Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #551
Changes the descriptions of
default_vpc_id
default_vpc_arn
default_vpc_cidr_block
default_vpc_default_network_acl_id
default_vpc_route_tabnle_id
default_vpc_security_group_id
default_vpc_enable_dns_hostnames
default_vpc_enable_dns_support
default_vpc_instance_tenancy
default_vpc_main_route_table_id
in both README.md and outputs.tf to avoid confusion.

---

Choice A:
README.md
@@ -673,16 +673,16 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_id | The ID of the default network ACL |
 | default\_route\_table\_id | The ID of the default route table |
 | default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_arn | The ARN of the VPC |
-| default\_vpc\_cidr\_block | The CIDR block of the VPC |
-| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL |
-| default\_vpc\_default\_route\_table\_id | The ID of the default route table |
-| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_enable\_dns\_hostnames | Whether or not the VPC has DNS hostname support |
-| default\_vpc\_enable\_dns\_support | Whether or not the VPC has DNS support |
-| default\_vpc\_id | The ID of the VPC |
-| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
-| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |
+| default\_vpc\_arn | The ARN of the Default VPC |
+| default\_vpc\_cidr\_block | The CIDR block of the Default VPC |
+| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL of the Default VPC |
+| default\_vpc\_default\_route\_table\_id | The ID of the default route table of the Default VPC |
+| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on Default VPC creation |
+| default\_vpc\_enable\_dns\_hostnames | Whether or not the Default VPC has DNS hostname support |
+| default\_vpc\_enable\_dns\_support | Whether or not the Default VPC has DNS support |
+| default\_vpc\_id | The ID of the Default VPC |
+| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within Default VPC |
+| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with the Default VPC |
 | egress\_only\_internet\_gateway\_id | The ID of the egress only Internet Gateway |
 | elasticache\_network\_acl\_arn | ARN of the elasticache network ACL |
 | elasticache\_network\_acl\_id | ID of the elasticache network ACL |
---
outputs.tf
@@ -368,52 +368,52 @@ output "vgw_arn" {
 }

 output "default_vpc_id" {
-  description = "The ID of the VPC"
+  description = "The ID of the Default VPC"
   value       = concat(aws_default_vpc.this.*.id, [""])[0]
 }

 output "default_vpc_arn" {
-  description = "The ARN of the VPC"
+  description = "The ARN of the Default VPC"
   value       = concat(aws_default_vpc.this.*.arn, [""])[0]
 }

 output "default_vpc_cidr_block" {
-  description = "The CIDR block of the VPC"
+  description = "The CIDR block of the Default VPC"
   value       = concat(aws_default_vpc.this.*.cidr_block, [""])[0]
 }

 output "default_vpc_default_security_group_id" {
-  description = "The ID of the security group created by default on VPC creation"
+  description = "The ID of the security group created by default on Default VPC creation"
   value       = concat(aws_default_vpc.this.*.default_security_group_id, [""])[0]
 }

 output "default_vpc_default_network_acl_id" {
-  description = "The ID of the default network ACL"
+  description = "The ID of the default network ACL of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_network_acl_id, [""])[0]
 }

 output "default_vpc_default_route_table_id" {
-  description = "The ID of the default route table"
+  description = "The ID of the default route table of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_route_table_id, [""])[0]
 }

 output "default_vpc_instance_tenancy" {
-  description = "Tenancy of instances spin up within VPC"
+  description = "Tenancy of instances spin up within Default VPC"
   value       = concat(aws_default_vpc.this.*.instance_tenancy, [""])[0]
 }

 output "default_vpc_enable_dns_support" {
-  description = "Whether or not the VPC has DNS support"
+  description = "Whether or not the Default VPC has DNS support"
   value       = concat(aws_default_vpc.this.*.enable_dns_support, [""])[0]
 }

 output "default_vpc_enable_dns_hostnames" {
-  description = "Whether or not the VPC has DNS hostname support"
+  description = "Whether or not the Default VPC has DNS hostname support"
   value       = concat(aws_default_vpc.this.*.enable_dns_hostnames, [""])[0]
 }

 output "default_vpc_main_route_table_id" {
-  description = "The ID of the main route table associated with this VPC"
+  description = "The ID of the main route table associated with the Default VPC"
   value       = concat(aws_default_vpc.this.*.main_route_table_id, [""])[0]
 }

---

---

Choice B:
README.md
@@ -673,16 +673,16 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_id | The ID of the default network ACL |
 | default\_route\_table\_id | The ID of the default route table |
 | default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_arn | The ARN of the VPC |
-| default\_vpc\_cidr\_block | The CIDR block of the VPC |
-| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL |
-| default\_vpc\_default\_route\_table\_id | The ID of the default route table |
-| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_enable\_dns\_hostnames | Whether or not the VPC has DNS hostname support |
-| default\_vpc\_enable\_dns\_support | Whether or not the VPC has DNS support |
-| default\_vpc\_id | The ID of the VPC |
-| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
-| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |
+| default\_vpc\_arn | The ARN of the Default VPC |
+| default\_vpc\_cidr\_block | The CIDR block of the Default VPC |
+| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL of the Default VPC |
+| default\_vpc\_default\_route\_table\_id | The ID of the default route table of the Default VPC |
+| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on Default VPC creation |
+| default\_vpc\_enable\_dns\_hostnames | Whether or not the Default VPC has DNS hostname support |
+| default\_vpc\_enable\_dns\_support | Whether or not the Default VPC has DNS support |
+| default\_vpc\_id | The ID of the Default VPC |
+| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within Default VPC |
+| default\_vpc\_main\_route\_table\_id | The ID
 the main route table associated with the Default VPC |
 | egress\_only\_internet\_gateway\_id | The ID of the egress only Internet Gateway |
 | elasticache\_network\_acl\_arn | ARN of the elasticache network ACL |
 | elasticache\_network\_acl\_id | ID of the elasticache network ACL |
---
outputs.tf
@@ -368,52 +368,52 @@ output "vgw_arn" {
 }

 output "default_vpc_id" {
-  description = "The ID of the VPC"
+  description = "The ID of the Default VPC"
   value       = concat(aws_default_vpc.this.*.id, [""])[0]
 }

 output "default_vpc_arn" {
-  description = "The ARN of the VPC"
+  description = "The ARN of the Default VPC"
   value       = concat(aws_default_vpc.this.*.arn, [""])[0]
 }

 output "default_vpc_cidr_block" {
-  description = "The CIDR block of the VPC"
+  description = "The CIDR block of the Default VPC"
   value       = concat(aws_default_vpc.this.*.cidr_block, [""])[0]
 }

 output "default_vpc_default_security_group_id" {
-  description = "The ID of the security group created by default on VPC creation"
+  description = "The ID of the security group created by default on Default VPC creation"
   value       = concat(aws_default_vpc.this.*.default_security_group_id, [""])[0]
 }

 output "default_vpc_default_network_acl_id" {
-  description = "The ID of the default network ACL"
+  description = "The ID of the default network ACL of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_network_acl_id, [""])[0]
 }

 output "default_vpc_default_route_table_id" {
-  description = "The ID of the default route table"
+  description = "The ID of the default route table of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_route_table_id, [""])[0]
 }

 output "default_vpc_instance_tenancy" {
-  description = "Tenancy of instances spin up within VPC"
+  description = "Tenancy of instances spin up within Default VPC"
   value       = concat(aws_default_vpc.this.*.instance_tenancy, [""])[0]
 }

 output "default_vpc_enable_dns_support" {
-  description = "Whether or not the VPC has DNS support"
+  description = "Whether or not the Default VPC has DNS support"
   value       = concat(aws_default_vpc.this.*.enable_dns_support, [""])[0]
 }

 output "default_vpc_enable_dns_hostnames" {
-  description = "Whether or not the VPC has DNS hostname support"
+  description = "Whether or not the Default VPC has DNS hostname support"
   value       = concat(aws_default_vpc.this.*.enable_dns_hostnames, [""])[0]
 }

 output "default_vpc_main_route_table_id" {
-  description = "The ID of the main route table associated with this VPC"
+  description = "The ID of the main route table associated with the Default VPC"
   value       = concat(aws_default_vpc.this.*.main_route_table_id, [""])[0]
 }

---

---

Choice C:
README.md
@@ -673,16 +673,16 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_id | The ID of the default network ACL |
 | default\_route\_table\_id | The ID of the default route table |
 | default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_arn | The ARN of the VPC |
-| default\_vpc\_cidr\_block | The CIDR block of the VPC |
-| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL |
-| default\_vpc\_default\_route\_table\_id | The ID of the default route table |
-| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_enable\_dns\_hostnames | Whether or not the VPC has DNS hostname support |
-| default\_vpc\_enable\_dns\_support | Whether or not the VPC has DNS support |
-| default\_vpc\_id | The ID of the VPC |
-| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
-| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |
+| default\_vpc\_arn | The ARN of the Default VPC |
+| default\_vpc\_cidr\_block | The CIDR block of the Default VPC |
+| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL of the Default VPC |
+| default\_vpc\_default\_route\_table\_id | The ID of the default route table of the Default VPC |
+| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on Default VPC creation |
+| default\_vpc\_enable\_dns\_hostnames | Whether or not the Default VPC has DNS hostname support |
+| default\_vpc\_enable\_dns\_support | Whether or not the Default VPC has DNS support |
+| default\_vpc\_id | The ID of the Default VPC |
+| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within Default VPC |
+| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with the Default VPC |
 | egress\_only\_internet\_gateway\_id | The ID of the egress only Internet Gateway |
 | elasticache\_network\_acl\_arn | ARN of the elasticache network ACL |
 | elasticache\_network\_acl\_id | ID of the elasticache network ACL |
---
outputs.tf
@@ -368,52 +368,52 @@ output "vgw_arn" {
 }

 output "default_vpc_id" {
-  description = "The ID of the VPC"
+  description = "The ID of the Default VPC"
   value       = concat(aws_default_vpc.this.*.id, [""])[0]
 }

 output "default_vpc_arn" {
-  description = "The ARN of the VPC"
+  description = "The ARN of the Default VPC"
   value       = concat(aws_default_vpc.this.*.arn, [""])[0]
 }

 output "default_vpc_cidr_block" {
-  description = "The CIDR block of the VPC"
+  description = "The CIDR block of the Default VPC"
   value       = concat(aws_default_vpc.this.*.cidr_block, [""])[0]
 }

 output "default_vpc_default_security_group_id" {
-  description = "The ID of the security group created by default on VPC creation"
+  description = "The ID of the security group created by default on Default VPC creation"
   value       = concat(aws_default_vpc.this.*.default_security_group_id, [""])[0]
 }

 output "default_vpc_default_network_acl_id" {
-  description = "The ID of the default network ACL"
+  description = "The ID of the default network ACL of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_network_acl_id, [""])[0]
 }

 output "default_vpc_default_route_table_id" {
-  description = "The ID of the default route table"
+  description = "The ID of the default route table of the Default VPC"
   value   The    = concat(aws_default_vpc.this.*.default_route_table_id, [""])[0]
 }

 output "default_vpc_instance_tenancy" {
-  description = "Tenancy of instances spin up within VPC"
+  description = "Tenancy of instances spin up within Default VPC"
   value       = concat(aws_default_vpc.this.*.instance_tenancy, [""])[0]
 }

 output "default_vpc_enable_dns_support" {
-  description = "Whether or not the VPC has DNS support"
+  description = "Whether or not the Default VPC has DNS support"
   value       = concat(aws_default_vpc.this.*.enable_dns_support, [""])[0]
 }

 output "default_vpc_enable_dns_hostnames" {
-  description = "Whether or not the VPC has DNS hostname support"
+  description = "Whether or not the Default VPC has DNS hostname support"
   value       = concat(aws_default_vpc.this.*.enable_dns_hostnames, [""])[0]
 }

 output "default_vpc_main_route_table_id" {
-  description = "The ID of the main route table associated with this VPC"
+  description = "The ID of the main route table associated with the Default VPC"
   value       = concat(aws_default_vpc.this.*.main_route_table_id, [""])[0]
 }

---

---

Choice D:
README.md
@@ -673,16 +673,16 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_id | The ID of the default network ACL |
 | default\_route\_table\_id | The ID of the default route table |
 | default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_arn | The ARN of the VPC |
-| default\_vpc\_cidr\_block | The CIDR block of the VPC |
-| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL |
-| default\_vpc\_default\_route\_table\_id | The ID of the default route table |
-| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on VPC creation |
-| default\_vpc\_enable\_dns\_hostnames | Whether or not the VPC has DNS hostname support |
-| default\_vpc\_enable\_dns\_support | Whether or not the VPC has DNS support |
-| default\_vpc\_id | The ID of the VPC |
-| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within VPC |
-| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with this VPC |
+| default\_vpc\_arn | The ARN of the Default VPC |
+| default\_vpc\_cidr\_block | The CIDR block of the Default VPC |
+| default\_vpc\_default\_network\_acl\_id | The ID of the default network ACL of the Default VPC |
+| default\_vpc\_default\_route\_table\_id | The ID of the default route table of the Default VPC |
+| default\_vpc\_default\_security\_group\_id | The ID of the security group created by default on Default VPC creation |
+| default\_vpc\_enable\_dns\_hostnames | Whether or not the Default VPC has DNS hostname support |
+| default\_vpc\_enable\_dns\_support | Whether or not the Default VPC has DNS support |
+| default\_vpc\_id | The ID of the Default VPC |
+| default\_vpc\_instance\_tenancy | Tenancy of instances spin up within Default VPC |
+| default\_vpc\_main\_route\_table\_id | The ID of the main route table associated with the Default VPC |
 | egress\_only\_internet\_gateway\_id | The ID of the egress only Internet Gateway |
 | elasticache\_network\_acl\_arn | ARN of the elasticache network ACL |
 | elasticache\_network\_acl\_id | ID of the elasticache network ACL |
---
outputs.tf
@@ -368,52 +368,52 @@ output "vgw_arn" {
 }

 output "default_vpc_id" {
-  description = "The ID of the VPC"
+  description = "The ID of the Default VPC"
   value       = concat(aws_default_vpc.this.*.id, [""])[0]
 }

 output "default_vpc_arn" {
-  description = "The ARN of the VPC"
+  description = "The ARN of the Default VPC"
   value       = concat(aws_default_vpc.this.*.arn, [""])[0]
 }

 output "default_vpc_cidr_block" {
-  description = "The CIDR block of the VPC"
+  description = "The CIDR block of the Default VPC"
   value       = concat(aws_default_vpc.this.*.cidr_block, [""])[0]
 }

 output "default_vpc_default_security_group_id" {
-  description = "The ID of the security group created by default on VPC creation"
+  description = "The ID of the security group created by default on Default VPC creation"
   value       = concat(aws_default_vpc.this.*.default_security_group_id, [""])[0]
 }

 output "default_vpc_default_network_acl_id" {
-  description = "The ID of the default network ACL"
+  description = "The ID of the default network ACL of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_network_acl_id, [""])[0]
 }

 output "default_vpc_default_route_table_id" {
-  description = "The ID of the default route table"
+  description = "The ID of the default route table of the Default VPC"
   value       = concat(aws_default_vpc.this.*.default_route_table_id, [""])[0]
 }

 output "default_vpc_instance_tenancy" {
-  description = "Tenancy of instances spin up within VPC"
+  description = "Tenancy of instances spin up within Default VPC"
   value       = concat(aws_default_vpc.this.*.instance_tenancy, [""])[0]
 }

 output "default_vpc_enable_dns_support" {
-  description = "Whether or not the VPC has DNS support"
+  description = "Whether or not the Default VPC has DNS support"
   value       = concat(aws_default_vpc.this.*.enable_dns_support, [""])[0]
 }

 output "default_vpc_enable_dns_hostnames" {
-  description = "Whether or not the VPC has DNS hostname support"
+  description = "Whether or not the Default VPC has DNS hostname support"
   value       = concat(aws_default_vpc.this.*.enable_dns_hostnames, [""])[0]
 }

 output "default_vpc_main_route_table_id" {
-  description = "The ID of the main route table associated with this VPC"
+  description = "The ID of the main route
 associated with the Default VPC"
   value       = concat(aws_default_vpc.this.*.main_route_table_id, [""])[0]
 }

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description

## Motivation and Context
This permission is not needed because we create the log group with Terraform so the VPC Flow Logs service doesn’t need to do it. On the other hand having this permission causes a bug where, on terraform destroy the log group will be destroyed, but then if there is still a few messages in a VPC Flow Logs queue the managed service will see that the log group does not exist and create it again using.

You’ll then have the log group lingering after the tf destroy, which can cause trouble if you try to terraform apply again with the same name: the log group will be already existing and your apply will fail. Not having the permission prevents that as the managed service will not be able to recreate the log group after the tf destroy.

## Breaking Changes
Not that I know, except if someone was reusing the created role for another purpose that depended on the permission, which seems unlikely (we don’t expose the role name in the outputs, do we ?).

## How Has This Been Tested?
I’m waiting on CI here https://github.com/trussworks/terraform-aws-vpc-flow-logs/pull/8 which is the exact same change in another module.

---

Choice A:
vpc-flow-logs.tf
@@ -90,7 +90,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
      = "Allow"

     actions = [
-      "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:DescribeLogGroups",
---

---

Choice B:
vpc-flow-logs.tf
@@ -90,7 +90,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
     effect = "Allow"

     actions = [
-      "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:DescribeLogGroups",
---

---

Choice C:
vpc-flow-logs.tf
@@ -90,7 +90,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
     effect = "Allow"

     actions = [
-      "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:DescribeLogGroups",
---

---

Choice D:
vpc-flow-logs.tf
@@ -90,7 +90,6 @@ data "aws_iam_policy_document" "vpc_flow_log_cloudwatch" {
     effect = "Allow"

     actions =       "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:DescribeLogGroups",
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
This commit implements a fully-automated development setup using Gitpod.io, an
online IDE for GitLab, GitHub, and Bitbucket that enables Dev-Environments-As-Code.
This makes it easy for anyone to get a ready-to-code workspace for any branch,
issue or pull request almost instantly with a single click.

---

Choice A:
.gitpod.Dockerfile
@@ -0,0 +1,7 @@
+FROM gitpod/workspace-full
+
+# Install custom tools, runtimes, etc.
+# For example "bastet", a command-line tetris clone:
+# RUN brew  bastet
+#
+# More information: https://www.gitpod.io/docs/config-docker/
---
.gitpod.yml
@@ -0,0 +1,5 @@
+image:
+  file: .gitpod.Dockerfile
+
+tasks:
+  - init: make
---
README.md
@@ -1,3 +1,5 @@
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/terraform-aws-modules/terraform-aws-vpc)
+
 # AWS VPC Terraform module

 [![Help Contribute to Open Source](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc/badges/users.svg)](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc)
---

---

Choice B:
tetris -0,0 +1,7 @@
+FROM gitpod/workspace-full
+
+# Install custom tools, runtimes, etc.
+# For example "bastet", a command-line tetris clone:
+# RUN brew install bastet
+#
+# More information: https://www.gitpod.io/docs/config-docker/
---
.gitpod.yml
@@ -0,0 +1,5 @@
+image:
+  file: .gitpod.Dockerfile
+
+tasks:
+  - init: make
---
README.md
@@ -1,3 +1,5 @@
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/terraform-aws-modules/terraform-aws-vpc)
+
 # AWS VPC Terraform module

 [![Help Contribute to Open Source](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc/badges/users.svg)](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc)
---

---

Choice C:
.gitpod.Dockerfile
@@ -0,0 +1,7 @@
+FROM gitpod/workspace-full
+
+# Install custom tools, runtimes, etc.
+# For example "bastet", a command-line tetris clone:
+# RUN brew install bastet
+#
+# More information: https://www.gitpod.io/docs/config-docker/
---
.gitpod.yml
@@ -0,0 +1,5 @@
+image:
+  file: .gitpod.Dockerfile
+
+tasks:
+  - init: make
---
README.md
@@ -1,3 +1,5 @@
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/terraform-aws-modules/terraform-aws-vpc)
+
 # AWS VPC Terraform module

 [![Help Contribute to Open Source](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc/badges/users.svg)](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc)
---

---

Choice D:
.gitpod.Dockerfile
@@ -0,0 +1,7 @@
+FROM gitpod/workspace-full
+
+# Install custom tools, For etc.
+# For example "bastet", a command-line tetris clone:
+# RUN brew install bastet
+#
+# More information: https://www.gitpod.io/docs/config-docker/
---
.gitpod.yml
@@ -0,0 +1,5 @@
+image:
+  file: .gitpod.Dockerfile
+
+tasks:
+  - init: make
---
README.md
@@ -1,3 +1,5 @@
+[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/terraform-aws-modules/terraform-aws-vpc)
+
 # AWS VPC Terraform module

 [![Help Contribute to Open Source](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc/badges/users.svg)](https://www.codetriage.com/terraform-aws-modules/terraform-aws-vpc)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Signed-off-by: Lays Rodrigues <laysrodriguessilva@gmail.com>

## Description
Add support to tag default route table since PR #147 is getting dust.

## Motivation and Context
So far this is the only resource on this module that has not set a Name by default. And I like my resources tagged :3

## Breaking Changes
Not that I know.

## How Has This Been Tested?
Used terraform 0.14
```sh
terraform fmt
terraform validate
terraform plan
terraform apply
```
```hcl
  # module.vpc.aws_default_route_table.default[0] must be replaced
-/+ resource "aws_default_route_table" "default" {
      + default_route_table_id = "rtb-id"
      + id                     = (known after apply)
      + owner_id               = (known after apply)
      + route                  = (known after apply)
      + tags                   = {
          + "Name"                            = "my-rt-name"
          + "environment"                     = "development"
          + "kubernetes.io/cluster/beira-rio" = "shared"
        }
      + vpc_id                 = (known after apply)
    }
```
```
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
```

---

Choice A:
README.md
@@ -335,6 +335,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 | default\_network\_acl\_name | Name to be used on the Default Network ACL | `string` | `""` | no |
 | default\_network\_acl\_tags | Additional tags for the Default Network ACL | `map(string)` | `{}` | no |
+| default\_route\_table\_tags | Additional tags for |
 Default Route Table | `map(string)` | `{}` | no |
 | default\_security\_group\_egress | List of maps of egress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_ingress | List of maps of ingress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_name | Name to be used on the default security group | `string` | `"default"` | no |
---
main.tf
@@ -160,6 +160,22 @@ resource "aws_egress_only_internet_gateway" "this" {
   )
 }

+
+################
+# Default route
+################
+resource "aws_default_route_table" "default" {
+  count                  = var.create_vpc ? 1 : 0
+  default_route_table_id = aws_vpc.this[0].default_route_table_id
+  tags = merge(
+    {
+      "Name" = format("%s", var.name)
+    },
+    var.tags,
+    var.default_route_table_tags,
+  )
+}
+
 ################
 # Publiс routes
 ################
---
variables.tf
@@ -2602,3 +2602,9 @@ variable "create_egress_only_igw" {
   type        = bool
   default     = true
 }
+
+variable "default_route_table_tags" {
+  description = "Additional tags for the Default Route Table"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice B:
README.md
@@ -335,6 +335,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 | default\_network\_acl\_name | Name to be used on the Default Network ACL | `string` | `""` | no |
 | default\_network\_acl\_tags | Additional tags for the Default Network ACL | `map(string)` | `{}` | no |
+| default\_route\_table\_tags | Additional tags for the Default Route Table | `map(string)` | `{}` | no |
 | default\_security\_group\_egress | List of maps of egress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_ingress | List of maps of ingress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_name | Name to be used on the default security group | `string` | `"default"` | no |
---
main.tf
@@ -160,6 +160,22 @@ resource "aws_egress_only_internet_gateway" "this" {
   )
 }

+
+################
+# Default route
+################
+resource "aws_default_route_table" "default" {
+  count                  = var.create_vpc ? 1 : 0
+  default_route_table_id = aws_vpc.this[0].default_route_table_id
+  tags = merge(
+    {
+      "Name" = format("%s", var.name)
+    },
+    var.tags,
+    var.default_route_table_tags,
+  )
+}
+
 ################
 # Publiс routes
 ################
---
variables.tf
@@ -2602,3 +2602,9 @@ variable "create_egress_only_igw" {
   type        = bool
   default     = true
 }
+
+variable "default_route_table_tags" {
+  description = "Additional tags for the Default Route Table"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice C:
README.md
@@ -335,6 +335,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 | default\_network\_acl\_name | Name to be used on the Default Network ACL | `string` | `""` | no |
 | default\_network\_acl\_tags | Additional tags for the Default Network ACL | `map(string)` | `{}` | no |
+| default\_route\_table\_tags | Additional tags for the Default Route Table | `map(string)` | `{}` | no |
 | default\_security\_group\_egress | List of maps of egress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_ingress | List of maps of ingress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_name | Name to be used on the default security group | `string` | `"default"` | no |
---
main.tf
@@ -160,6 +160,22 @@ resource "aws_egress_only_internet_gateway" "this" {
   -160,6 }

+
+################
+# Default route
+################
+resource "aws_default_route_table" "default" {
+  count                  = var.create_vpc ? 1 : 0
+  default_route_table_id = aws_vpc.this[0].default_route_table_id
+  tags = merge(
+    {
+      "Name" = format("%s", var.name)
+    },
+    var.tags,
+    var.default_route_table_tags,
+  )
+}
+
 ################
 # Publiс routes
 ################
---
variables.tf
@@ -2602,3 +2602,9 @@ variable "create_egress_only_igw" {
   type        = bool
   default     = true
 }
+
+variable "default_route_table_tags" {
+  description = "Additional tags for the Default Route Table"
+  type        = map(string)
+  default     = {}
+}
---

---

Choice D:
README.md
@@ -335,6 +335,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | `list(map(string))` |
[
  {
    "action": "allow",
    "cidr_block": "0.0.0.0/0",
    "from_port": 0,
    "protocol": "-1",
    "rule_no": 100,
    "to_port": 0
  },
  {
    "action": "allow",
    "from_port": 0,
    "ipv6_cidr_block": "::/0",
    "protocol": "-1",
    "rule_no": 101,
    "to_port": 0
  }
]
 | no |
 | default\_network\_acl\_name | Name to be used on the Default Network ACL | `string` | `""` | no |
 | default\_network\_acl\_tags | Additional tags for the Default Network ACL | `map(string)` | `{}` | no |
+| default\_route\_table\_tags | Additional tags for the Default Route Table | `map(string)` | `{}` | no |
 | default\_security\_group\_egress | List of maps of egress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_ingress | List of maps of ingress rules to set on the default security group | `list(map(string))` | `null` | no |
 | default\_security\_group\_name | Name to be used on the default security group | `string` | `"default"` | no |
---
main.tf
@@ -160,6 +160,22 @@ resource "aws_egress_only_internet_gateway" "this" {
   )
 }

+
+################
+# Default route
+################
+resource "aws_default_route_table" "default" {
+  count                  = var.create_vpc ? 1 : 0
+  default_route_table_id = aws_vpc.this[0].default_route_table_id
+  tags = merge(
+    {
+      "Name" = format("%s", var.name)
+    },
+    var.tags,
+    var.default_route_table_tags,
+  )
+}
+
 ################
 # Publiс routes
 ################
---
variables.tf
@@ -2602,3 +2602,9 @@ variable "create_egress_only_igw" {
   type        = bool
   default     = true
 }
+
+variable "default_route_table_tags" {
+  description = "Additional tags for the Default Route Table"
+  type        = map(string)
+  default     =

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
Fix for `aws_route_table.private` creation.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
If you are using only `elasticache_subnets` without providing `private_subnets` the "private route tables" will be created anyway.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

With this change, these "private route tables" will be removed.

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
################################################################################
 -222,7 +222,7 @@ resource "aws_route" "public_internet_gateway_ipv6" {
 ################################################################################

 resource "aws_route_table" "private" {
-  count = var.create_vpc && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0

   vpc_id = local.vpc_id

---

---

Choice B:
main.tf
@@ -222,7 +222,7 @@ resource "aws_route" "public_internet_gateway_ipv6" {
 ################################################################################

 resource "aws_route_table" "private" {
-  count = var.create_vpc && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0

   vpc_id
 local.vpc_id

---

---

Choice C:
main.tf
@@ -222,7 +222,7 @@ resource "aws_route" "public_internet_gateway_ipv6" {
 ################################################################################

 resource "aws_route_table" "private" {
-  count = var.create_vpc && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0

   vpc_id = local.vpc_id

---

---

Choice D:
main.tf
@@ -222,7 +222,7 @@ resource "aws_route" "public_internet_gateway_ipv6" {
 ################################################################################

 resource "aws_route_table" "private" {
-  count = var.create_vpc && local.max_subnet_length > 0 ? local.nat_gateway_count : 0
+  count = {
 && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0

   vpc_id = local.vpc_id

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
- Just testing for now, disregard

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->

---

Choice A:
.github/workflows/static-checks.yml
@@ -0,0 +1,73 @@
+name: static-checks
+
+on:
+  pull_request:
+
+jobs:
+  versionExtract:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@main
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  versionEvaluate:
+    name: Evaluate Terraform versions
+    runs-on: ubuntu-latest
+    needs: versionExtract
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.versionExtract.outputs.minVersion }}
+          - ${{ needs.versionExtract.outputs.maxVersion }}
+        directory: [examples/complete-vpc, examples/ipv6, examples/simple-vpc, examples/network-acls]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Init & validate v${{ matrix.version }}
+        run: |
+          cd ${{ matrix.directory }}
+          terraform init
+          terraform validate
+
+      - name: tflint
+        uses: reviewdog/action-tflint@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          working_directory: ${{ matrix.directory }}
+          fail_on_error: 'true'
+          filter_mode: 'nofilter'
+          flags: '--module'
+
+  format:
+    name: Check code format
+    runs-on: ubuntu-latest
+    needs: versionExtract
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ needs.versionExtract.outputs.maxVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ needs.versionExtract.outputs.maxVersion }}
+
+      - name: Check Terraform format changes
+        run: terraform fmt --recursive -check=true
---

---

Choice B:
.github/workflows/static-checks.yml
@@ -0,0 +1,73 @@
+name: static-checks
+
+on:
+  pull_request:
+
+jobs:
+  versionExtract:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@main
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  versionEvaluate:
+    name: Evaluate Terraform versions
+    runs-on: ubuntu-latest
+    needs: versionExtract
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.versionExtract.outputs.minVersion }}
+          - ${{ needs.versionExtract.outputs.maxVersion }}
+        directory: [examples/complete-vpc, examples/ipv6, examples/simple-vpc, examples/network-acls]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Init & validate v${{ matrix.version }}
+        run: |
+          cd ${{ matrix.directory }}
+          terraform init
+          terraform validate
+
+      - name: tflint
+        uses: reviewdog/action-tflint@master
+        with:
+          github_token:  secrets.GITHUB_TOKEN }}
+          working_directory: ${{ matrix.directory }}
+          fail_on_error: 'true'
+          filter_mode: 'nofilter'
+          flags: '--module'
+
+  format:
+    name: Check code format
+    runs-on: ubuntu-latest
+    needs: versionExtract
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ needs.versionExtract.outputs.maxVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ needs.versionExtract.outputs.maxVersion }}
+
+      - name: Check Terraform format changes
+        run: terraform fmt --recursive -check=true
---

---

Choice C:
.github/workflows/static-checks.yml
@@ -0,0 +1,73 @@
+name: static-checks
+
+on:
+  pull_request:
+
+jobs:
+  versionExtract:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@main
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  versionEvaluate:
+    name: Evaluate Terraform versions
+    runs-on: ubuntu-latest
+    needs: versionExtract
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.versionExtract.outputs.minVersion }}
+          - ${{ needs.versionExtract.outputs.maxVersion }}
+        directory: [examples/complete-vpc, examples/ipv6, examples/simple-vpc, examples/network-acls]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Init & validate v${{ matrix.version }}
+        run: |
+          cd ${{ matrix.directory }}
+          terraform init
+          terraform validate
+
+      - name: tflint
+        uses: reviewdog/action-tflint@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          working_directory: ${{ matrix.directory }}
+          fail_on_error: 'true'
+          filter_mode: 'nofilter'
+          flags: '--module'
+
+  format:
+    name: Check code format
+    runs-on: ubuntu-latest
+    needs: versionExtract
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ needs.versionExtract.outputs.maxVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ needs.versionExtract.outputs.maxVersion }}
+
+      - name: Check Terraform format changes
+        run: terraform fmt --recursive -check=true
---

---

Choice D:
.github/workflows/static-checks.yml
@@ -0,0 +1,73 @@
+name: static-checks
+
+on:
+  pull_request:
+
+jobs:
+  versionExtract:
+    name: Get min/max versions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Terraform min/max versions
+        id: minMax
+        uses: clowdhaus/terraform-min-max@main
+    outputs:
+      minVersion: ${{ steps.minMax.outputs.minVersion }}
+      maxVersion: ${{ steps.minMax.outputs.maxVersion }}
+
+  versionEvaluate:
+    name: Evaluate Terraform versions
+    runs-on: ubuntu-latest
+    needs: versionExtract
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - ${{ needs.versionExtract.outputs.minVersion }}
+          - ${{ needs.versionExtract.outputs.maxVersion }}
+        directory: [examples/complete-vpc, examples/ipv6, examples/simple-vpc, examples/network-acls]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ matrix.version }}
+ needs:       uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ matrix.version }}
+
+      - name: Init & validate v${{ matrix.version }}
+        run: |
+          cd ${{ matrix.directory }}
+          terraform init
+          terraform validate
+
+      - name: tflint
+        uses: reviewdog/action-tflint@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          working_directory: ${{ matrix.directory }}
+          fail_on_error: 'true'
+          filter_mode: 'nofilter'
+          flags: '--module'
+
+  format:
+    name: Check code format
+    runs-on: ubuntu-latest
+    needs: versionExtract
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Install Terraform v${{ needs.versionExtract.outputs.maxVersion }}
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: ${{ needs.versionExtract.outputs.maxVersion }}
+
+      - name: Check Terraform format changes
+        run: terraform fmt --recursive -check=true
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Adding `vpc_flow_log_permissions_boundary` so that developers who are required to specify a permissions boundary on IAM roles can enable the VPC Flow Log feature in this module

## Motivation and Context
In many AWS setups, developers are required to assume a role in order to make changes to AWS resources. One of the recommended security measures that is recommended by AWS is to allow roles the ability to create other roles only if a permissions boundary is set directly on the role. This prevents developers (in an assumed-role session) from [unintentionally/intentionally] creating a role with, for example, super powers/administrative rights. Without the ability to set a permissions boundary on the VPC Flow Logs IAM role, those who are bound by this permissions boundary restraint will not be able to enable the VPC Flow Logs feature, but will instead need to create a new module to handle this.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
None

<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
CircleCI pipeline passes. Using the fork in our production code/environment (manual smoke testing/verification) -- the VPC Flow Logs elements (IAM role, IAM cloudwatch log group) are created; other elements are not affected.
```
module "vpc" {
  source = "git::https://github.com/kelseymok/terraform-aws-vpc.git"

  name = "${local.project-name}-${local.module-name}"
  cidr = local.vpc-cidr

  azs = local.azs
  private_subnets = local.private_subnets
  public_subnets  = local.public_subnets

  enable_nat_gateway = true
  enable_dns_hostnames = true
  enable_dns_support   = true

  enable_flow_log = true
  flow_log_destination_type = "cloud-watch-logs"
  create_flow_log_cloudwatch_iam_role = true
  create_flow_log_cloudwatch_log_group = true
  vpc_flow_log_permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/my-awesome-boundary"
}
```

---

Choice A:
README.md
@@ -161,6 +161,10 @@ You can add additional tags with `intra_subnet_tags` as with other subnet types.

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).

+### Permissions Boundary
+
+If your organization requires a permissions boundary to be attached to the VPC Flow Log role, make sure that you specify an ARN of the permissions boundary policy as `vpc_flow_log_permissions_boundary` argument. Read more about required [IAM policy for publishing flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-iam).
+
 ## Conditional creation

 Sometimes you need to have a way to create VPC resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_vpc`.
@@ -637,6 +641,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no |
+| vpc\_flow\_log\_permissions\_boundary | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 | vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no |
 | vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | `null` | no |
---
variables.tf
@@ -2117,6 +2117,12 @@ variable "vpc_flow_log_tags" {
   default     = {}
 }

+variable "vpc_flow_log_permissions_boundary" {
+  description = "The ARN of the Permissions Boundary for the VPC Flow Log IAM Role"
+  type        = string
+  default     = null
+}
+
 variable "enable_dhcp_options" {
   description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS for NTP servers, netbios servers, and/or netbios server type"
   type        = bool
---
vpc-flow-logs.tf
@@ -45,8 +45,9 @@ resource "aws_cloudwatch_log_group" "flow_log" {
 resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

-  name_prefix        = "vpc-flow-log-role-"
-  assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  name_prefix          = "vpc-flow-log-role-"
+  assume_role_policy   = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  permissions_boundary = var.vpc_flow_log_permissions_boundary

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice B:
README.md
@@ -161,6 +161,10 @@ You can add additional tags with `intra_subnet_tags` as with other subnet types.

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).

+### Permissions Boundary
+
+If your organization requires a permissions boundary to be attached to the VPC Flow Log role, make sure that you specify an ARN of the permissions boundary policy as `vpc_flow_log_permissions_boundary` argument. Read more about required [IAM policy for publishing flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-iam).
+
 ## Conditional creation

 Sometimes you need to have a way to create VPC resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_vpc`.
@@ -637,6 +641,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no |
+| vpc\_flow\_log\_permissions\_boundary | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 | vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no |
 | vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | `null` | no |
---
variables.tf
@@ -2117,6 +2117,12 @@ variable "vpc_flow_log_tags" {
   default     = {}
 }

+variable "vpc_flow_log_permissions_boundary" {
+  description = "The ARN of the Permissions Boundary for the VPC Flow Log IAM Role"
+  type        = string
+  default     = null
+}
+
 variable "enable_dhcp_options" {
   description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type"
   type        = bool
---
vpc-flow-logs.tf
@@ -45,8 +45,9 @@ resource "aws_cloudwatch_log_group" "flow_log" {
 resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

-  name_prefix        = "vpc-flow-log-role-"
-  assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  name_prefix          = "vpc-flow-log-role-"
+  assume_role_policy   = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  permissions_boundary = var.vpc_flow_log_permissions_boundary

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice C:
README.md
@@ -161,6 +161,10 @@ You can add additional tags with `intra_subnet_tags` as with other subnet types.

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).

+### Permissions Boundary
+
+If your organization requires a permissions boundary to be attached to the VPC Flow Log role, make sure that you specify an ARN of the permissions boundary policy as `vpc_flow_log_permissions_boundary` argument. Read more about required [IAM policy for publishing flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-iam).
+
 ## Conditional creation

 Sometimes you need to have a way to create VPC resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_vpc`.
@@ -637,6 +641,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no |
+| vpc\_flow\_log\_permissions\_boundary | The ARN of the Permissions Boundary for the VPC Flow or IAM Role | `string` | `null` | no |
 | vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no |
 | vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | `null` | no |
---
variables.tf
@@ -2117,6 +2117,12 @@ variable "vpc_flow_log_tags" {
   default     = {}
 }

+variable "vpc_flow_log_permissions_boundary" {
+  description = "The ARN of the Permissions Boundary for the VPC Flow Log IAM Role"
+  type        = string
+  default     = null
+}
+
 variable "enable_dhcp_options" {
   description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type"
   type        = bool
---
vpc-flow-logs.tf
@@ -45,8 +45,9 @@ resource "aws_cloudwatch_log_group" "flow_log" {
 resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

-  name_prefix        = "vpc-flow-log-role-"
-  assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  name_prefix          = "vpc-flow-log-role-"
+  assume_role_policy   = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  permissions_boundary = var.vpc_flow_log_permissions_boundary

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---

Choice D:
README.md
@@ -161,6 +161,10 @@ You can add additional tags with `intra_subnet_tags` as with other subnet types.

 VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC. If you need to have VPC Flow Logs for subnet or ENI, you have to manage it outside of this module with [aws_flow_log resource](https://www.terraform.io/docs/providers/aws/r/flow_log.html).

+### Permissions Boundary
+
+If your organization requires a permissions boundary to be attached to the VPC Flow Log role, make sure that you specify an ARN of the permissions boundary policy as `vpc_flow_log_permissions_boundary` argument. Read more about required [IAM policy for publishing flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html#flow-logs-iam).
+
 ## Conditional creation

 Sometimes you need to have a way to create VPC resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_vpc`.
@@ -637,6 +641,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway
 | transferserver\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for Transfer Server endpoint | `list(string)` | `[]` | no |
 | transferserver\_endpoint\_subnet\_ids | The ID of one or more module in which to create a network interface for Transfer Server endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used. | `list(string)` | `[]` | no |
 | vpc\_endpoint\_tags | Additional tags for the VPC Endpoints | `map(string)` | `{}` | no |
+| vpc\_flow\_log\_permissions\_boundary | The ARN of the Permissions Boundary for the VPC Flow Log IAM Role | `string` | `null` | no |
 | vpc\_flow\_log\_tags | Additional tags for the VPC Flow Logs | `map(string)` | `{}` | no |
 | vpc\_tags | Additional tags for the VPC | `map(string)` | `{}` | no |
 | vpn\_gateway\_az | The Availability Zone for the VPN Gateway | `string` | `null` | no |
---
variables.tf
@@ -2117,6 +2117,12 @@ variable "vpc_flow_log_tags" {
   default     = {}
 }

+variable "vpc_flow_log_permissions_boundary" {
+  description = "The ARN of the Permissions Boundary for the VPC Flow Log IAM Role"
+  type        = string
+  default     = null
+}
+
 variable "enable_dhcp_options" {
   description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type"
   type        = bool
---
vpc-flow-logs.tf
@@ -45,8 +45,9 @@ resource "aws_cloudwatch_log_group" "flow_log" {
 resource "aws_iam_role" "vpc_flow_log_cloudwatch" {
   count = local.create_flow_log_cloudwatch_iam_role ? 1 : 0

-  name_prefix        = "vpc-flow-log-role-"
-  assume_role_policy = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  name_prefix          = "vpc-flow-log-role-"
+  assume_role_policy   = data.aws_iam_policy_document.flow_log_cloudwatch_assume_role[0].json
+  permissions_boundary = var.vpc_flow_log_permissions_boundary

   tags = merge(var.tags, var.vpc_flow_log_tags)
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Fixes #530

---

Choice A:
README.md
@@ -224,7 +224,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Version | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-108-route-already-exists/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-108-route-already-exists/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-46-no-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-46-no-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |
 | random | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws    = ">= 2.68"
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---

---

Choice B:
README.md
@@ -224,7 +224,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-108-route-already-exists/README.md
@@ -23,7 +23,7 @@ Note that this example may create Version which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-108-route-already-exists/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-46-no-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-46-no-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |
 | random | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws    = ">= 2.68"
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---

---

Choice C:
README.md
@@ -224,7 +224,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-108-route-already-exists/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-108-route-already-exists/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-46-no-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-46-no-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |
 | random | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws    = ">= 2.68"
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---

---

Choice D:
README.md
@@ -224,7 +224,7 @@ It is possible to integrate this VPC module with [terraform-aws-transit-gateway

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/complete-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/ipv6/README.md
@@ -19,7 +19,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/ipv6/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-108-route-already-exists/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-108-route-already-exists/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-44-asymmetric-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-44-asymmetric-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/issue-46-no-private-subnets/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/issue-46-no-private-subnets/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/manage-default-vpc/README.md
@@ -21,7 +21,7 @@ Run `terraform destroy` when you don't need these resources.

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/manage-default-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/network-acls/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/network-acls/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/secondary-cidr-blocks/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/secondary-cidr-blocks/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/simple-vpc/README.md
@@ -25,7 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/simple-vpc/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---
examples/vpc-flow-logs/README.md
@@ -23,7 +23,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |
 | random | >= 2 |

---
examples/vpc-flow-logs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws    = ">= 2.68"
---
examples/vpc-separate-private-route-tables/README.md
@@ -21,7 +21,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP

 | Name | Version |
 |------|---------|
-| terraform | >= 0.12.7 |
+| terraform | >= 0.12.21 |
 | aws | >= 2.68 |

 ## Providers
---
examples/vpc-separate-private-route-tables/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
   |------|---------|
-|  aws = ">= 2.68"
---
versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.12.7"
+  required_version = ">= 0.12.21"

   required_providers {
     aws = ">= 2.68"
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
This fix sets the value for the `subnet_ids` attribute of the `aws_default_network_acl` to be any subnets created by the module that are not allocated to any other `aws_network_acl` resources.

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
#529

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
This fix involves the usage of the `setsubtract`, `compact`, and `flatten` functions which should not break any backward compatibility.

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->
I did the following:

- Added the `manage_default_network_acl` attribute set as `true` to the `network-acls` example
- `terraform apply`
- Set the `private_dedicated_network_acl` attribute as `false` in the example
- `terraform apply`
- `terraform plan`
- Noticed that the plan was complaining that the previously created subnets would be removed from the `aws_default_network_acl` resource
- `terraform apply`
- `terraform plan`
- Noticed that the plan was *still* complaining that the previously created subnets would be removed from the `aws_default_network_acl` resource
- Implemented my changes to default the `subnet_ids` attribute of the `aws_default_network_acl` resource
- `terraform plan`
- No changes needed
- Set the `private_dedicated_network_acl` attribute back to `true` in the example
- `terraform apply`
- `terraform plan`
- No changes needed

---

Choice A:
examples/network-acls/main.tf
@@ -28,9 +28,11 @@ module "vpc" {
     local.network_acls["elasticache_outbound"],
   )

-  private_dedicated_network_acl     = true
+  private_dedicated_network_acl     = false
   elasticache_dedicated_network_acl = true

+  manage_default_network_acl = true
+
   enable_ipv6 = true

   enable_nat_gateway = false
@@ -200,4 +202,3 @@ locals {

   }
 }
-
---
main.tf
@@ -534,6 +534,27 @@ resource "aws_default_network_acl" "this" {

   default_network_acl_id = element(concat(aws_vpc.this.*.default_network_acl_id, [""]), 0)

+  # The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
+  #   for any of the non-default network ACLs
+  subnet_ids = setsubtract(
+    compact(flatten([
+      aws_subnet.public.*.id,
+      aws_subnet.private.*.id,
+      aws_subnet.intra.*.id,
+      aws_subnet.database.*.id,
+      aws_subnet.redshift.*.id,
+      aws_subnet.elasticache.*.id,
+    ])),
+    compact(flatten([
+      aws_network_acl.public.*.subnet_ids,
+      aws_network_acl.private.*.subnet_ids,
+      aws_network_acl.intra.*.subnet_ids,
+      aws_network_acl.database.*.subnet_ids,
+      aws_network_acl.redshift.*.subnet_ids,
+      aws_network_acl.elasticache.*.subnet_ids,
+    ]))
+  )
+
   dynamic "ingress" {
     for_each = var.default_network_acl_ingress
     content {
---

---

Choice B:
examples/network-acls/main.tf
@@ -28,9 +28,11 @@ module "vpc" {
     local.network_acls["elasticache_outbound"],
   )

-  private_dedicated_network_acl     = true
+       = false
   elasticache_dedicated_network_acl = true

+  manage_default_network_acl = true
+
   enable_ipv6 = true

   enable_nat_gateway = false
@@ -200,4 +202,3 @@ locals {
     ]
   }
 }
-
---
main.tf
@@ -534,6 +534,27 @@ resource "aws_default_network_acl" "this" {

   default_network_acl_id = element(concat(aws_vpc.this.*.default_network_acl_id, [""]), 0)

+  # The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
+  #   for any of the non-default network ACLs
+  subnet_ids = setsubtract(
+    compact(flatten([
+      aws_subnet.public.*.id,
+      aws_subnet.private.*.id,
+      aws_subnet.intra.*.id,
+      aws_subnet.database.*.id,
+      aws_subnet.redshift.*.id,
+      aws_subnet.elasticache.*.id,
+    ])),
+    compact(flatten([
+      aws_network_acl.public.*.subnet_ids,
+      aws_network_acl.private.*.subnet_ids,
+      aws_network_acl.intra.*.subnet_ids,
+      aws_network_acl.database.*.subnet_ids,
+      aws_network_acl.redshift.*.subnet_ids,
+      aws_network_acl.elasticache.*.subnet_ids,
+    ]))
+  )
+
   dynamic "ingress" {
     for_each = var.default_network_acl_ingress
     content {
---

---

Choice C:
examples/network-acls/main.tf
@@ -28,9 +28,11 @@ module "vpc" {
     local.network_acls["elasticache_outbound"],
   )

-  private_dedicated_network_acl     = true
+  private_dedicated_network_acl     = false
   elasticache_dedicated_network_acl = true

+  manage_default_network_acl = true
+
   enable_ipv6 = true

   enable_nat_gateway = false
@@ -200,4 +202,3 @@ locals {
     ]
   }
 }
-
---
main.tf
@@ -534,6 +534,27 @@ resource "aws_default_network_acl" "this" {

   default_network_acl_id = element(concat(aws_vpc.this.*.default_network_acl_id, [""]), 0)

+  # The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
+  #   for any of the non-default network ACLs
+  subnet_ids = setsubtract(
+    compact(flatten([
+      aws_subnet.public.*.id,
+      aws_subnet.private.*.id,
+      aws_subnet.intra.*.id,
+      aws_subnet.database.*.id,
+      aws_subnet.redshift.*.id,
+      aws_subnet.elasticache.*.id,
+    ])),
+    compact(flatten([
+      aws_network_acl.public.*.subnet_ids,
+      aws_network_acl.private.*.subnet_ids,
+      aws_network_acl.intra.*.subnet_ids,
+      aws_network_acl.database.*.subnet_ids,
+      aws_network_acl.redshift.*.subnet_ids,
+      aws_network_acl.elasticache.*.subnet_ids,
+    ]))
+  )
+
   dynamic "ingress" {
     for_each = var.default_network_acl_ingress
     content {
---

---

Choice D:
examples/network-acls/main.tf
@@ -28,9 +28,11 @@ module "vpc" {
     local.network_acls["elasticache_outbound"],
   )

-  private_dedicated_network_acl     = true
+  private_dedicated_network_acl     = false
   elasticache_dedicated_network_acl = true

+  manage_default_network_acl = true
+
   enable_ipv6 = true

   enable_nat_gateway = false
@@ -200,4 +202,3 @@ locals {
     ]
   }
 }
-
---
main.tf
@@ -534,6 +534,27 @@ resource "aws_default_network_acl" "this" {

   default_network_acl_id = element(concat(aws_vpc.this.*.default_network_acl_id, [""]), 0)

+  # The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
+  #   for any of the non-default network ACLs
+  subnet_ids = setsubtract(
+    compact(flatten([
+      aws_subnet.public.*.id,
+      aws_subnet.private.*.id,
+      aws_subnet.intra.*.id,
+      aws_subnet.database.*.id,
+      aws_subnet.redshift.*.id,
+      aws_subnet.elasticache.*.id,
+    ])),
+    compact(flatten([
+      aws_network_acl.public.*.subnet_ids,
+      aws_network_acl.private.*.subnet_ids,
+      aws_network_acl.intra.*.subnet_ids,
+      aws_network_acl.database.*.subnet_ids,
+      aws_network_acl.redshift.*.subnet_ids,
+      aws_network_acl.elasticache.*.subnet_ids,
+    ]))
+  )
+
   dynamic "ingress" {
     for_each = var.default_network_acl_ingress
     content {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested VPC networking change safely. Only respond with a single uppercase letter.

Task Description:
Follow up to #525
Related to https://github.com/hashicorp/terraform/pull/26387

---

Choice A:
main.tf
@@ -570,10 +570,6 @@ resource "aws_default_network_acl" "this" {
     var.tags,
     var.default_network_acl_tags,
   )
-
-  lifecycle {
-    ignore_changes = [subnet_ids]
-  }
 }

 ########################
---

---

Choice B:
main.tf
@@ -570,10 +570,6 @@ resource "aws_default_network_acl" "this" {
     var.tags,
     var.default_network_acl_tags,
   )
-
-  lifecycle {
-    ignore_changes = [subnet_ids]
-  }
 }

 ########################
---

---

Choice C:
main.tf
@@ -570,10 +570,6 @@ resource "aws_default_network_acl" "this" {
     var.tags,
     var.default_network_acl_tags,
   )
-
-  lifecycle {
-    ignore_changes = [subnet_ids]
-  }
 }

 ########################
---

---

Choice D:
main.tf
@@ -570,10 +570,6 @@ resource "aws_default_network_acl" -570,10 {
     var.tags,
     var.default_network_acl_tags,
   )
-
-  lifecycle {
-    ignore_changes = [subnet_ids]
-  }
 }

 ########################
---

---