +4,7 @@ locals {
     length(var.elasticache_subnets),
     length(var.database_subnets),
     length(var.redshift_subnets),
+    length(var.outpost_subnets),
   )
   nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

@@ -311,6 +312,22 @@ resource "aws_route_table" "redshift" {
   )
 }

+################################################################################
+# Outposts routes
+################################################################################
+
+resource "aws_route_table" "outpost" {
+  count = var.create_vpc && var.create_outpost_subnet_route_table && length(var.outpost_subnets) > 0 ? 1 : 0
+
+  vpc_id = local.vpc_id
+
+  tags = merge(
+    { "Name" = "${var.name}-${var.outpost_subnet_suffix}" },
+    var.tags,
+    var.outpost_route_table_tags,
+  )
+}
+
 ################################################################################
 # Elasticache routes
 ################################################################################
@@ -1076,11 +1093,8 @@ resource "aws_route_table_association" "private" {
 resource "aws_route_table_association" "outpost" {
   count = var.create_vpc && length(var.outpost_subnets) > 0 ? length(var.outpost_subnets) : 0

-  subnet_id = element(aws_subnet.outpost[*].id, count.index)
-  route_table_id = element(
-    aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
-  )
+  subnet_id      = element(aws_subnet.outpost[*].id, count.index)
+  route_table_id = element(aws_route_table.outpost[*].id, 0)
 }

 resource "aws_route_table_association" "database" {
---
outputs.tf
@@ -238,6 +238,11 @@ output "public_route_table_ids" {
   value       = aws_route_table.public[*].id
 }

+output "outpost_route_table_ids" {
+  description = "List of IDs of outpost route tables"
+  value       = aws_route_table.outpost[*].id
+}
+
 output "private_route_table_ids" {
   description = "List of IDs of private route tables"
   value       = aws_route_table.private[*].id
---
variables.tf
@@ -214,6 +214,12 @@ variable "create_database_subnet_route_table" {
   default     = false
 }

+variable "create_outpost_subnet_route_table" {
+  description = "Controls if separate route table for outpost should be created"
+  type        = bool
+  default     = false
+}
+
 variable "create_redshift_subnet_route_table" {
   description = "Controls if separate route table for redshift should be created"
   type        = bool
@@ -478,6 +484,12 @@ variable "redshift_route_table_tags" {
   default     = {}
 }

+variable "outpost_route_table_tags" {
+  description = "Additional tags for the outpost route tables"
+  type        = map(string)
+  default     =  variable "elasticache_route_table_tags" {
   description = "Additional tags for the elasticache route tables"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows Vpc to have a nat gateway even with no private subnets

## Motivation and Context
Error with below nat_gateway configs:

private_subnet "NOT SET"

enable_nat_gateway = true
single_nat_gateway = true
one_nat_gateway_per_az = false

│ Error: Error in function call
│
│ on .terraform/modules/openvpn_vpc/main.tf line 905, in resource "aws_route" "private_nat_gateway":
│ 905: route_table_id = element(aws_route_table.private.*.id, count.index)
│ ├────────────────
│ │ aws_route_table.private is empty tuple
│ │ count.index is 0
│
│ Call to function "element" failed: cannot use element function with an empty list.

## Breaking Changes
None

## How Has This Been Tested?
terraform apply with mentioned configs is running

---

Choice A:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway  local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice B:
main.tf
@@ -1040,7 +1040,7 : resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice C:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice D:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" 0 {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows Vpc to have a nate gateway even with no private subnets

## Motivation and Context
Error with below nat_gateway configs with no private subnet

  enable_nat_gateway = true
  single_nat_gateway = true
  one_nat_gateway_per_az = false

│ Error: Error in function call
│
│   on .terraform/modules/openvpn_vpc/main.tf line 905, in resource "aws_route" "private_nat_gateway":
│  905:   route_table_id         = element(aws_route_table.private.*.id, count.index)
│     ├────────────────
│     │ aws_route_table.private is empty tuple
│     │ count.index is 0
│
│ Call to function "element" failed: cannot use element function with an empty list.

## Breaking Changes
None

## How Has This Been Tested?
terraform apply with mentioned configs is running

---

Choice A:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice B:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 count local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice C:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway main.tf
@@ local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice D:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows Vpc to have a nate gateway even with no private subnets

## Motivation and Context
Error with below nat_gateway configs with no private subnet

  enable_nat_gateway = true
  single_nat_gateway = true
  one_nat_gateway_per_az = false

│ Error: Error in function call
│
│   on .terraform/modules/openvpn_vpc/main.tf line 905, in resource "aws_route" "private_nat_gateway":
│  905:   route_table_id         = element(aws_route_table.private.*.id, count.index)
│     ├────────────────
│     │ aws_route_table.private is empty tuple
│     │ count.index is 0
│
│ Call to function "element" failed: cannot use element function with an empty list.

## Breaking Changes
None

## How Has This Been Tested?
terraform apply with mentioned configs is running

---

Choice A:
main.tf
@@ -1040,7 +1040,7 @@  "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice B:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice C:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route"  {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---

Choice D:
main.tf
@@ -1040,7 +1040,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = var.create_vpc && var.enable_nat_gateway && length(var.private_subnets) > 0 ? local.nat_gateway_count : 0

   route_table_id   main.tf
@@      = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

When having a VPC with public and private subnets, there are cases where traffic from the private subnet that is destined for `0.0.0.0/0` does not need to go to the NAT Gateway but instead, it should be sent to another destination (e.g., transit gateway). And then only specific traffic that is destined for the internet (e.g., 8.8.8.8/32) should be sent to the NAT Gateway.

Therefore, this change adds a new conditional variable that enables us to pass a custom destination CIDR block for the NAT Gateway.

## Motivation and Context

When having a VPC with public and private subnets, there are cases where traffic from the private subnet that is destined for `0.0.0.0/0` does not need to go to the NAT Gateway but instead, it should be sent to another destination (e.g., transit gateway). And then only specific traffic that is destined for the internet (e.g., 8.8.8.8/32) should be sent to the NAT Gateway.

## Breaking Changes

No breaking changes were noticed.

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
README.md
@@ -410,6 +410,7 @@ No modules.
 |  [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | Should be false if you do not want to auto-assign public IP on launch | `bool` | `true` | no |
 |  [name](#input\_name) | Name to be used on all the resources as identifier | `string` | `""` | no |
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
+|  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route. | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
---
main.tf
@@ -1043,7 +1043,7 @@ resource "aws_route" "private_nat_gateway" {
   count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
+  destination_cidr_block = var.nat_gateway_destination_cidr_block
   nat_gateway_id         = element(aws_nat_gateway.this[*].id, count.index)

   timeouts {
---
variables.tf
@@ -298,6 +298,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_destination_cidr_block" {
+  description = "Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
---

---

Choice B:
README.md
@@ -410,6 +410,7 @@ No modules.
 |  [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | Should be false if you do not want to auto-assign public IP on launch | `bool` | `true` | no |
 |  [name](#input\_name) | Name to be used on all the resources as identifier | `string` | `""` | no |
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
+|  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route. | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
---
main.tf
@@ -1043,7 +1043,7 @@ resource "aws_route" "private_nat_gateway" {
   count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
+  destination_cidr_block = var.nat_gateway_destination_cidr_block
  to nat_gateway_id         = element(aws_nat_gateway.this[*].id, count.index)

   timeouts {
---
variables.tf
@@ -298,6 +298,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_destination_cidr_block" {
+  description = "Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
---

---

Choice C:
README.md
@@ -410,6 +410,7 @@ No modules.
 |  [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | Should be false if you do not want to auto-assign public IP on launch | `bool` | `true` | no |
 |  [name](#input\_name) | Name to be used on all the resources as identifier | `string` | `""` | no |
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
+|  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route. | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
---
main.tf
@@ -1043,7 +1043,7 @@ resource "aws_route" "private_nat_gateway" {
   count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
+  destination_cidr_block = var.nat_gateway_destination_cidr_block
   nat_gateway_id         = element(aws_nat_gateway.this[*].id, count.index)

   timeouts {
---
variables.tf
@@ -298,6 +298,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_destination_cidr_block" {
+  description = "Used to pass a custom destination route for private NAT Gateway. If not specified, | default 0.0.0.0/0 is used as a destination route."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
---

---

Choice D:
README.md
@@ -410,6 +410,7 @@ No modules.
 |  [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | Should be false if you do not want to auto-assign public IP on launch | `bool` | `true` | no |
 |  [name](#input\_name) | Name to be used on all the resources as identifier | `string` | `""` | no |
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
+|  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route. | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
---
main.tf
@@ -1043,7 +1043,7 @@ resource "aws_route" "private_nat_gateway" {
   count = var.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
-  destination_cidr_block = "0.0.0.0/0"
+  destination_cidr_block = var.nat_gateway_destination_cidr_block
   nat_gateway_id         = element(aws_nat_gateway.this[*].id, count.index)

   timeouts {
---
variables.tf
@@ -298,6 +298,12 @@ variable "enable_nat_gateway" {
   default     = false
 }

+variable "nat_gateway_destination_cidr_block" {
+  description = "Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a  route."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 variable "single_nat_gateway" {
   description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adds as outputs maps of AZ to subnet ID for each subnet type (private, public, database, etc)

## Motivation and Context
Having a mapping of which subnets were created in each AZ is useful e.g. when creating EKS node groups for each AZ with the terraform EKS module. This output would allow creation of per-az node groups with the AZ in the node group name.

## Breaking Changes
Does not break backward compatibility with anything, it is just a collection of new outputs.

## How Has This Been Tested?
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [ ] Verified that the output works with no subnets and also multiple subnets

---

Choice A:
outputs.tf
@@ -68,6 +68,11 @@ output "vpc_owner_id" {
   value       = try(aws_vpc.this[0].owner_id, "")
 }

+output "private_subnet_resources" {
+  description = "List of private subnet resources"
+  value       = aws_subnet.private
+}
+
 output "private_subnets" {
   description = "List of IDs of private subnets"
   value       = aws_subnet.private[*].id
@@ -88,6 +93,11 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private[*].ipv6_cidr_block
 }

+output "public_subnet_resources" {
+  description = "List of public subnet resources"
+  value       = aws_subnet.public
+}
+
 output "public_subnets" {
   description = "List of IDs of public subnets"
   value       = aws_subnet.public[*].id
@@ -108,6 +118,11 @@ output "public_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.public[*].ipv6_cidr_block
 }

+output "outpost_subnet_resources" {
+  description = "List of outpost subnet resources"
+  value       = aws_subnet.outpost
+}
+
 output "outpost_subnets" {
   description = "List of IDs of outpost subnets"
   value       = aws_subnet.outpost[*].id
@@ -128,6 +143,11 @@ output "outpost_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.outpost[*].ipv6_cidr_block
 }

+output "database_subnet_resources" {
+  description = "List of database subnet resources"
+  value       = aws_subnet.database
+}
+
 output "database_subnets" {
   description = "List of IDs of database subnets"
   value       = aws_subnet.database[*].id
@@ -158,6 +178,11 @@ output "database_subnet_group_name" {
   value       = try(aws_db_subnet_group.database[0].name, "")
 }

+output "redshift_subnet_resources" {
+  description = "List of redshift subnet resources"
+  value       = aws_subnet.redshift
+}
+
 output "redshift_subnets" {
   description = "List of IDs of redshift subnets"
   value       = aws_subnet.redshift[*].id
@@ -183,6 +208,11 @@ output "redshift_subnet_group" {
   value       = try(aws_redshift_subnet_group.redshift[0].id, "")
 }

+output "elasticache_subnet_resources" {
+  description = "List of elasticache subnet resources"
+  value       = aws_subnet.elasticache
+}
+
 output "elasticache_subnets" {
   description = "List of IDs of elasticache subnets"
   value       = aws_subnet.elasticache[*].id
@@ -203,6 +233,11 @@ output "elasticache_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.elasticache[*].ipv6_cidr_block
 }

+output "intra_subnet_resources" {
+  description = "List of intra subnet resources"
+  value       = aws_subnet.intra
+}
+
 output "intra_subnets" {
   description = "List of IDs of intra subnets"
   value       = aws_subnet.intra[*].id
---

---

Choice B:
outputs.tf
@@ -68,6 +68,11 @@ output "vpc_owner_id" {
   value       = try(aws_vpc.this[0].owner_id, "")
 }

+output "private_subnet_resources" {
+  description = "List of private subnet resources"
+  value       = aws_subnet.private
+}
+
 output "private_subnets" {
   description = "List of IDs of private subnets"
   value       = aws_subnet.private[*].id
@@ -88,6 +93,11 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private[*].ipv6_cidr_block

+output "public_subnet_resources" {
+  description = "List of public subnet resources"
+  value       = aws_subnet.public
+}
+
 output "public_subnets" {
   description = "List of IDs of public subnets"
   value       = aws_subnet.public[*].id
@@ -108,6 +118,11 @@ output "public_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.public[*].ipv6_cidr_block
 }

+output "outpost_subnet_resources" {
+  description = "List of outpost subnet resources"
+  value       = aws_subnet.outpost
+}
+
 output "outpost_subnets" {
   description = "List of IDs of outpost subnets"
   value       = aws_subnet.outpost[*].id
@@ -128,6 +143,11 @@ output "outpost_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.outpost[*].ipv6_cidr_block
 }

+output "database_subnet_resources" {
+  description = "List of database subnet resources"
+  value       = aws_subnet.database
+}
+
 output "database_subnets" {
   description = "List of IDs of database subnets"
   value       = aws_subnet.database[*].id
@@ -158,6 +178,11 @@ output "database_subnet_group_name" {
   value       = try(aws_db_subnet_group.database[0].name, "")
 }

+output "redshift_subnet_resources" {
+  description = "List of redshift subnet resources"
+  value       = aws_subnet.redshift
+}
+
 output "redshift_subnets" {
   description = "List of IDs of redshift subnets"
   value       = aws_subnet.redshift[*].id
@@ -183,6 +208,11 @@ output "redshift_subnet_group" {
   value       = try(aws_redshift_subnet_group.redshift[0].id, "")
 }

+output "elasticache_subnet_resources" {
+  description = "List of elasticache subnet resources"
+  value       = aws_subnet.elasticache
+}
+
 output "elasticache_subnets" {
   description = "List of IDs of elasticache subnets"
   value       = aws_subnet.elasticache[*].id
@@ -203,6 +233,11 @@ output "elasticache_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.elasticache[*].ipv6_cidr_block
 }

+output "intra_subnet_resources" {
+  description = "List of intra subnet resources"
+  value       = aws_subnet.intra
+}
+
 output "intra_subnets" {
   description = "List of IDs of intra subnets"
   value       = aws_subnet.intra[*].id
---

---

Choice C:
outputs.tf
@@ -68,6 +68,11 @@ output "vpc_owner_id" {
   value       = try(aws_vpc.this[0].owner_id, "")
 }

+output "private_subnet_resources" {
+  description = "List of private subnet resources"
+  value       = aws_subnet.private
+}
+
 output "private_subnets" {
   description = "List of IDs of private subnets"
   value       = aws_subnet.private[*].id
@@ -88,6 +93,11 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private[*].ipv6_cidr_block
 }

+output "public_subnet_resources" {
+  description = "List of public subnet resources"
+  value       = aws_subnet.public
+}
+
 output "public_subnets" {
   description = "List of IDs of public subnets"
   value       = aws_subnet.public[*].id
@@ -108,6 +118,11 @@ output "public_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.public[*].ipv6_cidr_block
 }

+output "outpost_subnet_resources" {
+  description = "List of outpost subnet resources"
+  value       = aws_subnet.outpost
+}
+
 output "outpost_subnets" {
   description = "List of IDs of outpost subnets"
   value       = aws_subnet.outpost[*].id
@@ -128,6 +143,11 @@ output "outpost_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.outpost[*].ipv6_cidr_block
 }

+output "database_subnet_resources" {
+  description = "List of database subnet resources"
+  value       = aws_subnet.database
+}
+
 output "database_subnets" {
   description = "List of IDs of database subnets"
   value       = aws_subnet.database[*].id
@@ -158,6 +178,11 @@ output "database_subnet_group_name" {
   value       = try(aws_db_subnet_group.database[0].name, "")
 }

+output "redshift_subnet_resources" {
+  description = "List of redshift subnet resources"
+  value       = aws_subnet.redshift
+}
+
 output "redshift_subnets" {
   description = "List of IDs of redshift subnets"
   value      description = aws_subnet.redshift[*].id
@@ -183,6 +208,11 @@ output "redshift_subnet_group" {
   value       = try(aws_redshift_subnet_group.redshift[0].id, "")
 }

+output "elasticache_subnet_resources" {
+  description = "List of elasticache subnet resources"
+  value       = aws_subnet.elasticache
+}
+
 output "elasticache_subnets" {
   description = "List of IDs of elasticache subnets"
   value       = aws_subnet.elasticache[*].id
@@ -203,6 +233,11 @@ output "elasticache_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.elasticache[*].ipv6_cidr_block
 }

+output "intra_subnet_resources" {
+  description = "List of intra subnet resources"
+  value       = aws_subnet.intra
+}
+
 output "intra_subnets" {
   description = "List of IDs of intra subnets"
   value       = aws_subnet.intra[*].id
---

---

Choice D:
outputs.tf
@@ -68,6 +68,11 @@ output "vpc_owner_id" {
   value       = try(aws_vpc.this[0].owner_id, "")
 }

+output "private_subnet_resources" {
+  description = "List of private subnet resources"
+  value       = aws_subnet.private
+}
+
 output "private_subnets" {
   description = "List of IDs of private subnets"
   value       = aws_subnet.private[*].id
@@ -88,6 +93,11 @@ output "private_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.private[*].ipv6_cidr_block
 }

+output "public_subnet_resources" {
+  description = "List of public subnet resources"
+  value       = aws_subnet.public
+}
+
 output "public_subnets" {
   description = "List of IDs of public subnets"
   value       = aws_subnet.public[*].id
@@ -108,6 +118,11 @@ output "public_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.public[*].ipv6_cidr_block
 }

+output "outpost_subnet_resources" {
+  description = "List of outpost subnet resources"
+  value       = aws_subnet.outpost
+}
+
 output "outpost_subnets" {
   description = "List of IDs of outpost subnets"
   value       = aws_subnet.outpost[*].id
@@ -128,6 +143,11 @@ output "outpost_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.outpost[*].ipv6_cidr_block
 }

+output "database_subnet_resources" {
+  description = "List of database subnet resources"
+  value       = aws_subnet.database
+}
+
 output "database_subnets" {
   description = "List of IDs of database subnets"
   value       = aws_subnet.database[*].id
@@ -158,6 +178,11 @@ output "database_subnet_group_name" {
   value       = try(aws_db_subnet_group.database[0].name, "")
 }

+output "redshift_subnet_resources" {
+  description = "List of redshift subnet resources"
+  value       = aws_subnet.redshift
+}
+
 output "redshift_subnets" {
   description = "List of IDs of redshift subnets"
   value       = aws_subnet.redshift[*].id
@@ +208,11 +208,11 @@ output "redshift_subnet_group" {
   value       = try(aws_redshift_subnet_group.redshift[0].id, "")
 }

+output "elasticache_subnet_resources" {
+  description = "List of elasticache subnet resources"
+  value       = aws_subnet.elasticache
+}
+
 output "elasticache_subnets" {
   description = "List of IDs of elasticache subnets"
   value       = aws_subnet.elasticache[*].id
@@ -203,6 +233,11 @@ output "elasticache_subnets_ipv6_cidr_blocks" {
   value       = aws_subnet.elasticache[*].ipv6_cidr_block
 }

+output "intra_subnet_resources" {
+  description = "List of intra subnet resources"
+  value       = aws_subnet.intra
+}
+
 output "intra_subnets" {
   description = "List of IDs of intra subnets"
   value       = aws_subnet.intra[*].id
---

---