Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Introduces 2 new variables `enable_private_subnet_tags` and `enable_public_subnet_tags`.

## Motivation and Context

https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1145

## Breaking Changes

These new variable are set to true by default so i assume it would not introduce any breaking change

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -111,17 +111,23 @@ resource "aws_subnet" "public" {
   private_dns_hostname_type_on_launch            = var.public_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.public_subnet_names[count.index],
-        format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_public_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.public_subnet_names[count.index],
+            format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.public_subnet_tags,
+        lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
 }

 locals {
@@ -246,17 +252,24 @@ resource "aws_subnet" "private" {
   private_dns_hostname_type_on_launch            = var.private_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.private_subnet_names[count.index],
-        format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_private_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.private_subnet_names[count.index],
+            format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.private_subnet_tags,
+        lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
+
 }

 # There are as many routing tables as the number of NAT gateways
---
variables.tf
@@ -178,6 +178,12 @@ variable "public_subnets" {
   default     = []
 }

+variable "enable_public_subnet_tags" {
+  description = "Indicates whether tags should be applied to public subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "public_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
@@ -318,6 +324,12 @@ variable "private_subnets" {
   default     = []
 }

+variable "enable_private_subnet_tags" {
+  description = "Indicates whether tags should be applied to private subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
---

---

Choice B:
main.tf
@@ -111,17 +111,23 @@ resource "aws_subnet" "public" {
   private_dns_hostname_type_on_launch            = var.public_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.public_subnet_names[count.index],
-        format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_public_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.public_subnet_names[count.index],
+            format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.public_subnet_tags,
+        lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
 }

 locals {
@@ -246,17 +252,24 @@ resource "aws_subnet" "private" {
   private_dns_hostname_type_on_launch            = var.private_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.private_subnet_names[count.index],
-        format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_private_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.private_subnet_names[count.index],
+            format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.private_subnet_tags,
+        lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
+
 }

 # There are as many routing tables as the number of NAT gateways
---
variables.tf
@@ -178,6 +178,12 @@ variable "public_subnets" {
   default     = []
 }

+variable "enable_public_subnet_tags" {
+  description = "Indicates whether tags should be applied to public subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "public_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
@@ -318,6 +324,12 @@ variable "private_subnets" {
   default     = []
 }

+variable "enable_private_subnet_tags" {
+  description = "Indicates whether tags should be applied to private subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
---

---

Choice C:
main.tf
@@ -111,17 +111,23 @@ resource "aws_subnet" "public" {
   private_dns_hostname_type_on_launch            = var.public_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.public_subnet_names[count.index],
-        format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_public_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.public_subnet_names[count.index],
+            format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.public_subnet_tags,
+        lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
 }

 locals {
@@ -246,17 +252,24 @@ resource "aws_subnet" "private" {
   private_dns_hostname_type_on_launch            = var.private_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.private_subnet_names[count.index],
-        format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_private_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.private_subnet_names[count.index],
+            format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.private_subnet_tags,
+        lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
+
 }

 # There are as many routing tables as the number of NAT gateways
---
variables.tf
@@ -178,6 +178,12 @@ variable "public_subnets" {
   default     = []
 }

+variable "enable_public_subnet_tags" {
+  description = "Indicates whether tags should be applied to public subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "public_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
@@ -318,6 +324,12 @@ variable "private_subnets" {
   default     = []
 }

+variable "enable_private_subnet_tags" {
+  description = "Indicates whether tags should be applied to private subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
---

---

Choice D:
main.tf
@@ -111,17 +111,23 @@ resource "aws_subnet" "public" {
   private_dns_hostname_type_on_launch            = var.public_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.public_subnet_names[count.index],
-        format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_public_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.public_subnet_names[count.index],
+            format("${var.name}-${var.public_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.public_subnet_tags,
+        lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
 }

 locals {
@@ -246,17 +252,24 @@ resource "aws_subnet" "private" {
   private_dns_hostname_type_on_launch            = var.private_subnet_private_dns_hostname_type_on_launch
   vpc_id                                         = local.vpc_id

-  tags = merge(
-    {
-      Name = try(
-        var.private_subnet_names[count.index],
-        format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+  dynamic "tags" {
+    for_each = var.enable_private_subnet_tags ? [1] : []
+    content {
+      tags = merge(
+        {
+          Name = try(
+            var.private_subnet_names[count.index],
+            format("${var.name}-${var.private_subnet_suffix}-%s", element(var.azs, count.index))
+          )
+        },
+        var.tags,
+        var.private_subnet_tags,
+        lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
       )
-    },
-    var.tags,
-    var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
-  )
+    }
+  }
+
+
 }

 # There are as many routing tables as the number of NAT gateways
---
variables.tf
@@ -178,6 +178,12 @@ variable "public_subnets" {
   default     = []
 }

+variable "enable_public_subnet_tags" {
+  description = "Indicates whether tags should be applied to public subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "public_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
@@ -318,6 +324,12 @@ variable "private_subnets" {
   default     = []
 }

+variable count.index))
+ {
+  description = "Indicates whether tags should be applied to private subnets. Default: `true`"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_assign_ipv6_address_on_creation" {
   description = "Specify true to indicate that network interfaces created in the specified subnet should be assigned an IPv6 address. Default is `false`"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adding `nat_gateway_tags_per_az` variable for NAT gateways

## Motivation and Context
It is useful for cost related reports to be able to tag NAT gateways per AZ.

## Breaking Changes
No

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -505,6 +505,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/simple/main.tf
@@ -32,4 +32,10 @@ module "vpc" {
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
+
+  nat_gateway_tags_per_az = {
+    for az in local.azs : az => {
+      Name = "NAT Gateway - ${az}"
+    }
+  }
 }
---
main.tf
@@ -1129,6 +1129,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -1252,6 +1252,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice B:
README.md
@@ -505,6 +505,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/simple/main.tf
@@ -32,4 +32,10 @@ module "vpc" {
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
+
+  nat_gateway_tags_per_az = {
+    for az in local.azs : az => {
+      Name = to Gateway - ${az}"
+    }
+  }
 }
---
main.tf
@@ -1129,6 +1129,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -1252,6 +1252,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice C:
README.md
@@ -505,6 +505,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the is of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/simple/main.tf
@@ -32,4 +32,10 @@ module "vpc" {
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
+
+  nat_gateway_tags_per_az = {
+    for az in local.azs : az => {
+      Name = "NAT Gateway - ${az}"
+    }
+  }
 }
---
main.tf
@@ -1129,6 +1129,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -1252,6 +1252,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---

Choice D:
README.md
@@ -505,6 +505,7 @@ No modules.
 |  [nat\_eip\_tags](#input\_nat\_eip\_tags) | Additional tags for the NAT EIP | `map(string)` | `{}` | no |
 |  [nat\_gateway\_destination\_cidr\_block](#input\_nat\_gateway\_destination\_cidr\_block) | Used to pass a custom destination route for private NAT Gateway. If not specified, the default 0.0.0.0/0 is used as a destination route | `string` | `"0.0.0.0/0"` | no |
 |  [nat\_gateway\_tags](#input\_nat\_gateway\_tags) | Additional tags for the NAT gateways | `map(string)` | `{}` | no |
+|  [nat\_gateway\_tags\_per\_az](#input\_nat\_gateway\_tags\_per\_az) | Additional tags for the NAT gateways where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [one\_nat\_gateway\_per\_az](#input\_one\_nat\_gateway\_per\_az) | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or the to the number of availability zones specified in `var.azs` | `bool` | `false` | no |
 |  [outpost\_acl\_tags](#input\_outpost\_acl\_tags) | Additional tags for the outpost subnets network ACL | `map(string)` | `{}` | no |
 |  [outpost\_arn](#input\_outpost\_arn) | ARN of Outpost you want to create a subnet in | `string` | `null` | no |
---
examples/simple/main.tf
@@ -32,4 +32,10 @@ module "vpc" {
   private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
+
+  nat_gateway_tags_per_az = {
+    for az in local.azs : az => {
+      Name = "NAT Gateway - ${az}"
+    }
+  }
 }
---
main.tf
@@ -1129,6 +1129,7 @@ resource "aws_nat_gateway" "this" {
     },
     var.tags,
     var.nat_gateway_tags,
+    lookup(var.nat_gateway_tags_per_az, element(var.azs, count.index), {})
   )

   depends_on = [aws_internet_gateway.this]
---
variables.tf
@@ -1252,6 +1252,12 @@ variable "nat_gateway_tags" {
   default     = {}
 }

+variable "nat_gateway_tags_per_az" {
+  description = "Additional tags for the NAT gateways where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "nat_eip_tags" {
   description = "Additional tags for the NAT EIP"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

This commit updates the module to support defining subnet tags per subnet name, in addition to per AZ.

## Motivation and context

Reasoning behind this is to allow for specific tags to be applied to different public/private subnets.
E.g.
```terraform
  private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
  private_subnet_tags_per_name = {
    "Private Subnet One" = {
      "subnet one" = "true"
    },
    "Private Subnet Two" = {
      "subnet two" = "true"
    }
  }
```

Fixes #1129

---

Choice A:
README.md
@@ -539,6 +539,7 @@ No modules.
 |  [private\_subnet\_suffix](#input\_private\_subnet\_suffix) | Suffix to append to private subnets name | `string` | `"private"` | no |
 |  [private\_subnet\_tags](#input\_private\_subnet\_tags) | Additional tags for the private subnets | `map(string)` | `{}` | no |
 |  [private\_subnet\_tags\_per\_az](#input\_private\_subnet\_tags\_per\_az) | Additional tags for the private subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [private\_subnet\_tags\_per\_name](#input\_private\_subnet\_tags\_per\_name) | Additional tags for the private subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [private\_subnets](#input\_private\_subnets) | A list of private subnets inside the VPC | `list(string)` | `[]` | no |
 |  [propagate\_intra\_route\_tables\_vgw](#input\_propagate\_intra\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
 |  [propagate\_private\_route\_tables\_vgw](#input\_propagate\_private\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
@@ -559,6 +560,7 @@ No modules.
 |  [public\_subnet\_suffix](#input\_public\_subnet\_suffix) | Suffix to append to public subnets name | `string` | `"public"` | no |
 |  [public\_subnet\_tags](#input\_public\_subnet\_tags) | Additional tags for the public subnets | `map(string)` | `{}` | no |
 |  [public\_subnet\_tags\_per\_az](#input\_public\_subnet\_tags\_per\_az) | Additional tags for the public subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [public\_subnet\_tags\_per\_name](#input\_public\_subnet\_tags\_per\_name) | Additional tags for the public subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [public\_subnets](#input\_public\_subnets) | A list of public subnets inside the VPC | `list(string)` | `[]` | no |
 |  [putin\_khuylo](#input\_putin\_khuylo) | [public\_subnet\_tags](#input\_public\_subnet\_tags) you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
---
examples/complete/main.tf
@@ -37,6 +37,14 @@ module "vpc" {
   intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
+  private_subnet_tags_per_name = {
+    "Private Subnet One" = {
+      "subnet one" = "true"
+    },
+    "Private Subnet Two" = {
+      "subnet two" = "true"
+    }
+  }
   # public_subnet_names omitted to show default name generation for all three subnets
   database_subnet_names    = ["DB Subnet One"]
   elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
---
main.tf
@@ -150,7 +150,8 @@ resource "aws_subnet" "public" {
     },
     var.tags,
     var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.public_subnet_tags_per_name, try(var.public_subnet_names[count.index], ""), {})
   )
 }

@@ -285,7 +286,8 @@ resource "aws_subnet" "private" {
     },
     var.tags,
     var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.private_subnet_tags_per_name, try(var.private_subnet_names[count.index], ""), {})
   )
 }

---
variables.tf
@@ -268,6 +268,12 @@ variable "public_subnet_tags_per_az" {
   default     = {}
 }

+variable "public_subnet_tags_per_name" {
+  description = "Additional tags for the public subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "public_route_table_tags" {
   description = "Additional tags for the public route tables"
   type        = map(string)
@@ -402,6 +408,12 @@ variable "private_subnet_tags_per_az" {
   default     = {}
 }

+variable "private_subnet_tags_per_name" {
+  description = "Additional tags for the private subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "private_route_table_tags" {
   description = "Additional tags for the private route tables"
   type        = map(string)
---

---

Choice B:
README.md
@@ -539,6 +539,7 @@ No modules.
 |  [private\_subnet\_suffix](#input\_private\_subnet\_suffix) | Suffix to append to private subnets name | `string` | `"private"` | no |
 |  [private\_subnet\_tags](#input\_private\_subnet\_tags) | Additional tags for the private subnets | `map(string)` | `{}` | no |
 |  [private\_subnet\_tags\_per\_az](#input\_private\_subnet\_tags\_per\_az) | Additional tags for the private subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [private\_subnet\_tags\_per\_name](#input\_private\_subnet\_tags\_per\_name) | Additional tags for the private subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [private\_subnets](#input\_private\_subnets) | A list of private subnets inside the VPC | `list(string)` | `[]` | no |
 |  [propagate\_intra\_route\_tables\_vgw](#input\_propagate\_intra\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
 |  [propagate\_private\_route\_tables\_vgw](#input\_propagate\_private\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
@@ -559,6 +560,7 @@ No modules.
 |  [public\_subnet\_suffix](#input\_public\_subnet\_suffix) | Suffix to append to public subnets name | `string` | `"public"` | no |
 |  [public\_subnet\_tags](#input\_public\_subnet\_tags) | Additional tags for the public subnets | `map(string)` | `{}` | no |
 |  [public\_subnet\_tags\_per\_az](#input\_public\_subnet\_tags\_per\_az) | Additional tags for the public subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [public\_subnet\_tags\_per\_name](#input\_public\_subnet\_tags\_per\_name) | Additional tags for the public subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [public\_subnets](#input\_public\_subnets) | A list of public subnets inside the VPC | `list(string)` | `[]` | no |
 |  [putin\_khuylo](#input\_putin\_khuylo) | Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
---
examples/complete/main.tf
@@ -37,6 +37,14 @@ module "vpc" {
   intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
+  private_subnet_tags_per_name = {
+    "Private Subnet One" = {
+      "subnet one" = "true"
+    },
+    "Private Subnet Two" = {
+      "subnet two" = "true"
+    }
+  }
   # public_subnet_names omitted to show default name generation for all three subnets
   database_subnet_names    = ["DB Subnet One"]
   elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
---
main.tf
@@ -150,7 +150,8 @@ resource "aws_subnet" "public" {
     },
     var.tags,
     var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.public_subnet_tags_per_name, try(var.public_subnet_names[count.index], ""), {})
   )
 }

@@ -285,7 +286,8 @@ resource "aws_subnet" "private" {
     },
     var.tags,
     var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.private_subnet_tags_per_name, try(var.private_subnet_names[count.index], ""), {})
   )
 }

---
variables.tf
@@ -268,6 +268,12 @@ variable "public_subnet_tags_per_az" {
   default     = {}
 }

+variable "public_subnet_tags_per_name" {
+  description = "Additional tags for the public subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "public_route_table_tags" {
   description = "Additional tags for the public route tables"
   type        = map(string)
@@ -402,6 +408,12 @@ variable "private_subnet_tags_per_az" {
   default     = {}
 }

+variable "private_subnet_tags_per_name" {
+  description = "Additional tags for the private subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "private_route_table_tags" {
   description = "Additional tags for the private route tables"
   type        = map(string)
---

---

Choice C:
README.md
@@ -539,6 +539,7 @@ No modules.
 |  [private\_subnet\_suffix](#input\_private\_subnet\_suffix) | Suffix to append to private subnets name | `string` | `"private"` | no |
 |  [private\_subnet\_tags](#input\_private\_subnet\_tags) | Additional tags for the private subnets | `map(string)` | `{}` | no |
 |  [private\_subnet\_tags\_per\_az](#input\_private\_subnet\_tags\_per\_az) | Additional tags for the private subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [private\_subnet\_tags\_per\_name](#input\_private\_subnet\_tags\_per\_name) | Additional tags for the private subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [private\_subnets](#input\_private\_subnets) | A list of private subnets inside the VPC | `list(string)` | `[]` | no |
 |  [propagate\_intra\_route\_tables\_vgw](#input\_propagate\_intra\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
 |  [propagate\_private\_route\_tables\_vgw](#input\_propagate\_private\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
@@ -559,6 +560,7 @@ No modules.
 |  [public\_subnet\_suffix](#input\_public\_subnet\_suffix) | Suffix to append to public subnets name | `string` | `"public"` | no |
 |  [public\_subnet\_tags](#input\_public\_subnet\_tags) | Additional tags for the public subnets | `map(string)` | `{}` | no |
 |  [public\_subnet\_tags\_per\_az](#input\_public\_subnet\_tags\_per\_az) | Additional tags for the public subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [public\_subnet\_tags\_per\_name](#input\_public\_subnet\_tags\_per\_name) | Additional tags for the public subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [public\_subnets](#input\_public\_subnets) | A list of public subnets inside the VPC | `list(string)` | `[]` | no |
 |  [putin\_khuylo](#input\_putin\_khuylo) | Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
---
examples/complete/main.tf
@@ -37,6 +37,14 @@ module "vpc" {
   intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
+  private_subnet_tags_per_name = {
+    "Private Subnet One" = {
+      "subnet one" = "true"
+    },
+    "Private Subnet Two" = {
+      "subnet two" = "true"
+    }
+  }
   # public_subnet_names omitted to show default name generation for all three subnets
   database_subnet_names    = ["DB Subnet One"]
   elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
---
main.tf
@@ -150,7 +150,8 @@ resource "aws_subnet" "public" {
     },
     var.tags,
     var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.public_subnet_tags_per_name, try(var.public_subnet_names[count.index], ""), {})
   )
 }

@@ -285,7 +286,8 @@ resource "aws_subnet" "private" {
     },
     var.tags,
     var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.private_subnet_tags_per_name, try(var.private_subnet_names[count.index], ""), {})
 the  )
 }

---
variables.tf
@@ -268,6 +268,12 @@ variable "public_subnet_tags_per_az" {
   default     = {}
 }

+variable "public_subnet_tags_per_name" {
+  description = "Additional tags for the public subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "public_route_table_tags" {
   description = "Additional tags for the public route tables"
   type        = map(string)
@@ -402,6 +408,12 @@ variable "private_subnet_tags_per_az" {
   default     = {}
 }

+variable "private_subnet_tags_per_name" {
+  description = "Additional tags for the private subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "private_route_table_tags" {
   description = "Additional tags for the private route tables"
   type        = map(string)
---

---

Choice D:
README.md
@@ -539,6 +539,7 @@ No modules.
 |  [private\_subnet\_suffix](#input\_private\_subnet\_suffix) | Suffix to append to private subnets name | `string` | `"private"` | no |
 |  [private\_subnet\_tags](#input\_private\_subnet\_tags) | Additional tags for the private subnets | `map(string)` | `{}` | no |
 |  [private\_subnet\_tags\_per\_az](#input\_private\_subnet\_tags\_per\_az) | Additional tags for the private subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [private\_subnet\_tags\_per\_name](#input\_private\_subnet\_tags\_per\_name) | Additional tags for the private subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 =  [private\_subnets](#input\_private\_subnets) | A list of private subnets inside the VPC | `list(string)` | `[]` | no |
 |  [propagate\_intra\_route\_tables\_vgw](#input\_propagate\_intra\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
 |  [propagate\_private\_route\_tables\_vgw](#input\_propagate\_private\_route\_tables\_vgw) | Should be true if you want route table propagation | `bool` | `false` | no |
@@ -559,6 +560,7 @@ No modules.
 |  [public\_subnet\_suffix](#input\_public\_subnet\_suffix) | Suffix to append to public subnets name | `string` | `"public"` | no |
 |  [public\_subnet\_tags](#input\_public\_subnet\_tags) | Additional tags for the public subnets | `map(string)` | `{}` | no |
 |  [public\_subnet\_tags\_per\_az](#input\_public\_subnet\_tags\_per\_az) | Additional tags for the public subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
+|  [public\_subnet\_tags\_per\_name](#input\_public\_subnet\_tags\_per\_name) | Additional tags for the public subnets where the primary key is the subnet name | `map(map(string))` | `{}` | no |
 |  [public\_subnets](#input\_public\_subnets) | A list of public subnets inside the VPC | `list(string)` | `[]` | no |
 |  [putin\_khuylo](#input\_putin\_khuylo) | Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no |
 |  [redshift\_acl\_tags](#input\_redshift\_acl\_tags) | Additional tags for the redshift subnets network ACL | `map(string)` | `{}` | no |
---
examples/complete/main.tf
@@ -37,6 +37,14 @@ module "vpc" {
   intra_subnets       = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 20)]

   private_subnet_names = ["Private Subnet One", "Private Subnet Two"]
+  private_subnet_tags_per_name = {
+    "Private Subnet One" = {
+      "subnet one" = "true"
+    },
+    "Private Subnet Two" = {
+      "subnet two" = "true"
+    }
+  }
   # public_subnet_names omitted to show default name generation for all three subnets
   database_subnet_names    = ["DB Subnet One"]
   elasticache_subnet_names = ["Elasticache Subnet One", "Elasticache Subnet Two"]
---
main.tf
@@ -150,7 +150,8 @@ resource "aws_subnet" "public" {
     },
     var.tags,
     var.public_subnet_tags,
-    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.public_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.public_subnet_tags_per_name, try(var.public_subnet_names[count.index], ""), {})
   )
 }

@@ -285,7 +286,8 @@ resource "aws_subnet" "private" {
     },
     var.tags,
     var.private_subnet_tags,
-    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {})
+    lookup(var.private_subnet_tags_per_az, element(var.azs, count.index), {}),
+    lookup(var.private_subnet_tags_per_name, try(var.private_subnet_names[count.index], ""), {})
   )
 }

---
variables.tf
@@ -268,6 +268,12 @@ variable "public_subnet_tags_per_az" {
   default     = {}
 }

+variable "public_subnet_tags_per_name" {
+  description = "Additional tags for the public subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "public_route_table_tags" {
   description = "Additional tags for the public route tables"
   type        = map(string)
@@ -402,6 +408,12 @@ variable "private_subnet_tags_per_az" {
   default     = {}
 }

+variable "private_subnet_tags_per_name" {
+  description = "Additional tags for the private subnets where the primary key is the subnet name"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "private_route_table_tags" {
   description = "Additional tags for the private route tables"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allows modifications to the assume role policy of the flow log IAM role.

## Motivation and Context
The recommended action by AWS to prevent confused deputy attacks is to add sourceArn, sourceAccount or sourceOrg as conditions as condition to the role assumption. https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html

## Breaking Changes
Should not break anything, as the default variable is empty and will simply not render the dynamic block.

## How Has This Been Tested?
- [X] I have validated locally that the config is rendered correctly from terraform plan for both adding sourceAccount as condition and not adding conditions.
- [X] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -452,6 +452,7 @@ No modules.
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
 |  [external\_nat\_ips](#input\_external\_nat\_ips) | List of EIPs to be used for `nat_public_ips` output (used in combination with reuse\_nat\_ips and external\_nat\_ip\_ids) | `list(string)` | `[]` | no |
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `""` | no |
+|  [flow\_log\_cloudwatch\_iam\_role\_conditions](#input\_flow\_log\_cloudwatch\_iam\_role\_conditions) | Additional conditions of the CloudWatch role assumption policy |
list(object({
    test     = string
    variable = string
    values   = list(string)
  }))
 | `[]` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_class](#input\_flow\_log\_cloudwatch\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
---
variables.tf
@@ -1597,6 +1597,16 @@ variable "create_flow_log_cloudwatch_iam_role" {
   default     = false
 }

+variable "flow_log_cloudwatch_iam_role_conditions" {
+  description = "Additional conditions of the CloudWatch role assumption policy"
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = []
+}
+
 variable "flow_log_cloudwatch_iam_role_arn" {
   description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided"
   type        = string
---
vpc-flow-logs.tf
@@ -100,6 +100,15 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
     effect = "Allow"

     actions = ["sts:AssumeRole"]
+
+    dynamic "condition" {
+      for_each = var.flow_log_cloudwatch_iam_role_conditions
+      content {
+        test     = condition.value.test
+        variable = condition.value.variable
+        values   = condition.value.values
+      }
+    }
   }
 }

---

---

Choice B:
README.md
@@ -452,6 +452,7 @@ No modules.
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
 |  [external\_nat\_ips](#input\_external\_nat\_ips) | List of EIPs to be used for `nat_public_ips` output (used in combination with reuse\_nat\_ips and external\_nat\_ip\_ids) | `list(string)` | `[]` | no |
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `""` | no |
+|  [flow\_log\_cloudwatch\_iam\_role\_conditions](#input\_flow\_log\_cloudwatch\_iam\_role\_conditions) | Additional conditions of the CloudWatch role assumption policy |
list(object({
    test     = string
    variable = string
    values   = list(string)
  }))
 | `[]` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_class](#input\_flow\_log\_cloudwatch\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
---
variables.tf
@@ -1597,6 +1597,16 @@ variable "create_flow_log_cloudwatch_iam_role" {
   default     = false
 }

+variable "flow_log_cloudwatch_iam_role_conditions" {
+  description = "Additional conditions of the CloudWatch role assumption policy"
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = []
+}
+
 variable "flow_log_cloudwatch_iam_role_arn" {
   description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided"
   type        = string
---
vpc-flow-logs.tf
@@ -100,6 +100,15 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
     effect = "Allow"

    of actions = ["sts:AssumeRole"]
+
+    dynamic "condition" {
+      for_each = var.flow_log_cloudwatch_iam_role_conditions
+      content {
+        test     = condition.value.test
+        variable = condition.value.variable
+        values   = condition.value.values
+      }
+    }
   }
 }

---

---

Choice C:
README.md
@@ -452,6 +452,7 @@ No modules.
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
 |  [external\_nat\_ips](#input\_external\_nat\_ips) | List of EIPs to be used for `nat_public_ips` output (used in combination with reuse\_nat\_ips and external\_nat\_ip\_ids) | `list(string)` | `[]` | no |
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `""` | no |
+|  [flow\_log\_cloudwatch\_iam\_role\_conditions](#input\_flow\_log\_cloudwatch\_iam\_role\_conditions) | Additional conditions of the CloudWatch role assumption policy |
list(object({
    test     = string
    variable = string
    values   = list(string)
  }))
 | `[]` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_class](#input\_flow\_log\_cloudwatch\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | group. ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
---
variables.tf
@@ -1597,6 +1597,16 @@ variable "create_flow_log_cloudwatch_iam_role" {
   default     = false
 }

+variable "flow_log_cloudwatch_iam_role_conditions" {
+  description = "Additional conditions of the CloudWatch role assumption policy"
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = []
+}
+
 variable "flow_log_cloudwatch_iam_role_arn" {
   description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided"
   type        = string
---
vpc-flow-logs.tf
@@ -100,6 +100,15 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
     effect = "Allow"

     actions = ["sts:AssumeRole"]
+
+    dynamic "condition" {
+      for_each = var.flow_log_cloudwatch_iam_role_conditions
+      content {
+        test     = condition.value.test
+        variable = condition.value.variable
+        values   = condition.value.values
+      }
+    }
   }
 }

---

---

Choice D:
README.md
@@ -452,6 +452,7 @@ No modules.
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
 |  [external\_nat\_ips](#input\_external\_nat\_ips) | List of EIPs to be used for `nat_public_ips` output (used in combination with reuse\_nat\_ips and external\_nat\_ip\_ids) | `list(string)` | `[]` | no |
 |  [flow\_log\_cloudwatch\_iam\_role\_arn](#input\_flow\_log\_cloudwatch\_iam\_role\_arn) | The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow\_log\_destination\_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided | `string` | `""` | no |
+|  [flow\_log\_cloudwatch\_iam\_role\_conditions](#input\_flow\_log\_cloudwatch\_iam\_role\_conditions) | Additional conditions of the CloudWatch role assumption policy |
list(object({
    test     = string
    | = string
    values   = list(string)
  }))
 | `[]` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_class](#input\_flow\_log\_cloudwatch\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_kms\_key\_id](#input\_flow\_log\_cloudwatch\_log\_group\_kms\_key\_id) | The ARN of the KMS Key to use when encrypting log data for VPC flow logs | `string` | `null` | no |
 |  [flow\_log\_cloudwatch\_log\_group\_name\_prefix](#input\_flow\_log\_cloudwatch\_log\_group\_name\_prefix) | Specifies the name prefix of CloudWatch Log Group for VPC flow logs | `string` | `"/aws/vpc-flow-log/"` | no |
---
variables.tf
@@ -1597,6 +1597,16 @@ variable "create_flow_log_cloudwatch_iam_role" {
   default     = false
 }

+variable "flow_log_cloudwatch_iam_role_conditions" {
+  description = "Additional conditions of the CloudWatch role assumption policy"
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = []
+}
+
 variable "flow_log_cloudwatch_iam_role_arn" {
   description = "The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group. When flow_log_destination_arn is set to ARN of Cloudwatch Logs, this argument needs to be provided"
   type        = string
---
vpc-flow-logs.tf
@@ -100,6 +100,15 @@ data "aws_iam_policy_document" "flow_log_cloudwatch_assume_role" {
     effect = "Allow"

     actions = ["sts:AssumeRole"]
+
+    dynamic "condition" {
+      for_each = var.flow_log_cloudwatch_iam_role_conditions
+      content {
+        test     = condition.value.test
+        variable = condition.value.variable
+        values   = condition.value.values
+      }
+    }
   }
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This update introduces a new variable, `create_private_nat_gateway_route`, to control the creation of NAT Gateway routes for private subnets. By making the creation of the `aws_route.private_nat_gateway` resource conditional, we provide users the flexibility to manage routes more precisely according to their specific requirements.

**Key Changes:**
- **New Variable** - `create_private_nat_gateway_route` (Boolean)
  - When set to `true`(default): NAT Gateway routes for private subnets are created automatically.
  - When set to `false`: NAT Gateway routes are not created, allowing users to define routes manually.
- **Resource Modification** - The `aws_route.private_nat_gateway` resource now checks the value of `create_private_nat_gateway_route` before creating routes.
- **Use Case**
  - Users can deploy NAT Gateways without setting automatic routes. This is particularly beneficial when a different routing strategy is in place, such as using a Transit Gateway for the default `0.0.0.0/0` route while assigning NAT Gateway routes only for specific destinations.

**Example Use Case:**
- If a Transit Gateway is used for the default `0.0.0.0/0` route and NAT Gateways are desired only for specific CIDR blocks, setting `create_private_nat_gateway_route` to `false` will prevent automatic route creation, giving full manual control over route configurations.

## Motivation and Context
The change is required to provide greater flexibility and control over the infrastructure setup. Previously, creating a NAT Gateway would always result in the automatic creation of routes, which limited configuration options for complex setups. By introducing this conditional variable, users can decide whether or not to create NAT Gateway routes, making the module more adaptable to different networking requirements.
This enhancement addresses scenarios where automatic route creation is not desirable or conflicts with specific routing strategies.
- https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/978

## Breaking Changes

No, this change does not break backward compatibility. The default behavior remains unchanged unless the `create_private_nat_gateway_route` variable is explicitly set to `false`.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s).
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects.
  - I deployed an example project with and without the `create_private_nat_gateway_route` variable set to ensure correct behavior.
  - Verified that the NAT Gateway routes are only deleted when the variable is disabled.
- [x] I have executed `pre-commit run -a` on my pull request to ensure code quality and compliance with standards.

---

Choice A:
README.md
@@ -374,6 +374,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1102,7 +1102,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -372,6 +372,12 nat variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a nat gateway route should be created to give internet access to the private subnets"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice B:
README.md
@@ -374,6 +374,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls  VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1102,7 +1102,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -372,6 +372,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a nat gateway route should be created to give internet access to the private subnets"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice C:
README.md
@@ -374,6 +374,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be created | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1102,7 +1102,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -372,6 +372,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a nat gateway route should be created to give internet access to the private subnets"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---

Choice D:
README.md
@@ -374,6 +374,7 @@ No modules.
 |  [create\_igw](#input\_create\_igw) | Controls if an Internet Gateway is created for public subnets and the related routes that connect them | `bool` | `true` | no |
 |  [create\_multiple\_intra\_route\_tables](#input\_create\_multiple\_intra\_route\_tables) | Indicates whether to create a separate route table for each intra subnet. Default: `false` | `bool` | `false` | no |
 |  [create\_multiple\_public\_route\_tables](#input\_create\_multiple\_public\_route\_tables) | Indicates whether to create a separate route table for each public subnet. Default: `false` | `bool` | `false` | no |
+|  [create\_private\_nat\_gateway\_route](#input\_create\_private\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the private subnets | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_group](#input\_create\_redshift\_subnet\_group) | Controls if redshift subnet group should be created | `bool` | `true` | no |
 |  [create\_redshift\_subnet\_route\_table](#input\_create\_redshift\_subnet\_route\_table) | Controls if separate route table for redshift should be `true` | `bool` | `false` | no |
 |  [create\_vpc](#input\_create\_vpc) | Controls if VPC should be created (it affects almost all resources) | `bool` | `true` | no |
---
main.tf
@@ -1102,7 +1102,7 @@ resource "aws_nat_gateway" "this" {
 }

 resource "aws_route" "private_nat_gateway" {
-  count = local.create_vpc && var.enable_nat_gateway ? local.nat_gateway_count : 0
+  count = local.create_vpc && var.enable_nat_gateway && var.create_private_nat_gateway_route ? local.nat_gateway_count : 0

   route_table_id         = element(aws_route_table.private[*].id, count.index)
   destination_cidr_block = var.nat_gateway_destination_cidr_block
---
variables.tf
@@ -372,6 +372,12 @@ variable "private_subnet_suffix" {
   default     = "private"
 }

+variable "create_private_nat_gateway_route" {
+  description = "Controls if a nat gateway route should be created to give internet access to the private subnets"
+  type        = bool
+  default     = true
+}
+
 variable "private_subnet_tags" {
   description = "Additional tags for the private subnets"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
 Add `enable_public_igw_route flag` to optionally create public route tables to internet gateway

## Motivation and Context
It can be desirable to have both an internet gateway and want to alter the default routes for public subnets through either using vpc endpoints (gwlb) or transit gateways. Offering this simple flag offers flexibility and enables someone to output the public route table ids and add any routes they want, rather than prescribing to specific use cases.

This cant be inside the VPC module because the endpoints are created outside of it and use the private subnets so it would create a circular dependency. By adding `enable_public_igw_route flag`. it allows someone to alter these routes if wanted.

Example (pseudo)

```hcl
resource "aws_route" "public_vpce_route" {
  for_each                       = aws_vpc_endpoint.gwlb
  route_table_id              = local.public_rtbl_to_subnet_id_map[each.key]
  destination_cidr_block = "0.0.0.0/0"
  vpc_endpoint_id           = each.value.id
}
```

## Breaking Changes

This is fully backwards compatible and does not introduce any breaking changes.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [X] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -447,6 +447,7 @@ No modules.
 |  [enable\_ipv6](#input\_enable\_ipv6) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block | `bool` | `false` | no |
 |  [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `false` | no |
 |  [enable\_network\_address\_usage\_metrics](#input\_enable\_network\_address\_usage\_metrics) | Determines whether network address usage metrics are enabled for the VPC | `bool` description `null` | no |
+|  [enable\_public\_igw\_route](#input\_enable\_public\_igw\_route) | Controls if public route tables should have route to internet gateway. | `bool` | `true` | no |
 |  [enable\_public\_redshift](#input\_enable\_public\_redshift) | Controls if redshift should have public routing table | `bool` | `false` | no |
 |  [enable\_vpn\_gateway](#input\_enable\_vpn\_gateway) | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
---
main.tf
@@ -153,7 +153,7 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
@@ -165,7 +165,7 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
---
variables.tf
@@ -262,6 +262,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "enable_public_igw_route" {
+  description = "Controls if public route tables should have route to internet gateway."
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice B:
README.md
@@ -447,6 +447,7 @@ No modules.
 |  [enable\_ipv6](#input\_enable\_ipv6) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block | `bool` | `false` | no |
 |  [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `false` | no |
 |  [enable\_network\_address\_usage\_metrics](#input\_enable\_network\_address\_usage\_metrics) | Determines whether network address usage metrics are enabled for the VPC | `bool` | `null` | no |
+|  [enable\_public\_igw\_route](#input\_enable\_public\_igw\_route) | Controls if public route tables should have route to internet gateway. | `bool` | `true` | no |
 |  [enable\_public\_redshift](#input\_enable\_public\_redshift) | Controls if redshift should have public routing table | `bool` | `false`  no |
 |  [enable\_vpn\_gateway](#input\_enable\_vpn\_gateway) | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
---
main.tf
@@ -153,7 +153,7 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
@@ -165,7 +165,7 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
---
variables.tf
@@ -262,6 +262,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "enable_public_igw_route" {
+  description = "Controls if public route tables should have route to internet gateway."
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice C:
README.md
@@ -447,6 +447,7 @@ No modules.
 |  [enable\_ipv6](#input\_enable\_ipv6) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block | `bool` | `false` | no |
 |  [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `false` | no |
 |  [enable\_network\_address\_usage\_metrics](#input\_enable\_network\_address\_usage\_metrics) | Determines whether network address usage metrics are enabled for the VPC | `bool` | `null` | no |
+|  [enable\_public\_igw\_route](#input\_enable\_public\_igw\_route) | Controls if public route tables should have route to internet gateway. | `bool` | `true` | no |
 |  [enable\_public\_redshift](#input\_enable\_public\_redshift) | Controls if redshift should have public routing table | `bool` | `false` | no |
 |  [enable\_vpn\_gateway](#input\_enable\_vpn\_gateway) | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
---
main.tf
@@ -153,7 +153,7 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
@@ -165,7 +165,7 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
---
variables.tf
@@ -262,6 +262,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "enable_public_igw_route" {
+  description = "Controls if public route tables should have route to internet gateway."
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---

Choice D:
README.md
@@ -447,6 +447,7 @@ No modules.
 |  [enable\_ipv6](#input\_enable\_ipv6) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block | `bool` | `false` | no |
 |  [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | Should be true if you want to provision NAT Gateways for each of your private networks | `bool` | `false` | no |
 |  [enable\_network\_address\_usage\_metrics](#input\_enable\_network\_address\_usage\_metrics) | Determines whether network address usage metrics are enabled for the VPC | `bool` | `null` | no |
+|  [enable\_public\_igw\_route](#input\_enable\_public\_igw\_route) | Controls if public route tables should have route to internet gateway. | `bool` | `true` | no |
 |  [enable\_public\_redshift](#input\_enable\_public\_redshift) | Controls if redshift should have public routing table | `bool` | `false` | no |
 |  [enable\_vpn\_gateway](#input\_enable\_vpn\_gateway) | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | `bool` | `false` | no |
 |  [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
---
main.tf
@@ -153,7 +153,7 @@ resource "aws_route_table_association" "public" {
 }

 resource "aws_route" "public_internet_gateway" {
-  count = local.create_public_subnets && var.create_igw ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_public_igw_route ? local.num_public_route_tables : 0

 [enable\_network\_address\_usage\_metrics](#input\_enable\_network\_address\_usage\_metrics)  route_table_id         = aws_route_table.public[count.index].id
   destination_cidr_block = "0.0.0.0/0"
@@ -165,7 +165,7 @@ resource "aws_route" "public_internet_gateway" {
 }

 resource "aws_route" "public_internet_gateway_ipv6" {
-  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 ? local.num_public_route_tables : 0
+  count = local.create_public_subnets && var.create_igw && var.enable_ipv6 && var.enable_public_igw_route ? local.num_public_route_tables : 0

   route_table_id              = aws_route_table.public[count.index].id
   destination_ipv6_cidr_block = "::/0"
---
variables.tf
@@ -262,6 +262,12 @@ variable "public_route_table_tags" {
   default     = {}
 }

+variable "enable_public_igw_route" {
+  description = "Controls if public route tables should have route to internet gateway."
+  type        = bool
+  default     = true
+}
+
 ################################################################################
 # Public Network ACLs
 ################################################################################
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
When generating the flow log group ARNs to include in the policy, if we are using a pre-existing log group, take that into account and use the destination ARN passed in as a variable, rather than assuming that we created a log group ourselves.

## Motivation and Context
Since 5.12.0, if you are using an existing CloudWatch Log Group for your flow logs destination ARN, this module tries to update the relevant IAM policy with an invalid policy document, which fails. See PR https://github.com/terraform-aws-modules/terraform-aws-vpc/pull/1088.

This fixes https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/1117

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
I have tested this in our own workspaces using a fork of this module -- I am happy to go further with the examples here if needed/desired.
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
vpc-flow-logs.tf
@@ -17,16 +17,22 @@ locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log

-  create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
-  create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  create_flow_log_cloudwatch_iam_role        = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
+  create_flow_log_cloudwatch_log_group       = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  use_existing_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type == "cloud-watch-logs" && !var.create_flow_log_cloudwatch_log_group

   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
-  flow_log_group_arns = [
-    for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
-  ]
+  flow_log_group_arns = compact(
+    concat(
+      [
+         log_group in aws_cloudwatch_log_group.flow_log :
+        "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+      ],
+      local.use_existing_flow_log_cloudwatch_log_group ? [var.flow_log_destination_arn] : []
+    )
+  )
 }

 ################################################################################
---

---

Choice B:
vpc-flow-logs.tf
@@ -17,16 +17,22 @@ locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log

-  create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
-  create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  create_flow_log_cloudwatch_iam_role        = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
+  create_flow_log_cloudwatch_log_group       = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  use_existing_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type == "cloud-watch-logs" && !var.create_flow_log_cloudwatch_log_group

   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
-  flow_log_group_arns = [
-    for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
-  ]
+  flow_log_group_arns = compact(
+    concat(
+      [
+        for log_group in aws_cloudwatch_log_group.flow_log :
+        "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+      ],
+      local.use_existing_flow_log_cloudwatch_log_group ? [var.flow_log_destination_arn] : []
+    )
+  )
 }

 ################################################################################
---

---

Choice C:
vpc-flow-logs.tf
@@ -17,16 +17,22 @@ locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log

-  create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
-  create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  create_flow_log_cloudwatch_iam_role        = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
+  create_flow_log_cloudwatch_log_group       = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  use_existing_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type == "cloud-watch-logs" && !var.create_flow_log_cloudwatch_log_group

   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && != ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
-  flow_log_group_arns = [
-    for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
-  ]
+  flow_log_group_arns = compact(
+    concat(
+      [
+        for log_group in aws_cloudwatch_log_group.flow_log :
+        "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+      ],
+      local.use_existing_flow_log_cloudwatch_log_group ? [var.flow_log_destination_arn] : []
+    )
+  )
 }

 ################################################################################
---

---

Choice D:
vpc-flow-logs.tf
@@ -17,16 +17,22 @@ locals {
   # Only create flow log if user selected to create a VPC as well
   enable_flow_log = var.create_vpc && var.enable_flow_log

-  create_flow_log_cloudwatch_iam_role  = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
-  create_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_log_group
+  create_flow_log_cloudwatch_iam_role        = local.enable_flow_log && var.flow_log_destination_type != "s3" && var.create_flow_log_cloudwatch_iam_role
+  create_flow_log_cloudwatch_log_group       = local.enable_flow_log && var.flow_log_destination_type != "s3" && local.enable_flow_log  use_existing_flow_log_cloudwatch_log_group = local.enable_flow_log && var.flow_log_destination_type == "cloud-watch-logs" && !var.create_flow_log_cloudwatch_log_group

   flow_log_destination_arn                  = local.create_flow_log_cloudwatch_log_group ? try(aws_cloudwatch_log_group.flow_log[0].arn, null) : var.flow_log_destination_arn
   flow_log_iam_role_arn                     = var.flow_log_destination_type != "s3" && local.create_flow_log_cloudwatch_iam_role ? try(aws_iam_role.vpc_flow_log_cloudwatch[0].arn, null) : var.flow_log_cloudwatch_iam_role_arn
   flow_log_cloudwatch_log_group_name_suffix = var.flow_log_cloudwatch_log_group_name_suffix == "" ? local.vpc_id : var.flow_log_cloudwatch_log_group_name_suffix
-  flow_log_group_arns = [
-    for log_group in aws_cloudwatch_log_group.flow_log :
-    "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
-  ]
+  flow_log_group_arns = compact(
+    concat(
+      [
+        for log_group in aws_cloudwatch_log_group.flow_log :
+        "arn:${data.aws_partition.current[0].partition}:logs:${data.aws_region.current[0].name}:${data.aws_caller_identity.current[0].account_id}:log-group:${log_group.name}:*"
+      ],
+      local.use_existing_flow_log_cloudwatch_log_group ? [var.flow_log_destination_arn] : []
+    )
+  )
 }

 ################################################################################
---

---