Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- Add missing private subnets to max subnet length local

## Motivation and Context
- Allows creating private only subnets

Error from current implementation:
![image](https://user-images.githubusercontent.com/10913471/230655727-e414ce5c-e6d3-46ca-9da0-2ce5f6fb634a.png)

## Breaking Changes
- No

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
examples/simple/main.tf
@@ -29,10 +29,7 @@ module "vpc" {
   cidr = local.vpc_cidr

   azs             = local.azs
-  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-
-  enable_nat_gateway = false
+  private_subnets  [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
 }
---
main.tf
@@ -8,7 +8,9 @@ locals {
   len_outpost_subnets     = max(length(var.outpost_subnets), length(var.outpost_subnet_ipv6_prefixes))

   max_subnet_length = max(
+    local.len_private_subnets,
     local.len_public_subnets,
+    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice B:
examples/simple/main.tf
@@ -29,10 +29,7 @@ module "vpc" {
   cidr = local.vpc_cidr

   azs             = local.azs
-  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-
-  enable_nat_gateway = false
+  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
 }
---
main.tf
@@ -8,7 +8,9 @@ locals {
   len_outpost_subnets     = max(length(var.outpost_subnets), length(var.outpost_subnet_ipv6_prefixes))

   max_subnet_length = max(
+    local.len_private_subnets,
     local.len_public_subnets,
+    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice C:
examples/simple/main.tf
@@ -29,10 +29,7 @@ module "vpc" {
   cidr = local.vpc_cidr

   azs             = local.azs
-  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-
-  enable_nat_gateway = false
+  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
 }
---
main.tf
@@ -8,7 +8,9 @@ locals {
   len_outpost_subnets     = max(length(var.outpost_subnets), length(var.outpost_subnet_ipv6_prefixes))

   max_subnet_length = max(
+    local.len_private_subnets,
     local.len_public_subnets,
+    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---

Choice D:
examples/simple/main.tf
@@ -29,10 +29,7 @@ module "vpc" {
   cidr = local.vpc_cidr

   azs             = local.azs
-  private_subnets =  k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
-  public_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 4)]
-
-  enable_nat_gateway = false
+  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]

   tags = local.tags
 }
---
main.tf
@@ -8,7 +8,9 @@ locals {
   len_outpost_subnets     = max(length(var.outpost_subnets), length(var.outpost_subnet_ipv6_prefixes))

   max_subnet_length = max(
+    local.len_private_subnets,
     local.len_public_subnets,
+    local.len_intra_subnets,
     local.len_elasticache_subnets,
     local.len_database_subnets,
     local.len_redshift_subnets,
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

## Motivation and Context

## Breaking Changes

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -390,6 +390,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs,  {})
   )
 }

---
variables.tf
@@ -530,6 +530,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "database_subnet_group_tags" {
   description = "Additional tags for the database subnet group"
   type        = map(string)
---

---

Choice B:
README.md
@@ -390,6 +390,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -530,6 +530,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "database_subnet_group_tags" {
   description = "Additional tags for the database subnet group"
   type        = map(string)
---

---

Choice C:
README.md
@@ -390,6 +390,7 @@ No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules  set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -530,6 +530,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "database_subnet_group_tags" {
   description = "Additional tags for the database subnet group"
   type        = map(string)
---

---

Choice D:
README.md
@@ -390,6 +390,7 = No modules.
 |  [database\_subnet\_private\_dns\_hostname\_type\_on\_launch](#input\_database\_subnet\_private\_dns\_hostname\_type\_on\_launch) | The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name` | `string` | `null` | no |
 |  [database\_subnet\_suffix](#input\_database\_subnet\_suffix) | Suffix to append to database subnets name | `string` | `"db"` | no |
 |  [database\_subnet\_tags](#input\_database\_subnet\_tags) | Additional tags for the database subnets | `map(string)` | `{}` | no |
+|  [database\_subnet\_tags\_per\_az](#input\_database\_subnet\_tags\_per\_az) | Additional tags for the database subnets where the primary key is the AZ | `map(map(string))` | `{}` | no |
 |  [database\_subnets](#input\_database\_subnets) | A list of database subnets inside the VPC | `list(string)` | `[]` | no |
 |  [default\_network\_acl\_egress](#input\_default\_network\_acl\_egress) | List of maps of egress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 |  [default\_network\_acl\_ingress](#input\_default\_network\_acl\_ingress) | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
---
main.tf
@@ -366,6 +366,7 @@ resource "aws_subnet" "database" {
     },
     var.tags,
     var.database_subnet_tags,
+    lookup(var.database_subnet_tags_per_az, element(var.azs, count.index), {})
   )
 }

---
variables.tf
@@ -530,6 +530,12 @@ variable "database_subnet_group_name" {
   default     = null
 }

+variable "database_subnet_tags_per_az" {
+  description = "Additional tags for the database subnets where the primary key is the AZ"
+  type        = map(map(string))
+  default     = {}
+}
+
 variable "database_subnet_group_tags" {
   description = "Additional tags for the database subnet group"
   type        = map(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This PR fixes a typo in the REAME file.
<!--- Describe your changes in detail -->

## Motivation and Context
Found a typo and think of fixing it.
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
No
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [x] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -85,7 +85,7 @@ If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, of
 ### One NAT Gateway per subnet (default)

-By default, the module will determine the number of NAT Gateways to create based on the the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:
+By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

 ```hcl
 database_subnets    = ["10.0.21.0/24", "10.0.22.0/24"]
---

---

Choice B:
README.md
@@ -85,7 +85,7 @@ If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, the

 ### One NAT Gateway per subnet (default)

-By default, the module will determine the number of NAT Gateways to create based on the the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:
+By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

 ```hcl
 database_subnets    = ["10.0.21.0/24", "10.0.22.0/24"]
---

---

Choice C:
README.md
@@ -85,7 +85,7 @@ If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, the

 ### One NAT Gateway per subnet (default)

-By default, the module are determine the number of NAT Gateways to create based on the the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:
+By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:

 ```hcl
 database_subnets    = ["10.0.21.0/24", "10.0.22.0/24"]
---

---

Choice D:
README.md
@@ -85,7 +85,7 @@ If both `single_nat_gateway` and `one_nat_gateway_per_az` are set to `true`, the

 ### One NAT Gateway per subnet (default)

-By default, the module will determine the number of NAT Gateways to create based on the the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks like the following:
+By default, the module will determine the number of NAT Gateways to create based on the `max()` of the private subnet lists (`database_subnets`, `elasticache_subnets`, `private_subnets`, and `redshift_subnets`). The module **does not** take into account the number of `intra_subnets`, since the latter are designed to have no Internet access via NAT Gateway. For example, if your configuration looks +85,7 the following:

 ```hcl
 database_subnets    = ["10.0.21.0/24", "10.0.22.0/24"]
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

This change allows users to call the module from their own module while passing `null` or an empty string (`""`) to this module for the `ipv6_ipam_pool_id` variable.

## Motivation and Context

We have our own wrapper module for VPCs that calls this module. We are using [Terragrunt](https://terragrunt.gruntwork.io/) to keep our code DRY.

In our `_envcommon` for VPCs, we have

```
locals {
  ...

   # Automatically load environment-level variables
  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))

  # Extract out common variables for reuse
  ipv6_ipam_pool_id = try(local.environment_vars.locals.vpc_ipv6_ipam_pool_id, null)
  use_ipam_pool       = local.ipv6_ipam_pool_id != null

  ...
}

inputs = {
  ...

  use_ipam_pool     = local.use_ipam_pool
  ipv6_ipam_pool_id = local.ipv6_ipam_pool_id

  ...
}
```

and we're getting the following error when `ipv6_ipam_pool_id` is `null`:

```
Error: Conflicting configuration arguments

  on .terraform/modules/vpc/main.tf line 27, in resource "aws_vpc" "this":
  27:   assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool  true : null

"assign_generated_ipv6_cidr_block": conflicts with ipv6_ipam_pool_id

Error: Conflicting configuration arguments

  on .terraform/modules/vpc/main.tf line 29, in resource "aws_vpc" "this":
  29:   ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id

"ipv6_ipam_pool_id": conflicts with assign_generated_ipv6_cidr_block

time=2023-03-22T18:46:38Z level=error msg=Terraform invocation failed in /tmp/274f71cb-cc98-48bf-bfe2-5b91e9064b0a/sase-preprod/us-west-2/sase-preprod/vpc/.terragrunt-cache/7bSSPeYRzQyBwlya0Kvd1mmg3ls/m48TkmguM93MPX0LUY4qqcafT_g prefix=[/tmp/274f71cb-cc98-48bf-bfe2-5b91e9064b0a/sase-preprod/us-west-2/sase-preprod/vpc]
time=2023-03-22T18:46:38Z level=error msg=1 error occurred:
	* exit status 1
```

This relates to https://github.com/hashicorp/terraform/issues/24142

So this is a fix for us (and others), which allows `null` or empty strings to be passed to this module.

## Breaking Changes

No, it works the same as before.

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
- [x] I have executed `pre-commit run -a` on my pull request

```
hnicholas7DYYW:ipv6 hnicholas$ pre-commit run
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed
```

---

Choice A:
README.md
@@ -356,7 +356,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN | `string` | `"64512"` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
-|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"10.0.0.0/16"` | no |
+|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `""` | no |
 |  [create\_database\_internet\_gateway\_route](#input\_create\_database\_internet\_gateway\_route) | Controls if an internet gateway route for public database access should be created | `bool` | `false` | no |
 |  [create\_database\_nat\_gateway\_route](#input\_create\_database\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the database subnets | `bool` | `false` | no |
 |  [create\_database\_subnet\_group](#input\_create\_database\_subnet\_group) | Controls if database subnet group should be created (n.b. database\_subnets must also be set) | `bool` | `true` | no |
@@ -477,8 +477,8 @@ No modules.
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
 |  [ipv6\_cidr](#input\_ipv6\_cidr) | (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length` | `string` | `null` | no |
 |  [ipv6\_cidr\_block\_network\_border\_group](#input\_ipv6\_cidr\_block\_network\_border\_group) | By default when an IPv6 CIDR is assigned to a VPC a default ipv6\_cidr\_block\_network\_border\_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones | `string` | `null` | no |
-|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `null` | no |
-|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `null` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `""` | no |
+|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `0` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `true` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `true` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |
---
main.tf
@@ -1,4 +1,6 @@
 locals {
+  default_cidr            = "10.0.0.0/16"
+  ipv6_netmask_length     = var.ipv6_netmask_length == 0 ? null : var.ipv6_netmask_length
   len_public_subnets      = max(length(var.public_subnets), length(var.public_subnet_ipv6_prefixes))
   len_private_subnets     = max(length(var.private_subnets), length(var.private_subnet_ipv6_prefixes))
   len_database_subnets    = max(length(var.database_subnets), length(var.database_subnet_ipv6_prefixes))
@@ -29,14 +31,17 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block = var.cidr != "" ? var.cidr : (
+    var.use_ipam_pool ? null : local.default_cidr
+  )
+
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

   assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
-  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
-  ipv6_netmask_length                  = var.ipv6_netmask_length
+  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id != "" ? var.ipv6_ipam_pool_id : null
+  ipv6_netmask_length                  = local.ipv6_netmask_length
   ipv6_cidr_block_network_border_group = var.ipv6_cidr_block_network_border_group

   instance_tenancy                     = var.instance_tenancy
---
variables.tf
@@ -17,7 +17,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "10.0.0.0/16"
+  default     = ""
 }

 variable "secondary_cidr_blocks" {
@@ -89,13 +89,13 @@ variable "ipv6_cidr" {
 variable "ipv6_ipam_pool_id" {
   description = "(Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`"
   type        = string
-  default     = null
+  default     = ""
 }

 variable "ipv6_netmask_length" {
   description = "(Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`"
   type        = number
-  default      null
+  default     = 0
 }

 variable "ipv6_cidr_block_network_border_group" {
---

---

Choice B:
README.md
@@ -356,7 +356,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN | `string` | `"64512"` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
-|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"10.0.0.0/16"` | no |
+|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `""` | no |
 |  [create\_database\_internet\_gateway\_route](#input\_create\_database\_internet\_gateway\_route) | Controls if an internet gateway route for public database access should be created | `bool` | `false` | no |
 |  [create\_database\_nat\_gateway\_route](#input\_create\_database\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the database subnets | `bool` | `false` | no |
 |  [create\_database\_subnet\_group](#input\_create\_database\_subnet\_group) | Controls if database subnet group should be created (n.b. database\_subnets must also be set) | `bool` | `true` | no |
@@ -477,8 +477,8 @@ No modules.
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
 |  [ipv6\_cidr](#input\_ipv6\_cidr) | (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length` | `string` | `null` | no |
 |  [ipv6\_cidr\_block\_network\_border\_group](#input\_ipv6\_cidr\_block\_network\_border\_group) | By default when an IPv6 CIDR is assigned to a VPC a default ipv6\_cidr\_block\_network\_border\_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones | `string` | `null` | no |
-|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `null` | no |
-|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `null` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `""` | no |
+|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `0` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `true` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `true` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |
---
main.tf
@@ -1,4 +1,6 @@
 locals {
+  default_cidr            = "10.0.0.0/16"
+  ipv6_netmask_length     = var.ipv6_netmask_length == 0 ? null : var.ipv6_netmask_length
   len_public_subnets      = max(length(var.public_subnets), length(var.public_subnet_ipv6_prefixes))
   len_private_subnets     = max(length(var.private_subnets), length(var.private_subnet_ipv6_prefixes))
   len_database_subnets    = max(length(var.database_subnets), length(var.database_subnet_ipv6_prefixes))
@@ -29,14 +31,17 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block = var.cidr != "" ? var.cidr : (
+    var.use_ipam_pool ? null : local.default_cidr
+  )
+
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

   assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool  true : null
   ipv6_cidr_block                      = var.ipv6_cidr
-  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
-  ipv6_netmask_length                  = var.ipv6_netmask_length
+  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id != "" ? var.ipv6_ipam_pool_id : null
+  ipv6_netmask_length                  = local.ipv6_netmask_length
   ipv6_cidr_block_network_border_group = var.ipv6_cidr_block_network_border_group

   instance_tenancy                     = var.instance_tenancy
---
variables.tf
@@ -17,7 +17,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "10.0.0.0/16"
+  default     = ""
 }

 variable "secondary_cidr_blocks" {
@@ -89,13 +89,13 @@ variable "ipv6_cidr" {
 variable "ipv6_ipam_pool_id" {
   description = "(Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`"
   type        = string
-  default     = null
+  default     = ""
 }

 variable "ipv6_netmask_length" {
   description = "(Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`"
   type        = number
-  default     = null
+  default     = 0
 }

 variable "ipv6_cidr_block_network_border_group" {
---

---

Choice C:
README.md
@@ -356,7 +356,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN | `string` | `"64512"` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
-|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"10.0.0.0/16"` | no |
+|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `""` | no |
 |  [create\_database\_internet\_gateway\_route](#input\_create\_database\_internet\_gateway\_route) | Controls if an internet gateway route for public database access should be created | `bool` | `false` | no |
 |  [create\_database\_nat\_gateway\_route](#input\_create\_database\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the database subnets | `bool` | `false` | no |
 |  [create\_database\_subnet\_group](#input\_create\_database\_subnet\_group) | Controls if database subnet group should be created (n.b. database\_subnets must also be set) | `bool` | `true` | no |
@@ -477,8 +477,8 @@ No modules.
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
 |  [ipv6\_cidr](#input\_ipv6\_cidr) | (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length` | `string` | `null` | no |
 |  [ipv6\_cidr\_block\_network\_border\_group](#input\_ipv6\_cidr\_block\_network\_border\_group) | By default when an IPv6 CIDR is assigned to a VPC a default ipv6\_cidr\_block\_network\_border\_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones | `string` | `null` | no |
-|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `null` | no |
-|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `null` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `""` | no |
+|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `0` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `true` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `true` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |
---
main.tf
@@ -1,4 +1,6 @@
 locals {
+  default_cidr            = "10.0.0.0/16"
+  ipv6_netmask_length     = var.ipv6_netmask_length == 0 ? null : var.ipv6_netmask_length
   len_public_subnets      = max(length(var.public_subnets), length(var.public_subnet_ipv6_prefixes))
   len_private_subnets     = max(length(var.private_subnets), length(var.private_subnet_ipv6_prefixes))
   len_database_subnets    = max(length(var.database_subnets), length(var.database_subnet_ipv6_prefixes))
@@ -29,14 +31,17 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block = var.cidr != "" ? var.cidr : (
+    var.use_ipam_pool ? null : local.default_cidr
+  )
+
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

   assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
-  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
-  ipv6_netmask_length                  = var.ipv6_netmask_length
+  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id != "" ? var.ipv6_ipam_pool_id : null
+  ipv6_netmask_length                  = local.ipv6_netmask_length
   ipv6_cidr_block_network_border_group = var.ipv6_cidr_block_network_border_group

   instance_tenancy                     = var.instance_tenancy
---
variables.tf
@@ -17,7 +17,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "10.0.0.0/16"
+  default     = ""
 }

 variable "secondary_cidr_blocks" {
@@ -89,13 +89,13 @@ variable "ipv6_cidr" {
 variable "ipv6_ipam_pool_id" {
   description = "(Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`"
   type        = string
-  default     = null
+  default     = ""
 }

 variable "ipv6_netmask_length" {
   description = "(Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`"
   type        = number
-  default     = null
+  default     = 0
 }

 variable "ipv6_cidr_block_network_border_group" {
---

---

Choice D:
README.md
@@ -356,7 +356,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN | `string` | `"64512"` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
-|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"10.0.0.0/16"` | no |
+|  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `""` | no |
 |  [create\_database\_internet\_gateway\_route](#input\_create\_database\_internet\_gateway\_route) | Controls if an internet gateway route for public database access should be created | `bool` | `false` | no |
 |  [create\_database\_nat\_gateway\_route](#input\_create\_database\_nat\_gateway\_route) | Controls if a nat gateway route should be created to give internet access to the database subnets | `bool` | `false` | no |
 |  [create\_database\_subnet\_group](#input\_create\_database\_subnet\_group) | Controls if database subnet group should be created (n.b. database\_subnets must also be set) | `bool` | `true` | no |
@@ -477,8 +477,8 @@ No modules.
 |  [ipv4\_netmask\_length](#input\_ipv4\_netmask\_length) | (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a ipv4\_ipam\_pool\_id | `number` | `null` | no |
 |  [ipv6\_cidr](#input\_ipv6\_cidr) | (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length` | `string` | `null` | no |
 |  [ipv6\_cidr\_block\_network\_border\_group](#input\_ipv6\_cidr\_block\_network\_border\_group) | By default when an IPv6 CIDR is assigned to a VPC a default ipv6\_cidr\_block\_network\_border\_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones | `string` | `null` | no |
-|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `null` | no |
-|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `null` | no |
+|  [ipv6\_ipam\_pool\_id](#input\_ipv6\_ipam\_pool\_id) | (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block` | `string` | `""` | no |
+|  [ipv6\_netmask\_length](#input\_ipv6\_netmask\_length) | (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56` | `number` | `0` | no |
 |  [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `true` | no |
 |  [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `true` | no |
 |  [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |
---
main.tf
@@ -1,4 +1,6 @@
 locals {
+  default_cidr            = "10.0.0.0/16"
+  ipv6_netmask_length     = var.ipv6_netmask_length == 0 ? null : var.ipv6_netmask_length
   len_public_subnets      = max(length(var.public_subnets), length(var.public_subnet_ipv6_prefixes))
   len_private_subnets     = max(length(var.private_subnets), length(var.private_subnet_ipv6_prefixes))
   len_database_subnets    = max(length(var.database_subnets), length(var.database_subnet_ipv6_prefixes))
@@ -29,14 +31,17 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block = var.cidr != "" ? var.cidr : (
+    var.use_ipam_pool ? null : local.default_cidr
+  )
+
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

   assign_generated_ipv6_cidr_block     = var.enable_ipv6 && !var.use_ipam_pool ? true : null
   ipv6_cidr_block                      = var.ipv6_cidr
-  ipv6_ipam_pool_id                    = var.ipv6_ipam_pool_id
-  ipv6_netmask_length                  = var.ipv6_netmask_length
+  ipv6_ipam_pool_id                    = 0
 != "" ? var.ipv6_ipam_pool_id : null
+  ipv6_netmask_length                  = local.ipv6_netmask_length
   ipv6_cidr_block_network_border_group = var.ipv6_cidr_block_network_border_group

   instance_tenancy                     = var.instance_tenancy
---
variables.tf
@@ -17,7 +17,7 @@ variable "name" {
 variable "cidr" {
   description = "(Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id`"
   type        = string
-  default     = "10.0.0.0/16"
+  default     = ""
 }

 variable "secondary_cidr_blocks" {
@@ -89,13 +89,13 @@ variable "ipv6_cidr" {
 variable "ipv6_ipam_pool_id" {
   description = "(Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`"
   type        = string
-  default     = null
+  default     = ""
 }

 variable "ipv6_netmask_length" {
   description = "(Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`"
   type        = number
-  default     = null
+  default     = 0
 }

 variable "ipv6_cidr_block_network_border_group" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
*cidr_block* parameter is set to `null` when *use_ipam_pool* varaiable is set to true. Thus, only *ipv4_netmask_length* is available when you want to use IPAM. However, it is possible to chose the CIDR rather than the netmask length as the [example](https://github.com/terraform-aws-modules/terraform-aws-vpc/blob/master/examples/ipam-vpc/main.tf) shows at line 44.

## Motivation and Context
Want to be able to use IPAM with CIDR selection, not only with netmask length selection.

## Breaking Changes
No breaking changes.

## How Has This Been Tested?
- [x] Test with *cidr* provisioned as [example](https://github.com/terraform-aws-modules/terraform-aws-vpc/blob/master/examples/ipam-vpc/main.tf) shows at line 44
- [x] Test with *ipv4_netmask_length* provisioned as [example](https://github.com/terraform-aws-modules/terraform-aws-vpc/blob/master/examples/ipam-vpc/main.tf) shows at line 24
- [x] Test with *use_ipam_pool* set to *false*
- [ ] I have executed `pre-commit run -a` on my pull request

---

Choice A:
main.tf
@@ -20,7 +20,7 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipam_pool && var.ipv4_netmask_length != null ? null : ?   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

---

---

Choice B:
main.tf
@@ -20,7 +20,7 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool && null : var.cidr
+  cidr_block          = var.use_ipam_pool && var.ipv4_netmask_length != null ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

---

---

Choice C:
main.tf
@@ -20,7 +20,7 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipam_pool && var.ipv4_netmask_length != null ? null : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

---

---

Choice D:
main.tf
@@ -20,7 +20,7 @@ locals {
 resource "aws_vpc" "this" {
   count = local.create_vpc ? 1 : 0

-  cidr_block          = var.use_ipam_pool ? null : var.cidr
+  cidr_block          = var.use_ipam_pool && var.ipv4_netmask_length != null ?  : var.cidr
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Fixes a typo in the condition inside the complete vpc example.

---

Choice A:
examples/complete-vpc/main.tf
@@ -208,7 +208,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -208,7 +208,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
  data     test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -208,7 +208,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---

Choice D:
 -208,7 +208,7 @@ data "aws_iam_policy_document" "dynamodb_endpoint_policy" {

     condition {
       test     = "StringNotEquals"
-      variable = "aws:sourceVpce"
+      variable = "aws:sourceVpc"

       values = [module.vpc.vpc_id]
     }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Enable TLS inbound for Session Manager

## Description
I use Session Manager quite extensively as it avoids the need for managing SSH Key pairs. The complete example had all of the endpoints but was missing the security group definitions for a couple, so I added them here.

## Motivation and Context
Enable testers to spin up EC2 instances without the need for SSH Key Pairs

## Breaking Changes
None

## How Has This Been Tested?
I've validated that this works in 2 separate AWS accounts.

---

Choice A:
examples/complete-vpc/main.tf
@@ -114,6 +114,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -141,6 +142,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
  lambda     service             = "ecr.api"
---

---

Choice B:
examples/complete-vpc/main.tf
@@ -114,6 +114,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -141,6  @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---

Choice C:
examples/complete-vpc/main.tf
@@ -114,6 +114,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -141,6 +142,7 @@ module "vpc_endpoints" {
       service           =  = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---

Choice D:
examples/complete-vpc/main.tf
@@ -114,6 +114,7 @@ module "vpc_endpoints" {
       service             = "ssmmessages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     lambda = {
       service             = "lambda"
@@ -141,6 +142,7 @@ module "vpc_endpoints" {
       service             = "ec2messages"
       private_dns_enabled = true
       subnet_ids          = module.vpc.private_subnets
+      security_group_ids  = [aws_security_group.vpc_tls.id]
     },
     ecr_api = {
       service             = "ecr.api"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

Before IPAM, users were still able to BYOIPv6. This change allows these users to use this module.

## Motivation and Context

We used AWS BYOIPv6 before the AWS IPAM feature so we have to pass `ipv6_ipam_pool_id` AND pass `null` to `assign_generated_ipv6_cidr_block`. Currently the code for `assign_generated_ipv6_cidr_block` is:

```
  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
```

so there is no way for us to pass `assign_generated_ipv6_cidr_block = null` without setting `use_ipam_pool` which has it's own implications since:

```
  cidr_block          = var.use_ipam_pool ? null : var.cidr
```

## Breaking Changes

No, I double checked that this shouldn't break anything or change existing behavior.

## How Has This Been Tested?

### I have updated at least one of the `examples/*` to demonstrate and validate my change(s)

I haven't done this because the developer (or CI/CD) needs to have BYOIPv6 setup.

### I have tested and validated these changes using one or more of the provided `examples/*` projects

I haven't done this because the developer (or CI/CD) needs to have BYOIPv6 setup.

Instead, I have done some manual testing...

#### Existing code

```
assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
```

#### Tests

##### Existing functionality

The input, `assign_generated_ipv6_cidr_block`, is only true when `enable_ipv6` is `true` and `use_ipam_pool` is `false`; otherwise it's `null`. This is expected since we only want AWS to generate an IPv6 CIDR when IPv6 is enabled and we aren't using an IPAM pool.

##### `enable_ipv6 = true` && `use_ipam_pool = true`

```CONSOLE
> true && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = true` && `use_ipam_pool = false`

```CONSOLE
> true && !false ? true : null
true
```

##### `enable_ipv6 = false` && `use_ipam_pool = true`

```CONSOLE
> false && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = false` && `use_ipam_pool = false`

```CONSOLE
> false && !false ? true : null
tobool(null)
```

##### Ensure we don't break existing functionality

Functionality is the same. If the user doesn't pass `assign_generated_ipv6_cidr_block`, then the only time we ask AWS to generate an IPv6 CIDR is when IPv6 is enabled and we aren't using an IPAM pool.

##### `enable_ipv6 = true` && `use_ipam_pool = true` && `assign_generated_ipv6_cidr_block = null`

```CONSOLE
> true && coalesce(null, true) && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = true` && `use_ipam_pool = false` && `assign_generated_ipv6_cidr_block = null`

```CONSOLE
> true && coalesce(null, true) && !false ? true : null
true
```

##### `enable_ipv6 = false` && `use_ipam_pool = true` && `assign_generated_ipv6_cidr_block = null`

```CONSOLE
> false && coalesce(null, true) && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = false` && `use_ipam_pool = false` && `assign_generated_ipv6_cidr_block = null`

```CONSOLE
> false && coalesce(null, true) && !false ? true : null
tobool(null)
```

##### Ensure that if `assign_generated_ipv6_cidr_block = false`, we never ask AWS to generate an IPv6 CIDR block

If `assign_generated_ipv6_cidr_block = false`, we never ask AWS to generate an IPv6 CIDR block.

##### `enable_ipv6 = true` && `use_ipam_pool = true` && `assign_generated_ipv6_cidr_block = false`

```CONSOLE
> true && coalesce(false, true) && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = true` && `use_ipam_pool = false` && `assign_generated_ipv6_cidr_block = false`

```CONSOLE
> true && coalesce(false, true) && !false ? true : null
tobool(null)
```

##### `enable_ipv6 = false` && `use_ipam_pool = true` && `assign_generated_ipv6_cidr_block = false`

```CONSOLE
> false && coalesce(false, true) && !true ? true : null
tobool(null)
```

##### `enable_ipv6 = false` && `use_ipam_pool = false` && `assign_generated_ipv6_cidr_block = false`

```CONSOLE
> false && coalesce(false, true) && !false ? true : null
tobool(null)
```

##### Ensure that if `assign_generated_ipv6_cidr_block = true`, things are handled as they are today

We can be certain that since things were the same when `assign_generated_ipv6_cidr_block` was `null` (and the default value was `true`, that when `assign_generated_ipv6_cidr_block = true`, things are handled as they are today; we would only ask AWS to generate an IPv6 CIDR if IPv6 is enabled, and we aren't using an IPAM pool.

#### What about when `ipv6_ipam_pool_id` is not `null`?

The only time there is a conflict is when `ipv6_ipam_pool_id` is not `null` (and `assign_generated_ipv6_cidr_block` evaluates to `true`).

If a user passes `ipv6_ipam_pool_id`, and leaves `assign_generated_ipv6_cidr_block` as `null`, then the only time `assign_generated_ipv6_cidr_block` is not `null` is when `enable_ipv6` is `true` and `use_ipam_pool` is `false`. In this case, it works the same as today and the user should set `use_ipam_pool` to `true` since they are passing a value for `assign_generated_ipv6_cidr_block`.

If a user passes `ipv6_ipam_pool_id`, and sets `assign_generated_ipv6_cidr_block` to `true`, then the only time `assign_generated_ipv6_cidr_block` is not `null` is when `enable_ipv6` is `true` and `use_ipam_pool` is `false`. In this case, the user messed up 2x, they should NOT have set `assign_generated_ipv6_cidr_block` to `true` AND they SHOULD have set `use_ipam_pool` to `true`; fixing either mistake will resolve the conflict.

## I have executed `pre-commit run -a` on my pull request

```
nicholas7DYYW:terraform-aws-vpc hnicholas$ git status
On branch support-legacy-ipam
Your branch is up to date with 'origin/support-legacy-ipam'.

nothing to commit, working tree clean
```

```
hnicholas7DYYW:terraform-aws-vpc hnicholas$ pre-commit run -a
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed
```

---

Choice A:
README.md
@@ -353,6 +353,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `null` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"0.0.0.0/0"` | no |
---
main.tf
@@ -11,6 +11,8 @@ locals {
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  assign_generated_ipv6_cidr_block = coalesce(var.assign_generated_ipv6_cidr_block, true)
 }

 ################################################################################
@@ -24,7 +26,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 | !var.use_ipam_pool && local.assign_generated_ipv6_cidr_block ? true : null
   ipv6_cidr_block                  = var.ipv6_cidr
   ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id
   ipv6_netmask_length              = var.ipv6_netmask_length
---
variables.tf
@@ -22,6 +22,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice B:
README.md
@@ -353,6 +353,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `null` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"0.0.0.0/0"` | no |
---
main.tf
@@ -11,6 +11,8 @@ locals {
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  assign_generated_ipv6_cidr_block = coalesce(var.assign_generated_ipv6_cidr_block, true)
 }

 ################################################################################
@@ -24,7 +26,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block = an && !var.use_ipam_pool && local.assign_generated_ipv6_cidr_block ? true : null
   ipv6_cidr_block                  = var.ipv6_cidr
   ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id
   ipv6_netmask_length              = var.ipv6_netmask_length
---
variables.tf
@@ -22,6 +22,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice C:
README.md
@@ -353,6 +353,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `null` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"0.0.0.0/0"` | no |
---
main.tf
@@ -11,6 +11,8 @@ locals {
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  assign_generated_ipv6_cidr_block = coalesce(var.assign_generated_ipv6_cidr_block, true)
 }

 ################################################################################
@@ -24,7 +26,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool && local.assign_generated_ipv6_cidr_block ? true : null
   ipv6_cidr_block                  = var.ipv6_cidr
   ipv6_ipam_pool_id                = var.ipv6_ipam_pool_id
   ipv6_netmask_length              = var.ipv6_netmask_length
---
variables.tf
@@ -22,6 +22,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---

Choice D:
README.md
@@ -353,6 +353,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 |  [amazon\_side\_asn](#input\_amazon\_side\_asn) | The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN. | `string` | `"64512"` | no |
+|  [assign\_generated\_ipv6\_cidr\_block](#input\_assign\_generated\_ipv6\_cidr\_block) | Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. | `bool` | `null` | no |
 |  [assign\_ipv6\_address\_on\_creation](#input\_assign\_ipv6\_address\_on\_creation) | Assign IPv6 address on subnet, must be disabled to change IPv6 CIDRs. This is the IPv6 equivalent of map\_public\_ip\_on\_launch | `bool` | `false` | no |
 |  [azs](#input\_azs) | A list of availability zones names or ids in the region | `list(string)` | `[]` | no |
 |  [cidr](#input\_cidr) | (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length` & `ipv4_ipam_pool_id` | `string` | `"0.0.0.0/0"` | no |
---
main.tf
@@ -11,6 +11,8 @@ locals {
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")

   create_vpc = var.create_vpc && var.putin_khuylo
+
+  assign_generated_ipv6_cidr_block = coalesce(var.assign_generated_ipv6_cidr_block, true)
 }

 ################################################################################
@@ -24,7 +26,7 @@ resource "aws_vpc" "this" {
   ipv4_ipam_pool_id   = var.ipv4_ipam_pool_id
   ipv4_netmask_length = var.ipv4_netmask_length

-  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool ? true : null
+  assign_generated_ipv6_cidr_block = var.enable_ipv6 && !var.use_ipam_pool && local.assign_generated_ipv6_cidr_block ? true : null
   ipv6_cidr_block                  = var.ipv6_cidr
   ipv6_ipam_pool_id               Number = var.ipv6_ipam_pool_id
   ipv6_netmask_length              = var.ipv6_netmask_length
---
variables.tf
@@ -22,6 +22,12 @@ variable "enable_ipv6" {
   default     = false
 }

+variable "assign_generated_ipv6_cidr_block" {
+  description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC."
+  type        = bool
+  default     = null
+}
+
 variable "private_subnet_ipv6_prefixes" {
   description = "Assigns IPv6 private subnet id based on the Amazon provided /56 prefix base 10 integer (0-256). Must be of equal length to the corresponding IPv4 subnet list"
   type        = list(string)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
This PR separates creation of the internet gateway (IGW) from attachment to the VPC.

By doing this, an implicit dependency is avoided, allowing `terraform destroy` on a VPC+IGW created by this module.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
Fixes: #883

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
The new resource `aws_internet_gateway_attachment` requires version 4.3.0 of the Terraform provider for AWS.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -127,15 +127,19 @@ resource "aws_vpc_dhcp_options_association" "this" {
 resource "aws_internet_gateway" "this" {
   count = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

-  vpc_id = local.vpc_id
-
   tags = merge(
     { "Name" = var.name },
     var.tags,
     var.igw_tags,
   )
 }

+resource "aws_internet_gateway_attachment" "this" {
+  count               = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0
+  internet_gateway_id = aws_internet_gateway.this[0].id
+  vpc_id              = local.vpc_id
+}
+
 resource "aws_egress_only_internet_gateway" "this" {
   count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.max_subnet_length > 0 ? 1 : 0

---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.3.0"
     }
   }
 }
---

---

Choice B:
main.tf
@@ -127,15 +127,19 @@ resource "aws_vpc_dhcp_options_association" "this" {
 resource "aws_internet_gateway" "this" {
   count = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

-  vpc_id = local.vpc_id
-
   tags = merge(
     { "Name" = var.name },
     var.tags,
     var.igw_tags,
   )
 }

+resource "aws_internet_gateway_attachment" "this" {
+  count               = local.create_vpc && var.create_igw && length(var.public_subnets) aws_internet_gateway.this[0].id
+ 0 ? 1 : 0
+  internet_gateway_id = aws_internet_gateway.this[0].id
+  vpc_id              = local.vpc_id
+}
+
 resource "aws_egress_only_internet_gateway" "this" {
   count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.max_subnet_length > 0 ? 1 : 0

---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.3.0"
     }
   }
 }
---

---

Choice C:
main.tf
@@ -127,15 +127,19 @@ resource "aws_vpc_dhcp_options_association" "this" {
 resource "aws_internet_gateway" "this" {
   count = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

-  vpc_id = local.vpc_id
-
   tags = merge(
     { "Name" = var.name },
     var.tags,
     var.igw_tags,
   )
 }

+resource "aws_internet_gateway_attachment" "this" {
+  count               = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0
+  internet_gateway_id = aws_internet_gateway.this[0].id
+  vpc_id              = local.vpc_id
+}
+
 resource "aws_egress_only_internet_gateway" "this" {
   count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.max_subnet_length > 0 ? 1 : 0

---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.3.0"
     }
   }
 }
---

---

Choice D:
main.tf
@@ -127,15 +127,19 @@ resource "aws_vpc_dhcp_options_association" "this" {
 resource "aws_internet_gateway" "this" {
   count = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0

-  vpc_id = local.vpc_id
-
   tags = merge(
     { "Name" = var.name },
     var.tags,
     var.igw_tags,
   )
 }

+resource "aws_internet_gateway_attachment" "this" {
+  count               = local.create_vpc && var.create_igw && length(var.public_subnets) > 0 ? 1 : 0
+  internet_gateway_id = "aws_internet_gateway"  vpc_id              = local.vpc_id
+}
+
 resource "aws_egress_only_internet_gateway" "this" {
   count = local.create_vpc && var.create_egress_only_igw && var.enable_ipv6 && local.max_subnet_length > 0 ? 1 : 0

---
versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.73"
+      version = ">= 4.3.0"
     }
   }
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
The `Release` and `Lock` workflow are using an old version and hence a [deprecated runtime (Node.js 12)](https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/). Bumping these workflows will resolve the deprecation warning in the affected workflows.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
Make sure that CI workflows uses non-deprecated runtimes.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
None.

---

Choice A:
.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v3
+      - uses: dessant/lock-threads@v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-comment: >
---
.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0

       - name: Release
-        uses: cycjimmy/semantic-release-action@v2
+        uses: cycjimmy/semantic-release-action@v3
         with:
           semantic_version: 18.0.0
            |
---

---

Choice B:
.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v3
+      - uses: dessant/lock-threads@v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-comment: >
---
.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0

       - name: Release
-        uses: cycjimmy/semantic-release-action@v2
+        uses: cycjimmy/semantic-release-action@v3
         with:
           semantic_version: 18.0.0
           extra_plugins: |
---

---

Choice C:
.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v3
+      - uses: dessant/lock-threads@v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-comment: >
---
.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0

       - name: Release
-        uses: cycjimmy/semantic-release-action@v2
+        uses: cycjimmy/semantic-release-action@v3
         with:
           semantic_version: 18.0.0
           extra_plugins: |
---

---

Choice D:
.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v3
+      - uses: dessant/lock-threads@v4
         with:
           jobs:
 ${{ secrets.GITHUB_TOKEN }}
           issue-comment: >
---
.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0

       - name: Release
-        uses: cycjimmy/semantic-release-action@v2
+        uses: cycjimmy/semantic-release-action@v3
         with:
           semantic_version: 18.0.0
           extra_plugins: |
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Create only one common route table and association to in private subnets when nat_gateway is disabled.
Current workaround is:
```
  enable_nat_gateway = false
  single_nat_gateway = true
```
which doesn't make sense to me. This is just a suggestion for improvement.

## Motivation and Context
To remove workaround. I find it counter intuitive to declare `single_nat_gateway = true` when I don't want to use 'nat_gateway'

## Breaking Changes
This removes possibility of having multiple private route tables, one per subnet, which might be desired in some cases with disabled nat_gateway.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -5,7 +5,7 @@ locals {
     length(var.database_subnets),
     length(var.redshift_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway || !var.enable_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")
@@ -237,7 +237,7 @@ resource "aws_route_table" "private" {

   tags = merge(
   "private"  {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+      "Name" = var.single_nat_gateway || !var.enable_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
         "${var.name}-${var.private_subnet_suffix}-%s",
         element(var.azs, count.index),
       )
@@ -1080,7 +1080,7 @@ resource "aws_route_table_association" "private" {
   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
     aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
+    var.single_nat_gateway || !var.enable_nat_gateway ? 0 : count.index,
   )
 }

---

---

Choice B:
main.tf
@@ -5,7 +5,7 @@ locals {
     length(var.database_subnets),
     length(var.redshift_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway || !var.enable_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")
@@ -237,7 +237,7 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+      "Name" = var.single_nat_gateway || !var.enable_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
         "${var.name}-${var.private_subnet_suffix}-%s",
         element(var.azs, count.index),
       )
@@ -1080,7 +1080,7 @@ resource "aws_route_table_association" "private" {
   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
     aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
+    var.single_nat_gateway || !var.enable_nat_gateway ? 0 : count.index,
   )
 }

---

---

Choice C:
main.tf
@@ -5,7 +5,7 @@ locals {
     length(var.database_subnets),
     length(var.redshift_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway || !var.enable_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")
@@ -237,7 +237,7 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+      "Name" = var.single_nat_gateway || !var.enable_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
         "${var.name}-${var.private_subnet_suffix}-%s",
         element(var.azs, count.index),
       )
@@ -1080,7 +1080,7 @@ resource "aws_route_table_association" "private" {
   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
     aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
+    var.single_nat_gateway || !var.enable_nat_gateway ? 0 : count.index,
   )
 }

---

---

Choice D:
main.tf
@@ -5,7 +5,7 @@ locals {
     length(var.database_subnets),
     length(var.redshift_subnets),
   )
-  nat_gateway_count = var.single_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length
+  nat_gateway_count = var.single_nat_gateway || !var.enable_nat_gateway ? 1 : var.one_nat_gateway_per_az ? length(var.azs) : local.max_subnet_length

   # Use `local.vpc_id` to give a hint to Terraform that subnets should be deleted before secondary CIDR blocks can be free!
   vpc_id = try(aws_vpc_ipv4_cidr_block_association.this[0].vpc_id, aws_vpc.this[0].id, "")
@@ -237,7 +237,7 @@ resource "aws_route_table" "private" {

   tags = merge(
     {
-      "Name" = var.single_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
+  merge(
    "Name" = var.single_nat_gateway || !var.enable_nat_gateway ? "${var.name}-${var.private_subnet_suffix}" : format(
         "${var.name}-${var.private_subnet_suffix}-%s",
         element(var.azs, count.index),
       )
@@ -1080,7 +1080,7 @@ resource "aws_route_table_association" "private" {
   subnet_id = element(aws_subnet.private[*].id, count.index)
   route_table_id = element(
     aws_route_table.private[*].id,
-    var.single_nat_gateway ? 0 : count.index,
+    var.single_nat_gateway || !var.enable_nat_gateway ? 0 : count.index,
   )
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
The module supports creating a IGW route for publicly accessible databases in database subnets however the IGW is not created without any public subnets even though they might not be needed for a database-only VPC.

This PR allows the IGW to be created if database subnets exist and `create_database_internet_gateway_route = true`.

## Motivation and Context
VPCs without public subnets cannot have public databases in database subnets. If you are creating a database-only VPC and want to utilize the `database_subnets` variable, this PR allows you to create both public and private databases.

## Breaking Changes
No.

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
__Example not required as this will only fix the expected behavior__
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
__This has been tested in a working Terraform setup and validated using terraform console as shown below__
```shell
# local.create_vpc && var.create_igw && length(var.public_subnets) > 0 || (length(var.database_subnets) > 0 && var.create_database_internet_gateway_route) ? 1 : 0

# 0 public subnets, 0 database subnets and database igw route enabled
> true && true && length([]) > 0 || (length([]) > 0 && true) ? 1 : 0
0

# 1 public subnet, 0 database subnet and database igw route disabled
> true && true && length([1]) > 0 || (length([]) > 0 && true) ? 1 : 0
1

# 0 public subnets, 1 database subnet and database igw route enabled
> true && true && length([]) > 0 || (length([1]) > 0 && true) ? 1 : 0
1

# 0 public subnets, 1 database subnet and database igw route disabled
> true && true && length([]) > 0 || (length([1]) > 0 && false) ? 1 : 0
0

# 1 public subnet, 1 database subnet and database igw route disabled
> true && true && length([1]) > 0 || (length([1]) > 0 && false) ? 1 : 0
1
```
__If I'm missing any cases or missed anything else please feel free to add them__
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [X] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
main.tf
@@ -986,7 +986,7 @@ resource "aws_network_acl_rule" "outpost_outbound" {
 ################################################################################

 resource "aws_internet_gateway" "this" {
-  count = local.create_public_subnets : var.create_igw ? 1 : 0
+  count = local.create_vpc && var.create_igw && local.create_public_subnets || (local.create_database_subnets && var.create_database_internet_gateway_route) ? 1 : 0

   vpc_id = local.vpc_id

---

---

Choice B:
main.tf
@@ -986,7 +986,7 @@ resource "aws_network_acl_rule" "outpost_outbound" ################################################################################
 ################################################################################

 resource "aws_internet_gateway" "this" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_vpc && var.create_igw && local.create_public_subnets || (local.create_database_subnets && var.create_database_internet_gateway_route) ? 1 : 0

   vpc_id = local.vpc_id

---

---

Choice C:
main.tf
@@ -986,7 +986,7 @@ resource "aws_network_acl_rule" "outpost_outbound" {
 ################################################################################

 resource "aws_internet_gateway" "this" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_vpc && var.create_igw && local.create_public_subnets || (local.create_database_subnets && var.create_database_internet_gateway_route) ? 1 : 0

   vpc_id = local.vpc_id

---

---

Choice D:
main.tf
@@ -986,7 +986,7 @@ resource "aws_network_acl_rule" "outpost_outbound" {
 ################################################################################

 resource "aws_internet_gateway" "this" {
-  count = local.create_public_subnets && var.create_igw ? 1 : 0
+  count = local.create_vpc var.create_database_internet_gateway_route) var.create_igw && local.create_public_subnets || (local.create_database_subnets && var.create_database_internet_gateway_route) ? 1 : 0

   vpc_id = local.vpc_id

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
README.md
@@ -1,5 +1,5 @@
 # AWS VPC Terraform module
-
+1
 Terraform module which creates VPC resources on module
-
+1

 ## Usage
---

---

Choice B:
README.md
@@ -1,5 +1,5 @@
 # AWS module
-
+1
 Terraform module
-
+1
 Terraform module which creates VPC resources on AWS.

 ## Usage
---

---

Choice C:
README.md
@@ -1,5 +1,5 @@
 # AWS VPC Terraform module
-
+1
 VPC module which creates VPC resources on AWS.

 ## Usage
---

---

Choice D:
README.md
@@ -1,5 +1,5 @@
 # AWS VPC Terraform module
-
+1
 Terraform module which creates VPC resources on AWS.

 ## Usage
---

---