diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100755
index 0000000..47453ca
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,23 @@
+FROM mcr.microsoft.com/devcontainers/base:jammy
+
+# install aws
+RUN apt-get update && \
+    apt-get install -y unzip python3-pip && \
+    pip3 install --no-cache-dir --upgrade awscli && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# install terraform
+ENV TERRAFORM_VERSION=1.5.1
+ENV TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache
+RUN SYSTEM_ARCH=$(dpkg --print-architecture) \
+    && mkdir -p $TF_PLUGIN_CACHE_DIR \
+    && curl -OL https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip \
+    && unzip terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip \
+    && mv terraform /usr/local/bin/ \
+    && terraform version \
+    && rm terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip
+
+# verify installs
+RUN terraform --version \
+    && aws --version
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100755
index 0000000..82c5db6
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,40 @@
+{
+  "name": "Terraform",
+  "dockerFile": "Dockerfile",
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:2.0.1": {},
+  },
+  "mounts": [
+    "source=${localEnv:HOME}/.aws,target=${env:HOME}/.aws,type=bind,consistency=cached"
+  ],
+  "containerEnv": {
+    "TF_PLUGIN_CACHE_DIR": "/workspaces/terraform-aws-vpc-network/.devcontainer/tmp/.terraform.d/"
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "editor.codeActionsOnSave": {
+          "source.fixAll": true
+        },
+        "editor.formatOnSave": true,
+        "editor.formatOnType": false,
+        "editor.inlineSuggest.enabled": true,
+        "terminal.integrated.shell.linux": "/bin/bash",
+        "[markdown]": {
+          "editor.rulers": [
+            80
+          ]
+        }
+      },
+      "extensions": [
+        "darkriszty.markdown-table-prettify",
+        "editorconfig.editorconfig",
+        "github.copilot",
+        "github.copilot-chat",
+        "github.vscode-github-actions",
+        "hashicorp.terraform",
+        "VisualStudioExptTeam.vscodeintellicode",
+      ],
+    }
+  },
+}
\ No newline at end of file
diff --git a/.editorconfig b/.editorconfig
new file mode 100755
index 0000000..0cd22c7
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,26 @@
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[{Dockerfile,Dockerfile.*}]
+indent_size = 4
+tab_width = 4
+
+[{Makefile,makefile,GNUmakefile}]
+indent_style = tab
+indent_size = 4
+
+[Makefile.*]
+indent_style = tab
+indent_size = 4
+
+[**/*.{go,mod,sum}]
+indent_style = tab
+indent_size = unset
+
+[**/*.py]
+indent_size = 4
diff --git a/.github/.dependabot.yml b/.github/.dependabot.yml
new file mode 100644
index 0000000..1230149
--- /dev/null
+++ b/.github/.dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..879c67c
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,43 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3.7.0
+        with:
+          node-version: 18
+      - name: Tests for auth-at-edge
+        run: |
+          cd assets/cf-mw-auth
+          npm install
+          npm test
+      - name: Tests for url-rewriter
+        run: |
+          cd assets/cf-mw-urlrewrite
+          npm install
+          npm test
+      - name: Bump Version
+        id: tag_version
+        uses: mathieudutour/github-tag-action@v6.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          default_bump: minor
+          custom_release_rules: bug:patch:Fixes,chore:patch:Chores,docs:patch:Documentation,feat:minor:Features,refactor:minor:Refactors,test:patch:Tests,ci:patch:Development,dev:patch:Development
+      - name: Create Release
+        uses: ncipollo/release-action@v1.12.0
+        with:
+          tag: ${{ steps.tag_version.outputs.new_tag }}
+          name: ${{ steps.tag_version.outputs.new_tag }}
+          body: ${{ steps.tag_version.outputs.changelog }}
diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml
new file mode 100644
index 0000000..2e5d44f
--- /dev/null
+++ b/.github/workflows/semantic-check.yml
@@ -0,0 +1,26 @@
+name: semantic-check
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  main:
+    name: Semantic Commit Message Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+      - uses: amannn/action-semantic-pull-request@v5.2.0
+        name: Check PR for Semantic Commit Message
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          requireScope: false
+          validateSingleCommit: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..80ec60b
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,27 @@
+name: test
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3.7.0
+        with:
+          node-version: 18
+      - name: Tests for auth-at-edge
+        run: |
+          cd assets/cf-mw-auth
+          npm install
+          npm test
+      - name: Tests for url-rewriter
+        run: |
+          cd assets/cf-mw-urlrewrite
+          npm install
+          npm test
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..59b7e01
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,61 @@
+# .gitignore
+
+# terraform files
+.terraform.lock.hcl
+.terraform.tfstate.lock.info
+*.tfstate
+*.tfstate.*.backup
+*.tfstate.backup
+*.tfplan
+*.terraform/
+*.tfvars
+.grunt
+
+# node.js / typescript
+node_modules
+npm-debug.log
+yarn-error.log
+dist
+out
+*.tsbuildinfo
+
+# logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# coverage directories
+coverage
+lib-cov
+
+# docker files
+*.tar
+dockerfile.*.bak
+
+# general
+tmp/
+!**/.gitkeep
+.DS_Store
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# ides
+.vscode
+.idea
+*.swp
+*.swo
+
+# opa
+bundle.tar.gz
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..da22803
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,82 @@
+# Contributing
+
+We welcome contributions to the project. This document provides information and
+guidelines for contributing.
+
+## Development Environment
+
+This repository includes a configuration for a development container using the
+[VS Code Remote - Containers extension](https://code.visualstudio.com/docs/remote/containers).
+This setup allows you to develop within a Docker container that already has all
+the necessary tools and dependencies installed.
+
+The development container is based on Ubuntu 22.04 (Jammy) and includes the
+following tools:
+
+- AWS CLI
+- Terraform
+
+### Prerequisites
+
+- [Docker](https://www.docker.com/products/docker-desktop) installed on your
+  local machine.
+- [Visual Studio Code](https://code.visualstudio.com/) installed on your
+  local machine.
+- [Remote - Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+  for Visual Studio Code.
+
+### Usage
+
+1. Clone and open this repository:
+
+    ```bash
+    git clone https://github.com/sgtoj/terraform-aws-vpc-network.git
+    code terraform-aws-vpc-network
+    ```
+
+2. When prompted to "Reopen in Container", click "Reopen in Container". This
+   will start building the Docker image for the development container. If you're
+   not prompted, you can open the Command Palette (F1 or Ctrl+Shift+P), and run
+   the "Remote-Containers: Reopen Folder in Container" command.
+
+3. After the development container is built and started, you can use the
+   Terminal in Visual Studio Code to interact with the container. All commands
+  you run in the Terminal will be executed inside the container.
+
+### Troubleshooting
+
+If you encounter any issues while using the development container, you can try
+rebuilding the container. To do this, open the Command Palette and run the
+"Remote-Containers: Rebuild Container" command.
+
+## Contribution Guidelines
+
+We appreciate your interest in contributing to the project. Here are some
+guidelines to help ensure your contributions are accepted.
+
+### Issues
+
+- Use the GitHub issue tracker to report bugs or propose new features.
+- Before submitting a new issue, please search to make sure it has not already
+  been reported. If it has, add a comment to the existing issue instead of
+  creating a new one.
+- When reporting a bug, include as much detail as you can. Include the version
+  of the module you're using, what you expected to happen, what actually
+  happened, and steps to reproduce the bug.
+
+### Pull Requests
+
+- Submit your changes as a pull request.
+- All pull requests should be associated with an issue. If your change isn't
+  associated with an existing issue, please create one before submitting a pull
+  request.
+- In your pull request, include a summary of the changes, the issue number it
+  resolves, and any additional information that might be helpful for
+  understanding your changes.
+- Make sure your changes do not break any existing functionality. If your
+  changes require updates to existing tests or the addition of new ones, include
+  those in your pull request.
+- Follow the existing code style. We use a linter to maintain code quality, so
+  make sure your changes pass the linter checks.
+
+Thank you for your contributions!
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..895c8d4
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 CruxStack LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..aa0fdaf
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,24 @@
+PROJ_ROOT := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+
+# allows args to pass to run-cmd example: make run-cmd echo "hello world"
+ifeq (run-cmd,$(firstword $(MAKECMDGOALS)))
+  RUN_ARGS := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
+  $(eval $(RUN_ARGS):;@:)
+endif
+
+all: deps build
+	@exit 0
+
+deps:
+	@exit 0
+
+build:
+	@exit 0
+
+clean:
+	@find . -type d -name "dist" -exec rm -rf {} +
+	@find . -type d -name ".terraform" -exec rm -rf {} +
+	@find . -type d -name ".terraform.d" -exec rm -rf {} +
+	@find . -type d -name ".tfstate" -exec rm -rf {} +
+	@find . -type d -name ".tfstate.backup" -exec rm -rf {} +
+	@touch .devcontainer/.terraform.d/.gitkeep || true
diff --git a/README.md b/README.md
new file mode 100755
index 0000000..af2bc8a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,63 @@
+# Terraform Module: AWS VPC Network
+
+This Terraform module deploys a complete Virtual Private Cloud (VPC) network on
+AWS with sensible defaults. It creates a VPC, public and private subnets, a NAT
+gateway, VPC flow logs, and optional VPC endpoints.
+
+## Usage
+
+```hcl
+module "vpc_network" {
+  source  = "cruxstack/vpc-network/aws"
+  version = "x.x.x"
+
+  vpc_ipv4_cidr             = "10.0.0.0/16"
+  availability_zones        = ["us-west-2a", "us-west-2b", "us-west-2c"]
+  vpc_flow_logs_destination = "your-flowlogs-bucket"
+}
+```
+
+## Inputs
+
+In addition to the variables documented below, this module includes several
+other optional variables (e.g., `name`, `tags`, etc.) provided by the
+`cloudposse/label/null` module. Please refer to the [`cloudposse/label` documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest)
+for more details on these variables.
+
+| Name                             | Description                                                                                      |  Type  |  Default  | Required |
+|----------------------------------|--------------------------------------------------------------------------------------------------|:------:|:---------:|:--------:|
+| `vpc_ipv4_cidr`                  | Primary IPv4 CIDR block for the VPC.                                                             | string |   None    |   Yes    |
+| `vpc_ipv6_cidr_auto_assigned`    | Toggle for assigning AWS generated IPv6 CIDR block to the VPC.                                   |  bool  |   false   |    No    |
+| `availability_zones`             | List of Availability Zones (AZs) for subnet creation. Ignored if `availability_zone_ids` is set. |  list  |    []     |    No    |
+| `availability_zone_ids`          | List of AZ IDs for subnet creation. Overrides `availability_zones`.                              |  list  |    []     |    No    |
+| `subnet_max_count`               | Maximum number of subnets to deploy. `0` deploys a subnet for each availability zone.            | number |     0     |    No    |
+| `public_subnets_enabled`         | Toggle for creating public subnets. If false, public subnets won't be created.                   |  bool  |   true    |    No    |
+| `public_subnets_auto_assign_ip`  | Toggle for assigning a public IP address to instances in a public subnet.                        |  bool  |   true    |    No    |
+| `nat_type`                       | Type of NAT to create. Can be `gateway` or `instance`.                                           | string | "gateway" |    No    |
+| `vpc_flow_logs_enabled`          | Toggle for VPC Flow Logs.                                                                        |  bool  |   true    |    No    |
+| `vpc_flow_logs_traffic_type`     | Type of traffic to capture. Can be `ACCEPT`, `REJECT`, or `ALL`.                                 | string |   "ALL"   |    No    |
+| `vpc_flow_logs_destination_type` | Type of the logging destination. Can be `cloud-watch-logs` or `s3`.                              | string |   "s3"    |    No    |
+| `aws_region_name`                | AWS Region.                                                                                      | string |    ""     |    No    |
+| `aws_account_id`                 | AWS account ID.                                                                                  | string |    ""     |    No    |
+
+## Outputs
+
+| Name                      | Description                                               |
+|---------------------------|-----------------------------------------------------------|
+| `vpc_id`                  | ID of the VPC.                                            |
+| `vpc_ipv4_cidr`           | CIDR of the VPC.                                          |
+| `availability_zones`      | List of Availability Zones where subnets were created.    |
+| `az_private_subnets_map`  | Map of AZ names to list of private subnet IDs in the AZs. |
+| `az_public_subnets_map`   | Map of AZ names to list of public subnet IDs in the AZs.  |
+| `public_subnet_ids`       | IDs of the public subnets.                                |
+| `public_subnet_cidrs`     | CIDRs of the public subnets.                              |
+| `private_subnet_ids`      | IDs of the private subnets.                               |
+| `private_subnet_cidrs`    | CIDRs of the private subnets.                             |
+| `private_route_table_ids` | IDs of the private subnet route tables.                   |
+| `public_route_table_ids`  | IDs of the public subnet route tables.                    |
+
+## Contributing
+
+We welcome contributions to this project. For information on setting up a
+development environment and how to make a contribution, see [CONTRIBUTING](./CONTRIBUTING.md)
+documentation.
diff --git a/context.tf b/context.tf
new file mode 100755
index 0000000..873244c
--- /dev/null
+++ b/context.tf
@@ -0,0 +1,277 @@
+#
+# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
+# All other instances of this file should be a copy of that one
+#
+#
+# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
+# and then place it in your Terraform module to automatically get
+# Cloud Posse's standard configuration inputs suitable for passing
+# to Cloud Posse modules.
+#
+# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
+#
+# Modules should access the whole context as `module.this.context`
+# to get the input variables with nulls for defaults,
+# for example `context = module.this.context`,
+# and access individual variables as `module.this.<var>`,
+# with final values filled in.
+#
+# For example, when using defaults, `module.this.context.delimiter`
+# will be null, and `module.this.delimiter` will be `-` (hyphen).
+#
+
+module "this" {
+  source  = "cloudposse/label/null"
+  version = "0.25.0" # requires Terraform >= 0.13.0
+
+  enabled             = var.enabled
+  namespace           = var.namespace
+  tenant              = var.tenant
+  environment         = var.environment
+  stage               = var.stage
+  name                = var.name
+  delimiter           = var.delimiter
+  attributes          = var.attributes
+  tags                = var.tags
+  additional_tag_map  = var.additional_tag_map
+  label_order         = var.label_order
+  regex_replace_chars = var.regex_replace_chars
+  id_length_limit     = var.id_length_limit
+  label_key_case      = var.label_key_case
+  label_value_case    = var.label_value_case
+  descriptor_formats  = var.descriptor_formats
+  labels_as_tags      = var.labels_as_tags
+
+  context = var.context
+}
+
+# Copy contents of cloudposse/terraform-null-label/variables.tf here
+
+variable "context" {
+  type = any
+  default = {
+    enabled             = true
+    namespace           = null
+    tenant              = null
+    environment         = null
+    stage               = null
+    name                = null
+    delimiter           = null
+    attributes          = []
+    tags                = {}
+    additional_tag_map  = {}
+    regex_replace_chars = null
+    label_order         = []
+    id_length_limit     = null
+    label_key_case      = null
+    label_value_case    = null
+    descriptor_formats  = {}
+    # Note: we have to use [] instead of null for unset lists due to
+    # https://github.com/hashicorp/terraform/issues/28137
+    # which was not fixed until Terraform 1.0.0,
+    # but we want the default to be all the labels in `label_order`
+    # and we want users to be able to prevent all tag generation
+    # by setting `labels_as_tags` to `[]`, so we need
+    # a different sentinel to indicate "default"
+    labels_as_tags = ["unset"]
+  }
+  description = <<-EOT
+    Single object for setting entire context at once.
+    See description of individual variables for details.
+    Leave string and numeric variables as `null` to use default value.
+    Individual variable settings (non-null) override settings in context object,
+    except for attributes, tags, and additional_tag_map, which are merged.
+  EOT
+
+  validation {
+    condition     = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`."
+  }
+
+  validation {
+    condition     = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+  }
+}
+
+variable "enabled" {
+  type        = bool
+  default     = null
+  description = "Set to false to prevent the module from creating any resources"
+}
+
+variable "namespace" {
+  type        = string
+  default     = null
+  description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
+}
+
+variable "tenant" {
+  type        = string
+  default     = null
+  description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
+}
+
+variable "environment" {
+  type        = string
+  default     = null
+  description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
+}
+
+variable "stage" {
+  type        = string
+  default     = null
+  description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
+}
+
+variable "name" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
+    This is the only ID element not also included as a `tag`.
+    The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
+    EOT
+}
+
+variable "delimiter" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Delimiter to be used between ID elements.
+    Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
+  EOT
+}
+
+variable "attributes" {
+  type        = list(string)
+  default     = []
+  description = <<-EOT
+    ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
+    in the order they appear in the list. New attributes are appended to the
+    end of the list. The elements of the list are joined by the `delimiter`
+    and treated as a single ID element.
+    EOT
+}
+
+variable "labels_as_tags" {
+  type        = set(string)
+  default     = ["default"]
+  description = <<-EOT
+    Set of labels (ID elements) to include as tags in the `tags` output.
+    Default is to include all labels.
+    Tags with empty values will not be included in the `tags` output.
+    Set to `[]` to suppress all generated tags.
+    **Notes:**
+      The value of the `name` tag, if included, will be the `id`, not the `name`.
+      Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
+      changed in later chained modules. Attempts to change it will be silently ignored.
+    EOT
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = <<-EOT
+    Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
+    Neither the tag keys nor the tag values will be modified by this module.
+    EOT
+}
+
+variable "additional_tag_map" {
+  type        = map(string)
+  default     = {}
+  description = <<-EOT
+    Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
+    This is for some rare cases where resources want additional configuration of tags
+    and therefore take a list of maps with tag key, value, and additional configuration.
+    EOT
+}
+
+variable "label_order" {
+  type        = list(string)
+  default     = null
+  description = <<-EOT
+    The order in which the labels (ID elements) appear in the `id`.
+    Defaults to ["namespace", "environment", "stage", "name", "attributes"].
+    You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
+    EOT
+}
+
+variable "regex_replace_chars" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Terraform regular expression (regex) string.
+    Characters matching the regex will be removed from the ID elements.
+    If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
+  EOT
+}
+
+variable "id_length_limit" {
+  type        = number
+  default     = null
+  description = <<-EOT
+    Limit `id` to this many characters (minimum 6).
+    Set to `0` for unlimited length.
+    Set to `null` for keep the existing setting, which defaults to `0`.
+    Does not affect `id_full`.
+  EOT
+  validation {
+    condition     = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
+    error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
+  }
+}
+
+variable "label_key_case" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Controls the letter case of the `tags` keys (label names) for tags generated by this module.
+    Does not affect keys of tags passed in via the `tags` input.
+    Possible values: `lower`, `title`, `upper`.
+    Default value: `title`.
+  EOT
+
+  validation {
+    condition     = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
+    error_message = "Allowed values: `lower`, `title`, `upper`."
+  }
+}
+
+variable "label_value_case" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Controls the letter case of ID elements (labels) as included in `id`,
+    set as tag values, and output by this module individually.
+    Does not affect values of tags passed in via the `tags` input.
+    Possible values: `lower`, `title`, `upper` and `none` (no transformation).
+    Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
+    Default value: `lower`.
+  EOT
+
+  validation {
+    condition     = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
+    error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+  }
+}
+
+variable "descriptor_formats" {
+  type        = any
+  default     = {}
+  description = <<-EOT
+    Describe additional descriptors to be output in the `descriptors` output map.
+    Map of maps. Keys are names of descriptors. Values are maps of the form
+    `{
+       format = string
+       labels = list(string)
+    }`
+    (Type is `any` so the map values can later be enhanced to provide additional options.)
+    `format` is a Terraform format string to be passed to the `format()` function.
+    `labels` is a list of labels, in order, to pass to `format()` function.
+    Label values will be normalized before being passed to `format()` so they will be
+    identical to how they appear in `id`.
+    Default is `{}` (`descriptors` output will be empty).
+    EOT
+}
\ No newline at end of file
diff --git a/examples/complete/README.md b/examples/complete/README.md
new file mode 100644
index 0000000..467a324
--- /dev/null
+++ b/examples/complete/README.md
@@ -0,0 +1,28 @@
+# Example: Complete
+
+This example provides a complete use case scenario for the VPC module. It
+creates a Virtual Private Cloud (VPC) with a specific IP CIDR range, NAT type,
+and availability zones.
+
+## Usage
+
+To run this example, run as-is or provide your own values for the following
+variables in a `.terraform.tfvars` file:
+
+```hcl
+availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
+vpc_ipv4_cidr      = "10.0.0.0/16"
+nat_type           = "instance"
+```
+
+## Inputs
+
+| Name                 | Description                                              | Type         | Default                                      | Required |
+|----------------------|----------------------------------------------------------|--------------|----------------------------------------------|:--------:|
+| `availability_zones` | A list of availability zones in which to create the VPC. | list(string) | `["us-east-1a", "us-east-1b", "us-east-1c"]` |    no    |
+| `vpc_ipv4_cidr`      | The IPv4 network range for the VPC, in CIDR notation.    | string       | `"10.0.0.0/16"`                              |    no    |
+| `nat_type`           | The type of NAT device to create.                        | string       | `"instance"`                                 |    no    |
+
+## Outputs
+
+_This module does not define any outputs._
diff --git a/examples/complete/main.tf b/examples/complete/main.tf
new file mode 100755
index 0000000..35a3f87
--- /dev/null
+++ b/examples/complete/main.tf
@@ -0,0 +1,9 @@
+module "vpc" {
+  source = "../../"
+
+  name                  = "tfexample-complete"
+  availability_zones    = var.availability_zones
+  vpc_ipv4_cidr         = var.vpc_ipv4_cidr
+  nat_type              = var.nat_type
+  vpc_flow_logs_enabled = false
+}
diff --git a/examples/complete/output.tf b/examples/complete/output.tf
new file mode 100644
index 0000000..e69de29
diff --git a/examples/complete/provider.tf b/examples/complete/provider.tf
new file mode 100755
index 0000000..c125940
--- /dev/null
+++ b/examples/complete/provider.tf
@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "us-east-1"
+}
diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf
new file mode 100644
index 0000000..11c2c39
--- /dev/null
+++ b/examples/complete/variables.tf
@@ -0,0 +1,14 @@
+variable "availability_zones" {
+  type    = list(string)
+  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
+}
+
+variable "vpc_ipv4_cidr" {
+  type    = list(string)
+  default = "10.0.0.0/16"
+}
+
+variable "nat_type" {
+  type    = list(string)
+  default = "instance"
+}
diff --git a/examples/complete/version.tf b/examples/complete/version.tf
new file mode 100644
index 0000000..5ff2f3a
--- /dev/null
+++ b/examples/complete/version.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0.0, < 6.0.0"
+    }
+  }
+}
diff --git a/main.tf b/main.tf
new file mode 100755
index 0000000..6efae2a
--- /dev/null
+++ b/main.tf
@@ -0,0 +1,150 @@
+locals {
+  enabled                               = module.this.enabled
+  nat_aws_shield_protection_enabled     = local.enabled && var.nat_aws_shield_protection_enabled
+  privatelink_enabled                   = local.enabled && (local.privatelink_vpc_endpoints_enabled || local.privatelink_gateway_endpoints_enabled)
+  privatelink_vpc_endpoints_enabled     = local.enabled && length(var.privatelink_vpc_endpoints) > 0
+  privatelink_gateway_endpoints_enabled = local.enabled && length(var.privatelink_gateway_endpoints) > 0
+  vpc_flow_logs_enabled                 = local.enabled && var.vpc_flow_logs_enabled
+
+  aws_account_id  = try(coalesce(var.aws_account_id, data.aws_caller_identity.current[0].account_id), "")
+  aws_region_name = try(coalesce(var.aws_region_name, data.aws_region.current[0].name), "")
+
+  subnet_max_count = (
+    var.subnet_max_count > 0 ? var.subnet_max_count : (
+      length(var.availability_zone_ids) > 0 ? length(var.availability_zone_ids) : length(var.availability_zones)
+    )
+  )
+  privatelink_gateway_endpoint_map = {
+    for v in var.privatelink_gateway_endpoints : lower(v) => {
+      name            = lower(v)
+      policy          = null
+      route_table_ids = module.subnets.private_route_table_ids
+    }
+  }
+
+  privatelink_vpc_endpoint_sg_key = "vpc-endpoint-interfaces"
+  privatelink_vpc_endpoint_map = {
+    for v in var.privatelink_vpc_endpoints : lower(v) => {
+      name                = lower(v)
+      policy              = null
+      private_dns_enabled = true
+      security_group_ids  = [module.privatelink_vpc_endpoint_sg[local.privatelink_vpc_endpoint_sg_key].id]
+      subnet_ids          = module.subnets.private_subnet_ids
+    }
+  }
+}
+
+data "aws_caller_identity" "current" {
+  count = module.this.enabled && var.aws_account_id == "" ? 1 : 0
+}
+
+data "aws_region" "current" {
+  count = module.this.enabled && var.aws_region_name == "" ? 1 : 0
+}
+
+# ====================================================================== vpc ===
+
+module "vpc" {
+  source  = "cloudposse/vpc/aws"
+  version = "2.1.0"
+
+  ipv4_primary_cidr_block          = var.vpc_ipv4_cidr
+  assign_generated_ipv6_cidr_block = var.vpc_ipv6_cidr_auto_assigned
+  internet_gateway_enabled         = var.public_subnets_enabled
+  dns_hostnames_enabled            = true
+  dns_support_enabled              = true
+
+  context = module.this.context
+}
+
+module "subnets" {
+  source  = "cloudposse/dynamic-subnets/aws"
+  version = "2.4.1"
+
+  availability_zones              = var.availability_zones
+  availability_zone_ids           = var.availability_zone_ids
+  ipv4_cidr_block                 = [module.vpc.vpc_cidr_block]
+  ipv4_cidrs                      = var.subnet_ipv4_cidrs
+  ipv6_enabled                    = false
+  igw_id                          = var.public_subnets_enabled ? [module.vpc.igw_id] : []
+  map_public_ip_on_launch         = var.public_subnets_auto_assign_ip
+  max_subnet_count                = local.subnet_max_count
+  nat_gateway_enabled             = lower(var.nat_type) == "gateway"
+  nat_instance_enabled            = lower(var.nat_type) == "instance"
+  nat_instance_type               = var.nat_instance_size
+  public_subnets_enabled          = var.public_subnets_enabled
+  public_subnets_additional_tags  = var.public_subnets_extra_tags
+  private_subnets_additional_tags = var.private_subnets_extra_tags
+  vpc_id                          = module.vpc.vpc_id
+
+  context = module.this.context
+}
+
+# -------------------------------------------------------------- privatelink ---
+
+module "privatelink_vpc_endpoint_sg" {
+  for_each = local.privatelink_vpc_endpoints_enabled ? toset([local.privatelink_vpc_endpoint_sg_key]) : []
+
+  source  = "cloudposse/security-group/aws"
+  version = "2.1.0"
+
+  create_before_destroy      = true
+  preserve_security_group_id = false
+  attributes                 = [each.value]
+  vpc_id                     = module.vpc.vpc_id
+  allow_all_egress           = true
+
+  rules_map = {
+    ingress = [{
+      key              = "vpc_ingress"
+      type             = "ingress"
+      from_port        = 0
+      to_port          = 65535
+      protocol         = "-1" # allow ping
+      cidr_blocks      = compact(concat([module.vpc.vpc_cidr_block], module.vpc.additional_cidr_blocks))
+      ipv6_cidr_blocks = compact(concat([module.vpc.vpc_ipv6_cidr_block], module.vpc.additional_ipv6_cidr_blocks))
+      description      = "ingress from vpc to ${each.value}"
+    }]
+  }
+
+  context = module.this.context
+}
+
+module "privatelink_vpc_endpoints" {
+  source  = "cloudposse/vpc/aws//modules/vpc-endpoints"
+  version = "2.1.0"
+
+  enabled                 = local.privatelink_enabled
+  vpc_id                  = module.vpc.vpc_id
+  gateway_vpc_endpoints   = local.privatelink_gateway_endpoint_map
+  interface_vpc_endpoints = local.privatelink_vpc_endpoint_map
+
+  context = module.this.context
+}
+
+# ------------------------------------------------------------------- shield ---
+
+data "aws_eip" "nat" {
+  for_each  = local.nat_aws_shield_protection_enabled ? toset(module.subnets.nat_ips) : []
+  public_ip = each.key
+}
+
+resource "aws_shield_protection" "nat" {
+  for_each = local.nat_aws_shield_protection_enabled ? data.aws_eip.nat : {}
+
+  name         = data.aws_eip.nat[each.key].id
+  resource_arn = "arn:aws:ec2:${local.aws_region_name}:${local.aws_account_id}:eip-allocation/${data.aws_eip.nat[each.key].id}"
+}
+
+# ---------------------------------------------------------------- flow-logs ---
+
+resource "aws_flow_log" "this" {
+  count = local.vpc_flow_logs_enabled ? 1 : 0
+
+  log_destination      = var.vpc_flow_logs_destination
+  log_destination_type = lower(var.vpc_flow_logs_destination_type)
+  traffic_type         = upper(var.vpc_flow_logs_traffic_type)
+  vpc_id               = module.vpc.vpc_id
+
+  tags = module.this.tags
+}
diff --git a/outputs.tf b/outputs.tf
new file mode 100755
index 0000000..f2f1474
--- /dev/null
+++ b/outputs.tf
@@ -0,0 +1,100 @@
+# ====================================================================== vpc ===
+
+output "vpc_id" {
+  value       = module.vpc.vpc_id
+  description = "ID of the VPC."
+}
+
+output "vpc_ipv4_cidr" {
+  value       = module.vpc.vpc_cidr_block
+  description = "CIDR of the VPC."
+}
+
+output "availability_zones" {
+  description = <<-EOF
+    List of Availability Zones where subnets were created.
+  EOF
+  value       = module.subnets.availability_zones
+}
+
+output "az_private_subnets_map" {
+  description = <<-EOF
+    Map of AZ names to list of private subnet IDs in the AZs.
+  EOF
+  value       = module.subnets.az_private_subnets_map
+}
+
+output "az_public_subnets_map" {
+  description = <<-EOF
+    Map of AZ names to list of public subnet IDs in the AZs.
+  EOF
+  value       = module.subnets.az_public_subnets_map
+}
+
+output "public_subnet_ids" {
+  value       = module.subnets.public_subnet_ids
+  description = "IDs of the public subnets."
+}
+
+output "public_subnet_cidrs" {
+  value       = module.subnets.public_subnet_cidrs
+  description = "CIDRs of the public subnets."
+}
+
+output "private_subnet_ids" {
+  value       = module.subnets.private_subnet_ids
+  description = "IDs of the private subnets."
+}
+
+output "private_subnet_cidrs" {
+  value       = module.subnets.private_subnet_cidrs
+  description = "CIDRs of the private subnets."
+}
+
+output "private_route_table_ids" {
+  value       = module.subnets.private_route_table_ids
+  description = "IDs of the private subnet route tables."
+}
+
+output "public_route_table_ids" {
+  value       = module.subnets.public_route_table_ids
+  description = "IDs of the public subnet route tables."
+}
+
+# ----------------------------------------------------------------- defaults ---
+
+output "vpc_default_network_acl_id" {
+  value       = module.vpc.vpc_default_network_acl_id
+  description = "ID of the default network ACL created on VPC creation."
+}
+
+output "vpc_default_security_group_id" {
+  value       = module.vpc.vpc_default_security_group_id
+  description = "ID of the default security group created on VPC creation."
+}
+
+# ---------------------------------------------------------------------- nat ---
+
+output "nat_ids" {
+  value       = coalescelist(module.subnets.nat_gateway_ids, module.subnets.nat_instance_ids)
+  description = "IDs of the NAT Gateways."
+}
+
+output "nat_gateway_public_ips" {
+  value       = module.subnets.nat_gateway_public_ips
+  description = "Public IPs of the NAT Gateways."
+}
+
+output "nat_eip_protections" {
+  description = "List of AWS Shield Advanced Protections for NAT Elastic IPs."
+  value       = aws_shield_protection.nat
+}
+
+# -------------------------------------------------------------- privatelink ---
+
+output "privatelink_vpc_endpoints" {
+  description = <<-EOF
+    List of Interface VPC Endpoints in this VPC.
+  EOF
+  value       = try(module.privatelink_vpc_endpoints[0].interface_vpc_endpoints, [])
+}
diff --git a/variables.tf b/variables.tf
new file mode 100755
index 0000000..b6d3305
--- /dev/null
+++ b/variables.tf
@@ -0,0 +1,162 @@
+# ====================================================================== vpc ===
+
+variable "vpc_ipv4_cidr" {
+  type        = string
+  description = "Primary IPv4 CIDR block for the VPC."
+}
+
+variable "vpc_ipv6_cidr_auto_assigned" {
+  type        = bool
+  description = "Toggle for assigning AWS generated IPv6 CIDR block to the VPC."
+  default     = false
+}
+
+variable "availability_zones" {
+  type        = list(string)
+  description = <<-EOF
+    List of Availability Zones (AZs) for subnet creation. Must be stable. Ignored if `availability_zone_ids` is set.
+  EOF
+  default     = []
+}
+
+variable "availability_zone_ids" {
+  type        = list(string)
+  description = "List of AZ IDs for subnet creation. Overrides `availability_zones`."
+  default     = []
+}
+
+variable "subnet_max_count" {
+  type        = number
+  default     = 0
+  description = "Maximum number of subnets to deploy. `0` deploys a subnet for each availability zone."
+}
+
+variable "subnet_ipv4_cidrs" {
+  type = list(object({
+    private = list(string)
+    public  = list(string)
+  }))
+  description = "List of CIDRs for subnets. Must maintain order."
+  default     = []
+}
+
+variable "public_subnets_enabled" {
+  type        = bool
+  description = "Toggle for creating public subnets. If false, public subnets won't be created."
+  default     = true
+}
+
+variable "public_subnets_auto_assign_ip" {
+  type        = bool
+  default     = true
+  description = "Toggle for assigning a public IP address to instances in a public subnet."
+}
+
+variable "public_subnets_extra_tags" {
+  type        = map(string)
+  description = "Extra tags for public subnets."
+  default     = {}
+}
+
+variable "private_subnets_extra_tags" {
+  type        = map(string)
+  description = "Extra tags for NAT subnets."
+  default     = {}
+}
+
+# ---------------------------------------------------------------------- nat ---
+
+variable "nat_type" {
+  type        = string
+  description = "Type of NAT to create. Can be `gateway` or `instance`."
+  default     = "gateway"
+
+  validation {
+    condition     = contains(["gateway", "instance"], lower(var.nat_type))
+    error_message = "Must be either `gateway` or `instance`."
+  }
+}
+
+variable "nat_instance_size" {
+  type        = string
+  description = "Size of the NAT instance. Only used if `nat_type` is set to `instance`."
+  default     = "t3.nano"
+}
+
+variable "nat_aws_shield_protection_enabled" {
+  type        = bool
+  description = <<-EOF
+    Toggle for AWS Shield Advanced protection for NAT EIPs. An active AWS Shield Advanced subscription is required if
+    set to 'true'.
+  EOF
+  default     = false
+}
+
+# ---------------------------------------------------------------- flow-logs ---
+
+variable "vpc_flow_logs_enabled" {
+  type        = bool
+  description = "Toggle for VPC Flow Logs."
+  default     = true
+}
+
+variable "vpc_flow_logs_traffic_type" {
+  type        = string
+  description = "Type of traffic to capture. Can be `ACCEPT`, `REJECT`, or `ALL`."
+  default     = "ALL"
+
+  validation {
+    condition     = contains(["ACCEPT", "REJECT", "ALL"], upper(var.vpc_flow_logs_traffic_type))
+    error_message = "Must be a comma-separated list of `ACCEPT`, `REJECT`, or `ALL`."
+  }
+}
+
+variable "vpc_flow_logs_destination" {
+  type        = string
+  description = "ARN of the logging destination."
+  default     = ""
+}
+
+variable "vpc_flow_logs_destination_type" {
+  type        = string
+  description = "Type of the logging destination. Can be `cloud-watch-logs` or `s3`."
+  default     = "s3"
+
+  validation {
+    condition = contains(["cloud-watch-logs", "s3"], lower(var.vpc_flow_logs_destination_type))
+    message   = "Must be either `cloud-watch-logs` or `s3`."
+  }
+}
+
+# -------------------------------------------------------------- privatelink ---
+
+variable "privatelink_gateway_endpoints" {
+  type        = set(string)
+  description = "List of Gateway VPC Endpoints for the VPC. Can only be `dynamodb` and `s3`."
+  default     = []
+
+  validation {
+    condition     = alltrue([for x in var.privatelink_gateway_endpoints : contains(["dynamodb", "s3"], lower(x))])
+    error_message = "Only valid values are `dynamodb` and `s3`."
+  }
+}
+
+variable "privatelink_vpc_endpoints" {
+  type        = set(string)
+  description = "List of Interface VPC Endpoints for the VPC."
+  default     = []
+}
+
+# ================================================================== context ===
+
+variable "aws_region_name" {
+  type        = string
+  description = "AWS Region."
+  default     = ""
+}
+
+variable "aws_account_id" {
+  type        = string
+  description = "AWS account ID."
+  default     = ""
+}
diff --git a/version.tf b/version.tf
new file mode 100755
index 0000000..b5df4ee
--- /dev/null
+++ b/version.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.3.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0.0, < 6.0.0"
+    }
+  }
+}