From ffa9a62ca71b6acd1f0a20f76a7aa90013da5506 Mon Sep 17 00:00:00 2001 From: "create-pr-on-fork-for-pan-dev[bot]" <135888023+create-pr-on-fork-for-pan-dev[bot]@users.noreply.github.com> Date: Tue, 17 Oct 2023 14:27:35 +0100 Subject: [PATCH] Sync aws Terraform module documentation (#472) Co-authored-by: pan-dev-content-sync-trigger[bot] --- .../vmseries/examples/panorama_standalone.md | 8 +- .../docs/swfw/aws/vmseries/modules/alb.md | 7 +- .../docs/swfw/aws/vmseries/modules/asg.md | 7 +- .../swfw/aws/vmseries/modules/bootstrap.md | 7 +- .../vmseries/modules/crosszone_failover.md | 88 ++++++++ .../docs/swfw/aws/vmseries/modules/gwlb.md | 11 +- .../aws/vmseries/modules/gwlb_endpoint_set.md | 6 +- .../aws/vmseries/modules/names_generator.md | 213 ++++++++++++++++++ .../aws/vmseries/modules/nat_gateway_set.md | 7 +- .../docs/swfw/aws/vmseries/modules/nlb.md | 11 +- .../swfw/aws/vmseries/modules/panorama.md | 7 +- .../swfw/aws/vmseries/modules/subnet_set.md | 8 +- .../aws/vmseries/modules/transit_gateway.md | 6 +- .../modules/transit_gateway_attachment.md | 6 +- .../modules/transit_gateway_peering.md | 8 +- .../swfw/aws/vmseries/modules/vmseries.md | 7 +- .../docs/swfw/aws/vmseries/modules/vpc.md | 12 +- .../swfw/aws/vmseries/modules/vpc_endpoint.md | 77 +++++++ .../swfw/aws/vmseries/modules/vpc_route.md | 6 +- .../docs/swfw/aws/vmseries/modules/vpn.md | 85 +++++++ .../centralized_design.md | 8 +- .../centralized_design_autoscale.md | 8 +- .../combined_design.md | 8 +- .../combined_design_autoscale.md | 14 +- .../isolated_design.md | 8 +- .../isolated_design_autoscale.md | 14 +- 26 files changed, 569 insertions(+), 78 deletions(-) create mode 100644 products/terraform/docs/swfw/aws/vmseries/modules/crosszone_failover.md create mode 100644 products/terraform/docs/swfw/aws/vmseries/modules/names_generator.md create mode 100644 products/terraform/docs/swfw/aws/vmseries/modules/vpc_endpoint.md create mode 100644 products/terraform/docs/swfw/aws/vmseries/modules/vpn.md diff --git a/products/terraform/docs/swfw/aws/vmseries/examples/panorama_standalone.md b/products/terraform/docs/swfw/aws/vmseries/examples/panorama_standalone.md index 6ff278cd7..4cf207dba 100644 --- a/products/terraform/docs/swfw/aws/vmseries/examples/panorama_standalone.md +++ b/products/terraform/docs/swfw/aws/vmseries/examples/panorama_standalone.md @@ -76,13 +76,13 @@ Use a web browser to access https://x.x.x.x and login with admin and your previo | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | -| [aws](#requirement\_aws) | ~> 4.25 | +| [aws](#requirement\_aws) | ~> 5.17 | ### Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | ~> 4.25 | +| [aws](#provider\_aws) | ~> 5.17 | ### Modules @@ -100,8 +100,10 @@ Use a web browser to access https://x.x.x.x and login with admin and your previo | [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | +| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_ebs_default_kms_key.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source | | [aws_kms_alias.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | ### Inputs @@ -112,7 +114,7 @@ Use a web browser to access https://x.x.x.x and login with admin and your previo | [panoramas](#input\_panoramas) | A map defining Panorama instances

Following properties are available:
- `instances`: map of Panorama instances with attributes:
- `az`: name of the Availability Zone
- `private_ip_address`: private IP address for management interface
- `panos_version`: PAN-OS version used for Panorama
- `network`: definition of network settings in object with attributes:
- `vpc`: name of the VPC (needs to be one of the keys in map `vpcs`)
- `vpc_subnet`: key of the VPC and subnet connected by '-' character
- `security_group`: security group assigned to ENI used by Panorama
- `create_public_ip`: true, if public IP address for management should be created
- `ebs`: EBS settings defined in object with attributes:
- `volumes`: list of EBS volumes attached to each instance
- `kms_key_alias`: KMS key alias used for encrypting Panorama EBS
- `iam`: IAM settings in object with attrbiutes:
- `create_role`: enable creation of IAM role
- `role_name`: name of the role to create or use existing one
- `enable_imdsv2`: whether to enable IMDSv2 on the EC2 instance

Example:
{
  panorama\_ha\_pair = {
    instances = {
      "primary" = {
        az                 = "eu-central-1a"
        private\_ip\_address = "10.255.0.4"
      }
      "secondary" = {
        az                 = "eu-central-1b"
        private\_ip\_address = "10.255.1.4"
      }
    }

    panos\_version = "10.2.3"

    network = {
      vpc              = "management\_vpc"
      vpc\_subnet       = "management\_vpc-mgmt"
      security\_group   = "panorama\_mgmt"
      create\_public\_ip = true
    }

    ebs = {
      volumes = [
        {
          name            = "ebs-1"
          ebs\_device\_name = "/dev/sdb"
          ebs\_size        = "2000"
          ebs\_encrypted   = true
        },
        {
          name            = "ebs-2"
          ebs\_device\_name = "/dev/sdc"
          ebs\_size        = "2000"
          ebs\_encrypted   = true
        }
      ]
      kms\_key\_alias = "aws/ebs"
    }

    iam = {
      create\_role = true
      role\_name   = "panorama"
    }

    enable\_imdsv2 = false
  }
}
| 
map(object({
    instances = map(object({
      az                 = string
      private\_ip\_address = string
    }))

    panos\_version = string

    network = object({
      vpc              = string
      vpc\_subnet       = string
      security\_group   = string
      create\_public\_ip = bool
    })

    ebs = object({
      volumes = list(object({
        name            = string
        ebs\_device\_name = string
        ebs\_size        = string
        ebs\_encrypted   = bool
      }))
      kms\_key\_alias = string
    })

    iam = object({
      create\_role = bool
      role\_name   = string
    })

    enable\_imdsv2 = bool
  }))
| `{}` | no | | [region](#input\_region) | AWS region used to deploy whole infrastructure | `string` | n/a | yes | | [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes | -| [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
- `az`: availability zone
- `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
- `vpc_subnet`: built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
- `to_cidr`: destination IP range
- `next_hop_key`: must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
- `next_hop_type`: internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
{
  security\_vpc = {
    name = "security-vpc"
    cidr = "10.100.0.0/16"
    security\_groups = {
      panorama\_mgmt = {
        name = "panorama\_mgmt"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
          https = {
            description = "Permit HTTPS"
            type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
            cidr\_blocks = ["130.41.247.0/24"]
          }
          ssh = {
            description = "Permit SSH"
            type        = "ingress", from\_port = "22", to\_port = "22", protocol = "tcp"
            cidr\_blocks = ["130.41.247.0/24"]
          }
        }
      }
    }
    subnets = {
      "10.100.0.0/24"  = { az = "eu-central-1a", set = "mgmt" }
      "10.100.64.0/24" = { az = "eu-central-1b", set = "mgmt" }
    }
    routes = {
      mgmt\_default = {
        vpc\_subnet    = "security\_vpc-mgmt"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "security\_vpc"
        next\_hop\_type = "internet\_gateway"
      }
    }
  }
}
| 
map(object({
    name = string
    cidr = string
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az  = string
      set = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
| `{}` | no | +| [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
- `az`: availability zone
- `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
- `vpc_subnet`: built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
- `to_cidr`: destination IP range
- `next_hop_key`: must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
- `next_hop_type`: internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
{
  security\_vpc = {
    name = "security-vpc"
    cidr = "10.100.0.0/16"
    security\_groups = {
      panorama\_mgmt = {
        name = "panorama\_mgmt"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
          https = {
            description = "Permit HTTPS"
            type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
            cidr\_blocks = ["130.41.247.0/24"]
          }
          ssh = {
            description = "Permit SSH"
            type        = "ingress", from\_port = "22", to\_port = "22", protocol = "tcp"
            cidr\_blocks = ["130.41.247.0/24"]
          }
        }
      }
    }
    subnets = {
      "10.100.0.0/24"  = { az = "eu-central-1a", set = "mgmt" }
      "10.100.64.0/24" = { az = "eu-central-1b", set = "mgmt" }
    }
    routes = {
      mgmt\_default = {
        vpc\_subnet    = "security\_vpc-mgmt"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "security\_vpc"
        next\_hop\_type = "internet\_gateway"
      }
    }
  }
}
| 
map(object({
    name            = string
    cidr            = string
    security\_groups = any
    subnets = map(object({
      az  = string
      set = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
| `{}` | no | ### Outputs diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/alb.md b/products/terraform/docs/swfw/aws/vmseries/modules/alb.md index 855221ce6..10f0c826a 100644 --- a/products/terraform/docs/swfw/aws/vmseries/modules/alb.md +++ b/products/terraform/docs/swfw/aws/vmseries/modules/alb.md @@ -20,7 +20,7 @@ title: Palo Alto Networks Application Load Balancer Module for AWS A Terraform module for deploying an Application Load Balancer in AWS cloud. This is always a public Load Balancer with Target Groups of `IP` type. It is intended to be placed just in front of Next Generation Firewalls. -[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/alb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/alb) +[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/alb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/alb) ## Usage @@ -98,13 +98,13 @@ module "public_alb" { | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | -| [aws](#requirement\_aws) | ~> 4.25 | +| [aws](#requirement\_aws) | ~> 5.17 | ### Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | ~> 4.25 | +| [aws](#provider\_aws) | ~> 5.17 | ### Modules @@ -127,6 +127,7 @@ No modules. | [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source | | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | ### Inputs diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/asg.md b/products/terraform/docs/swfw/aws/vmseries/modules/asg.md index 82dcbe63a..be0681ca9 100644 --- a/products/terraform/docs/swfw/aws/vmseries/modules/asg.md +++ b/products/terraform/docs/swfw/aws/vmseries/modules/asg.md @@ -20,7 +20,7 @@ title: Palo Alto Networks Autoscaling Group Module for AWS A Terraform module for deploying VM-Series in Autoscaling group in AWS cloud. -[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/asg) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/asg) +[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/asg) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/asg) ## Usage @@ -34,7 +34,7 @@ For example usage, please refer to the [Examples](https://github.com/PaloAltoNet |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | | [archive](#requirement\_archive) | ~> 2.2 | -| [aws](#requirement\_aws) | ~> 4.25 | +| [aws](#requirement\_aws) | ~> 5.17 | | [null](#requirement\_null) | 3.2.1 | ### Providers @@ -42,7 +42,7 @@ For example usage, please refer to the [Examples](https://github.com/PaloAltoNet | Name | Version | |------|---------| | [archive](#provider\_archive) | ~> 2.2 | -| [aws](#provider\_aws) | ~> 4.25 | +| [aws](#provider\_aws) | ~> 5.17 | | [null](#provider\_null) | 3.2.1 | ### Modules @@ -70,6 +70,7 @@ No modules. | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_kms_alias.ebs_kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | ### Inputs diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/bootstrap.md b/products/terraform/docs/swfw/aws/vmseries/modules/bootstrap.md index 1f8b932af..9a2c3b47f 100644 --- a/products/terraform/docs/swfw/aws/vmseries/modules/bootstrap.md +++ b/products/terraform/docs/swfw/aws/vmseries/modules/bootstrap.md @@ -29,7 +29,7 @@ The bootstrap package may optionally include a PAN-OS software image, application and threat signature updates, VM-Series plug-ins, and/or license files. -[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/bootstrap) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/bootstrap) +[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/bootstrap) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/bootstrap) ## Directory and file structure The root directory of the Terraform plan calling this module should include a @@ -93,14 +93,14 @@ variables and associated values. | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | -| [aws](#requirement\_aws) | ~> 4.25 | +| [aws](#requirement\_aws) | ~> 5.17 | | [random](#requirement\_random) | ~> 3.3.2 | ### Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | ~> 4.25 | +| [aws](#provider\_aws) | ~> 5.17 | | [random](#provider\_random) | ~> 3.3.2 | ### Modules @@ -125,6 +125,7 @@ No modules. | [aws_s3_object.init_cfg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource | | [random_id.sufix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource | | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | ### Inputs diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/crosszone_failover.md b/products/terraform/docs/swfw/aws/vmseries/modules/crosszone_failover.md new file mode 100644 index 000000000..15c13a578 --- /dev/null +++ b/products/terraform/docs/swfw/aws/vmseries/modules/crosszone_failover.md @@ -0,0 +1,88 @@ +--- +hide_title: true +id: crosszone_failover +keywords: +- pan-os +- panos +- firewall +- configuration +- terraform +- vmseries +- vm-series +- aws +pagination_next: null +pagination_prev: null +sidebar_label: Crosszone Failover +title: Crosszone Failover Module for AWS +--- + +# Crosszone Failover Module for AWS + +A Terraform module for deploying a Crosszone Failover for VM-Series firewalls. + +[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/crosszone_failover) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/crosszone_failover) + +## Reference + +### Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | +| [aws](#requirement\_aws) | ~> 5.17 | + +### Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | ~> 5.17 | + +### Modules + +No modules. + +### Resources + +| Name | Type | +|------|------| +| [aws_api_gateway_deployment.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_deployment) | resource | +| [aws_api_gateway_integration.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration) | resource | +| [aws_api_gateway_integration_response.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource | +| [aws_api_gateway_method.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource | +| [aws_api_gateway_method_response.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource | +| [aws_api_gateway_resource.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource | +| [aws_api_gateway_rest_api.pan_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_rest_api) | resource | +| [aws_iam_role.lambda_exec](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy.lambda_exec](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | +| [aws_iam_role_policy_attachment.test_attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_lambda_function.rt_failover](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource | +| [aws_lambda_permission.apigw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource | +| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_s3_bucket_server_side_encryption_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | +| [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | +| [aws_s3_object.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource | +| [aws_vpc_endpoint.api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | + +### Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [lambda\_file\_location](#input\_lambda\_file\_location) | Name of folder where lambda package is stored in this workspace. | `string` | `"lambda-package"` | no | +| [lambda\_file\_name](#input\_lambda\_file\_name) | File name of lambda package. | `string` | `"crosszone_ha_instance_id.zip"` | no | +| [lambda\_s3\_bucket](#input\_lambda\_s3\_bucket) | Name of bucket with lambda zip package to deploy. | `string` | `""` | no | +| [prefix\_name\_tag](#input\_prefix\_name\_tag) | Prefix used to build name tags for resources. | `string` | `""` | no | +| [region](#input\_region) | AWS Region. | `any` | n/a | yes | +| [reserved\_concurrent\_executions](#input\_reserved\_concurrent\_executions) | Amount of reserved concurrent execussions for lambda function. | `number` | `100` | no | +| [sg\_state](#input\_sg\_state) | Exported state from base infra workspace to make SG names to IDs. | `any` | n/a | yes | +| [subnet\_state](#input\_subnet\_state) | Exported state from base VPC workspace to map resource names to IDs. | `any` | n/a | yes | +| [tags](#input\_tags) | Map of additional tags to apply to all resources. | `map(any)` | `{}` | no | +| [vpc\_id](#input\_vpc\_id) | VPC ID. | `any` | n/a | yes | + +### Outputs + +No outputs. + \ No newline at end of file diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/gwlb.md b/products/terraform/docs/swfw/aws/vmseries/modules/gwlb.md index 65da1bef6..92a19bc34 100644 --- a/products/terraform/docs/swfw/aws/vmseries/modules/gwlb.md +++ b/products/terraform/docs/swfw/aws/vmseries/modules/gwlb.md @@ -21,7 +21,7 @@ title: AWS Gateway Load Balancer Module This module creates a single Gateway Load Balancer (GWLB). Routes from other VPCs can direct traffic towards the GWLB through the use of a separate module `gwlb_endpoint_set`. -[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/gwlb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/gwlb) +[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/gwlb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/gwlb) ## Attaching new targets to the pre-existing GWLB @@ -42,13 +42,13 @@ resource aws_lb_target_group_attachment this { | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 | -| [aws](#requirement\_aws) | ~> 4.25 | +| [aws](#requirement\_aws) | ~> 5.17 | ### Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | ~> 4.25 | +| [aws](#provider\_aws) | ~> 5.17 | ### Modules @@ -65,11 +65,13 @@ No modules. | [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_service) | resource | | [aws_vpc_endpoint_service_allowed_principal.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_service_allowed_principal) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | ### Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [acceptance\_required](#input\_acceptance\_required) | Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - true or false | `bool` | `false` | no | | [allowed\_principals](#input\_allowed\_principals) | List of AWS Principal ARNs who are allowed access to the GWLB Endpoint Service. For example `["arn:aws:iam::123456789000:root"]`. | `list(string)` | `[]` | no | | [deregistration\_delay](#input\_deregistration\_delay) | See the `aws` provider [documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group#deregistration_delay). | `number` | `null` | no | | [enable\_lb\_deletion\_protection](#input\_enable\_lb\_deletion\_protection) | Whether to enable deletion protection on the gateway loadbalancer. | `bool` | `false` | no | @@ -85,10 +87,11 @@ No modules. | [healthy\_threshold](#input\_healthy\_threshold) | The number of successful health checks required before an unhealthy target becomes healthy. Minimum 2 and maximum 10. | `number` | `3` | no | | [lb\_tags](#input\_lb\_tags) | Map of AWS tags to apply to the created Load Balancer object. These tags are applied after the `global_tags`. | `map(string)` | `{}` | no | | [lb\_target\_group\_tags](#input\_lb\_target\_group\_tags) | Map of AWS tags to apply to the created GWLB Target Group. These tags are applied after the `global_tags`. | `map(string)` | `{}` | no | -| [name](#input\_name) | Name of the created GWLB and its Target Group. Must be unique per AWS region per AWS account. | `string` | n/a | yes | +| [name](#input\_name) | Name of the created GWLB. Must be unique per AWS region per AWS account. | `string` | n/a | yes | | [stickiness\_type](#input\_stickiness\_type) | If `stickiness_type` is `null`, then attribute `enabled` is set to `false` in stickiness configuration block,
value provided in `type` is ignored and by default the Gateway Load Balancer uses 5-tuple to maintain flow stickiness to a specific target appliance.
If `stickiness_type` is not `null`, then attribute `enabled` is set to `true` in stickiness configuration block
and the stickiness `type` can be then customized by using value:
- `source_ip_dest_ip_proto` for 3-tuple (Source IP, Destination IP and Transport Protocol)
- `source_ip_dest_ip` for 2-tuple (Source IP and Destination IP)
 | `string` | `null` | no |
 |  [subnets](#input\_subnets) | Map of subnets where to create the GWLB. Each map's key is the availability zone name and each map's object has an attribute
`id` identifying AWS subnet.
Example for users of module `subnet_set`:
subnets = module.subnet\_set.subnets
Example:
subnets = {
  "us-east-1a" = { id = "snet-123007" }
  "us-east-1b" = { id = "snet-123008" }
}
 | 
map(object({
    id = string
  }))
 | n/a | yes |
 |  [target\_instances](#input\_target\_instances) | Map of instances to attach to the GWLB Target Group. | 
map(object({
    id = string
  }))
 | `{}` | no |
+|  [tg\_name](#input\_tg\_name) | Name of the created Target Group for GWLB. If not set, then value of variable name is used. | `string` | `null` | no |
 |  [unhealthy\_threshold](#input\_unhealthy\_threshold) | The number of failed health checks required before a healthy target becomes unhealthy. Minimum 2 and maximum 10. | `number` | `3` | no |
 |  [vpc\_id](#input\_vpc\_id) | AWS identifier of a VPC containing the Endpoint. | `string` | n/a | yes |
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/gwlb_endpoint_set.md b/products/terraform/docs/swfw/aws/vmseries/modules/gwlb_endpoint_set.md
index 41d67dd79..6cdde4f3c 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/gwlb_endpoint_set.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/gwlb_endpoint_set.md
@@ -21,7 +21,7 @@ title: AWS GWLB Endpoint Set
 This module creates a set of [VPC GWLB Endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-gateway-load-balancer.html)
 over a range of one or more Availability Zones. All the Endpoints transfer the traffic to the same Gateway Load Balancer (GWLB).
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/gwlb_endpoint_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/gwlb_endpoint_set)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/gwlb_endpoint_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/gwlb_endpoint_set)
 
 ## Reference
 
@@ -30,13 +30,13 @@ over a range of one or more Availability Zones. All the Endpoints transfer the t
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/names_generator.md b/products/terraform/docs/swfw/aws/vmseries/modules/names_generator.md
new file mode 100644
index 000000000..20381e204
--- /dev/null
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/names_generator.md
@@ -0,0 +1,213 @@
+---
+hide_title: true
+id: names_generator
+keywords:
+- pan-os
+- panos
+- firewall
+- configuration
+- terraform
+- vmseries
+- vm-series
+- aws
+pagination_next: null
+pagination_prev: null
+sidebar_label: Names Generator
+title: Palo Alto Networks Flexible Names Generator
+---
+
+# Palo Alto Networks Flexible Names Generator
+
+A Terraform module for flexible names generation for resources created in AWS by VM-Series modules.
+
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/names_generator) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/names_generator)
+
+## Usage
+
+In order to invoke the module to generated flexible names for all resources created by Terraform for VM-Series, you need to defined map e.g. as below for combined design example:
+
+```hcl
+module "generator" {
+  source = "../../modules/names_generator"
+
+  region               = var.region
+  name_prefix          = var.name_prefix
+  name_template        = var.name_templates.name_template
+  template_assignments = var.template_assignments.assigned_template
+  names = {
+    vpc              = { for k, v in var.vpcs : k => v.name }
+    internet_gateway = { for k, v in var.vpcs : k => v.name }
+    vpn_gateway      = { for k, v in var.vpcs : k => v.name }
+    subnet           = { for _, v in local.subnets : "${v.name}${v.az}" => "${v.name}${v.az}" }
+    security_group   = { for _, v in local.security_groups : v.key => v.name }
+    route_table = merge(
+      { for k, v in var.vpcs : k => "igw_${v.name}" },
+      { for _, v in local.subnets : "${v.name}${v.az}" => "${v.name}${v.az}" }
+    )
+    nat_gateway                           = { for _, v in local.nat_gateways : v.key => v.name }
+    transit_gateway                       = { "tgw" : var.tgw.name }
+    transit_gateway_route_table           = { for k, v in var.tgw.route_tables : k => v.name }
+    transit_gateway_attachment            = { for k, v in var.tgw.attachments : k => v.name }
+    gateway_loadbalancer                  = { for k, v in var.gwlbs : k => v.name }
+    gateway_loadbalancer_target_group     = { for k, v in var.gwlbs : k => v.name }
+    gateway_loadbalancer_endpoint         = { for k, v in var.gwlb_endpoints : k => v.name }
+    application_loadbalancer              = { for k, v in var.spoke_albs : k => k }
+    application_loadbalancer_target_group = { for _, v in local.alb_tg : v.key => v.value }
+    network_loadbalancer                  = { for k, v in var.spoke_nlbs : k => k }
+    network_loadbalancer_target_group     = { for _, v in local.nlb_tg : v.key => v.value }
+    vm                                    = { for k, v in var.spoke_vms : k => k }
+    vmseries                              = { for vmseries in local.vmseries_instances : "${vmseries.group}-${vmseries.instance}" => "${vmseries.group}-${vmseries.instance}" }
+    vmseries_network_interface            = { for n in local.vmseries_network_interfaces : "${n.group}-${n.instance}-${n.nic}" => "${n.nic}-${n.instance}" }
+    iam_role = {
+      security : "vmseries"
+      spoke : "spokevm"
+    }
+    iam_instance_profile = {
+      security : "vmseries"
+      spoke : "spokevm"
+    }
+  }
+}
+```
+
+For each kind of resource output from module can be used e.g. as below for VPC:
+
+```hcl
+module "vpc" {
+  source = "../../modules/vpc"
+
+  for_each = var.vpcs
+
+  name = module.generator.names.vpc[each.key]
+  ...
+}
+```
+
+or GWLB and its endpoints:
+
+```hcl
+module "gwlb" {
+  source = "../../../modules/gwlb"
+
+  for_each = var.gwlbs
+
+  name    = module.generator.names.gateway_loadbalancer[each.key]
+  ...
+}
+
+module "gwlbe_endpoint" {
+  source = "../../../modules/gwlb_endpoint_set"
+
+  for_each = var.gwlb_endpoints
+
+  name              = module.generator.names.gateway_loadbalancer_endpoint[each.key]
+  ...
+}
+```
+
+Map of templates needs to be defined in ``terraform.tfvars``:
+
+```hcl
+name_templates = {
+  name_at_the_end = {
+    delimiter = "-"
+    parts = [
+      { prefix = null },
+      { abbreviation = "__default__" },
+      { bu = "cloud" },
+      { env = "tst" },
+      { suffix = "ec1" },
+      { name = "%s" },
+  ] }
+  name_after_abbr = {
+    delimiter = "-"
+    parts = [
+      { prefix = null },
+      { abbreviation = "__default__" },
+      { name = "%s" },
+      { bu = "cloud" },
+      { env = "tst" },
+      { suffix = "ec1" },
+  ] }
+  name_with_az = {
+    delimiter = "-"
+    parts = [
+      { prefix = null },
+      { abbreviation = "__default__" },
+      { name = "%s" },
+      { bu = "cloud" },
+      { env = "tst" },
+      { suffix = "ec1" },
+      { az = "__az_numeric__" }, # __az_literal__, __az_numeric__
+  ] }
+  name_max_32_characters = {
+    delimiter = "-"
+    parts = [
+      { prefix = null },
+      { abbreviation = "__default__" },
+      { name = "%s" },
+      { bu = "cloud" },
+      { env = "tst" },
+  ] }
+}
+```
+
+Besides that for each kind template needs to be assigned (or default template needs to be used):
+
+```hcl
+template_assignments = {
+  default                               = "name_after_abbr"
+  subnet                                = "name_with_az"
+  route_table                           = "name_with_az"
+  nat_gateway                           = "name_at_the_end"
+  vm                                    = "name_at_the_end"
+  vmseries                              = "name_at_the_end"
+  vmseries_network_interface            = "name_at_the_end"
+  application_loadbalancer              = "name_max_32_characters"
+  application_loadbalancer_target_group = "name_max_32_characters"
+  network_loadbalancer                  = "name_max_32_characters"
+  network_loadbalancer_target_group     = "name_max_32_characters"
+  gateway_loadbalancer                  = "name_max_32_characters"
+  gateway_loadbalancer_target_group     = "name_max_32_characters"
+}
+```
+
+## Reference
+
+### Requirements
+
+| Name | Version |
+|------|---------|
+|  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
+
+### Providers
+
+No providers.
+
+### Modules
+
+No modules.
+
+### Resources
+
+No resources.
+
+### Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+|  [abbreviations](#input\_abbreviations) | Map of abbreviations used for resources (placed in place of "\_\_default\_\_"). | `map(string)` | 
{
  "application\_loadbalancer": "alb",
  "application\_loadbalancer\_target\_group": "atg",
  "gateway\_loadbalancer": "gwlb",
  "gateway\_loadbalancer\_endpoint": "gwep",
  "gateway\_loadbalancer\_target\_group": "gwtg",
  "iam\_instance\_profile": "profile",
  "iam\_role": "role",
  "internet\_gateway": "igw",
  "nat\_gateway": "ngw",
  "network\_loadbalancer": "nlb",
  "network\_loadbalancer\_target\_group": "ntg",
  "route\_table": "rt",
  "route\_table\_internet\_gateway": "rt",
  "security\_group": "sg",
  "subnet": "snet",
  "transit\_gateway": "tgw",
  "transit\_gateway\_attachment": "att",
  "transit\_gateway\_route\_table": "trt",
  "vm": "vm",
  "vmseries": "vm",
  "vmseries\_network\_interface": "nic",
  "vpc": "vpc",
  "vpn\_gateway": "vgw"
}
 | no |
+|  [az\_map\_literal\_to\_numeric](#input\_az\_map\_literal\_to\_numeric) | Map of number used instead of letters for AZs (placed in place of "\_\_az\_numeric\_\_"). | `map(string)` | 
{
  "a": 1,
  "b": 2,
  "c": 3,
  "d": 4,
  "e": 5,
  "f": 6,
  "g": 7,
  "h": 8,
  "i": 9
}
 | no |
+|  [name\_prefix](#input\_name\_prefix) | Prefix used in names for the resources | `string` | n/a | yes |
+|  [name\_templates](#input\_name\_templates) | Map of templates used to generate names. Each template is defined by list of objects. Each object contains 1 element defined by key and string value.

Important:
0. Delimiter specifies the delimiter used between all components of the new name.
1. Elements with key `prefix` (value is not important) will be replaced with value of the `name_prefix` variable (e.g. `{ prefix = null }`)
2. `%s` will be eventually replaced by resource name
3. `__default__` is a marker that we will be replaced with a default resource abbreviation, anything else will be used literally.
4. `__az_numeric__` is a marker that will be used to replace the availability zone letter indicator with a number (e.g. a->1, b->2, ...)
5. `__az_literal__` is a marker that will be used to replace the full availability zone name with a letter (e.g. `eu-central-1a` will become `a`)
6. Order matters

Example:

name\_template = {
  name\_at\_the\_end = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "\_\_default\_\_" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { name = "%s" },
  ] }
  name\_after\_abbr = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "\_\_default\_\_" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
  ] }
  name\_with\_az = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "\_\_default\_\_" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { az = "\_\_az\_numeric\_\_" }, # \_\_az\_literal\_\_, \_\_az\_numeric\_\_
  ] }
  name\_max\_32\_characters = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "\_\_default\_\_" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
  ] }
} | 
map(object({
    delimiter = string
    parts     = list(map(string))
  }))
 | `{}` | no |
+|  [names](#input\_names) | Map of objects defining names used for resources.

Example:

names = {
  vpc                           = { for k, v in var.vpcs : k => v.name }
  gateway\_loadbalancer          = { for k, v in var.gwlbs : k => v.name }
  gateway\_loadbalancer\_endpoint = { for k, v in var.gwlb\_endpoints : k => v.name }
}

Please take a look combined\_design example, which contains full map for names. | `map(map(string))` | `{}` | no |
+|  [region](#input\_region) | AWS region used to deploy whole infrastructure | `string` | n/a | yes |
+|  [template\_assignments](#input\_template\_assignments) | Map of templates (used to generate names) assigned to each kind of resource.

Example:

template\_assignments = {
  default                               = "name\_after\_abbr"
  subnet                                = "name\_with\_az"
  route\_table                           = "name\_with\_az"
  nat\_gateway                           = "name\_at\_the\_end"
  vm                                    = "name\_at\_the\_end"
  vmseries                              = "name\_at\_the\_end"
  vmseries\_network\_interface            = "name\_at\_the\_end"
  application\_loadbalancer              = "name\_max\_32\_characters"
  application\_loadbalancer\_target\_group = "name\_max\_32\_characters"
  network\_loadbalancer                  = "name\_max\_32\_characters"
  network\_loadbalancer\_target\_group     = "name\_max\_32\_characters"
  gateway\_loadbalancer                  = "name\_max\_32\_characters"
  gateway\_loadbalancer\_target\_group     = "name\_max\_32\_characters"
} | `map(string)` | `{}` | no |
+
+### Outputs
+
+| Name | Description |
+|------|-------------|
+|  [names](#output\_names) | Map of generated names for each kind of resources.

Example:

names = {
    vpc                           = {
        app1\_vpc     = "example-vpc-app1-cloud-tst-ec1"
        app2\_vpc     = "example-vpc-app2-cloud-tst-ec1"
        security\_vpc = "example-vpc-security-cloud-tst-ec1"
    }
    gateway\_loadbalancer          = {
        security\_gwlb = "example-gwlb-security-cloud-tst"
    }
    gateway\_loadbalancer\_endpoint = {
        app1\_inbound           = "example-gwep-app1-cloud-tst-ec1"
        app2\_inbound           = "example-gwep-app2-cloud-tst-ec1"
        security\_gwlb\_eastwest = "example-gwep-eastwest-cloud-tst-ec1"
        security\_gwlb\_outbound = "example-gwep-outbound-cloud-tst-ec1"
    }
} |
+
\ No newline at end of file
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/nat_gateway_set.md b/products/terraform/docs/swfw/aws/vmseries/modules/nat_gateway_set.md
index e2300dc5e..40aa2abbb 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/nat_gateway_set.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/nat_gateway_set.md
@@ -20,7 +20,7 @@ title: Palo Alto Networks NAT Gateway Set Module for AWS
 
 A Terraform module for deploying a NAT Gateway set in AWS cloud. The "set" means that the module will create an identical/similar NAT Gateway in each specified Availability Zone.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/nat_gateway_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/nat_gateway_set)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/nat_gateway_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/nat_gateway_set)
 
 ## Usage
 
@@ -61,13 +61,13 @@ module "nat_gateway_set" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -88,6 +88,7 @@ No modules.
 |------|-------------|------|---------|:--------:|
 |  [create\_eip](#input\_create\_eip) | If false, does not create a new Elastic IP, but instead reads a pre-existing one. This input is ignored if `create_nat_gateway` is false. | `bool` | `true` | no |
 |  [create\_nat\_gateway](#input\_create\_nat\_gateway) | If false, does not create a new NAT Gateway, but instead reads a pre-existing one. | `bool` | `true` | no |
+|  [eip\_domain](#input\_eip\_domain) | Indicates if this EIP is for use in VPC | `string` | `"vpc"` | no |
 |  [eip\_tags](#input\_eip\_tags) | n/a | `map(string)` | `{}` | no |
 |  [eips](#input\_eips) | Optional map of Elastic IP attributes. Each key is an Availability Zone name, for example "us-east-1b". Each entry has optional attributes `name`, `public_ip`, `id`.
These are mainly useful to select a pre-existing Elastic IP when create\_eip is false. Example:
eips = {
    "us-east-1a" = { id = aws\_eip.a.id }
    "us-east-1b" = { id = aws\_eip.b.id }
}
The `name` attribute can be used both for selecting the pre-existing Elastic IP, or for customizing a newly created Elastic IP:
eips = {
    "us-east-1a" = { name = "Alice" }
    "us-east-1b" = { name = "Bob" }
}
 | `map` | `{}` | no |
 |  [global\_tags](#input\_global\_tags) | n/a | `map(string)` | `{}` | no |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/nlb.md b/products/terraform/docs/swfw/aws/vmseries/modules/nlb.md
index 75ba2ddc5..63b29e623 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/nlb.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/nlb.md
@@ -20,11 +20,11 @@ title: Palo Alto Networks Network Load Balancer Module for AWS
 
 A Terraform module for deploying a Network Load Balancer in AWS cloud. This can be used both as a public facing Load Balancer (to balance incoming traffic to Firewalls) or as an internal Load Balancer (to balance traffic from Firewalls to the actual application.)
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/nlb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/nlb)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/nlb) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/nlb)
 
 ## Usage
 
-For example usage please refer to the [tgw_inbound_with_alb_nlb](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/tgw_inbound_with_alb_nlb) example.
+For example usage please refer to the [*Centralized Design*](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/centralized_design), [*Combined Design*](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/combined_design/) or [*Isolated Design*](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/isolated_design/) examples.
 
 ## Reference
 
@@ -33,13 +33,13 @@ For example usage please refer to the [tgw_inbound_with_alb_nlb](https://registr
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -62,6 +62,7 @@ No modules.
 | [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
 | [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
 | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source |
 
 ### Inputs
@@ -71,7 +72,7 @@ No modules.
 |  [access\_logs\_byob](#input\_access\_logs\_byob) | Bring Your Own Bucket - in case you would like to re-use an existing S3 Bucket for Load Balancer's access logs.

NOTICE.
This code does not set up proper `Bucket Policies` for existing buckets. They have to be already in place. | `bool` | `false` | no |
 |  [access\_logs\_s3\_bucket\_name](#input\_access\_logs\_s3\_bucket\_name) | Name of an S3 Bucket that will be used as storage for Load Balancer's access logs.

When used with `configure_access_logs` it becomes the name of a newly created S3 Bucket.
When used with `access_logs_byob` it is a name of an existing bucket. | `string` | `"pantf-alb-access-logs-bucket"` | no |
 |  [access\_logs\_s3\_bucket\_prefix](#input\_access\_logs\_s3\_bucket\_prefix) | A path to a location inside a bucket under which access logs will be stored. When omitted defaults to the root folder of a bucket. | `string` | `null` | no |
-|  [balance\_rules](#input\_balance\_rules) | An object that contains the listener, target group, and health check configuration.
It consist of maps of applications like follows:
balance\_rules = {
  "application\_name" = {
    protocol            = "communication protocol, since this is a NLB module accepted values are TCP or TLS"
    port                = "communication port"
    target\_type         = "type of the target that will be attached to a target group, no defaults here, has to be provided explicitly (regardless the defaults terraform could accept)"
    target\_port         = "for target types supporting port values, the port number on which the target accepts communication, defaults to the communication port value"
    targets             = "a map of targets, where key is the target name (used to create a name for the target attachment), value is the target ID (IP, resource ID, etc - the actual value depends on the target type)"

    health\_check\_port   = "port used by the target group healthcheck, if ommited, `traffic-port` will be used"
    threshold           = "number of consecutive health checks before considering target healthy or unhealthy, defaults to 3"
    interval            = "time between each health check, between 5 and 300 seconds, defaults to 30s"

    certificate\_arn     = "(TLS ONLY) this is the arn of a certificate"
    alpn\_policy         = "(TLS ONLY) ALPN policy name, for possible values check (terraform documentation)[https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb\_listener#alpn\_policy], defaults to `None`"
  }
}
The `application_name` key is valid only for letters, numbers and a dash (`-`) - that's an AWS limitation.


`protocol` and `port` are used for `listener`, `target group` and `target group attachment`. Partially also for health checks (see below).


All listeners are always of forward action.


If you add FWs as targets, make sure you use `target_type = "ip"` and you provide the correct FW IPs in `target` map. IPs should be from the subnet set that the Load Balancer was created in. An example on how to feed this variable with data:
fw\_instance\_ips = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private\_ip }
For format of `var.vmseries` check the (`vmseries` module)[../vmseries/README.md]. The key is the VM name. By using those keys, we can loop through all vmseries modules and take the private IP from the interface that is assigned to the subnet we require. The subnet can be identified by the subnet set name (like above). In other words, the `for` loop returns the following map:
{
  vm01 = "1.1.1.1"
  vm02 = "2.2.2.2"
  ...
}

Healthchecks are by default of type TCP. Reason for that is the fact, that HTTP requests might flow through the FW to the actual application. So instead of checking the status of the FW we might check the status of the application.

You have an option to specify a health check port. This way you can set up a Management Profile with an Administrative Management Service limited only to NLBs private IPs and use a port for that service as the health check port. This way you make sure you separate the actual health check from the application rule's port.


EXAMPLE
balance\_rules = {
  "HTTPS-APP" = {
    protocol          = "TCP"
    port              = "443"
    health\_check\_port = "80"
    threshold         = 2
    interval          = 10
    target\_port       = 8443
    target\_type       = "ip"
    targets           = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private\_ip }
    stickiness        = true
  }
}
 | `any` | n/a | yes |
+|  [balance\_rules](#input\_balance\_rules) | An object that contains the listener, target group, and health check configuration.
It consist of maps of applications like follows:
balance\_rules = {
  "application\_name" = {
    protocol            = "communication protocol, since this is a NLB module accepted values are TCP or TLS"
    port                = "communication port"
    target\_type         = "type of the target that will be attached to a target group, no defaults here, has to be provided explicitly (regardless the defaults terraform could accept)"
    target\_port         = "for target types supporting port values, the port number on which the target accepts communication, defaults to the communication port value"
    targets             = "a map of targets, where key is the target name (used to create a name for the target attachment), value is the target ID (IP, resource ID, etc - the actual value depends on the target type)"
    target\_az           = "This parameter is not supported if the target type of the target group is instance or alb. If the target type is ip and the IP address is outside the VPC, this parameter is required."
    health\_check\_port   = "port used by the target group healthcheck, if ommited, `traffic-port` will be used"
    threshold           = "number of consecutive health checks before considering target healthy or unhealthy, defaults to 3"
    interval            = "time between each health check, between 5 and 300 seconds, defaults to 30s"

    certificate\_arn     = "(TLS ONLY) this is the arn of a certificate"
    alpn\_policy         = "(TLS ONLY) ALPN policy name, for possible values check (terraform documentation)[https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb\_listener#alpn\_policy], defaults to `None`"
  }
}
The `application_name` key is valid only for letters, numbers and a dash (`-`) - that's an AWS limitation.


`protocol` and `port` are used for `listener`, `target group` and `target group attachment`. Partially also for health checks (see below).


All listeners are always of forward action.


If you add FWs as targets, make sure you use `target_type = "ip"` and you provide the correct FW IPs in `target` map. IPs should be from the subnet set that the Load Balancer was created in. An example on how to feed this variable with data:
fw\_instance\_ips = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private\_ip }
For format of `var.vmseries` check the (`vmseries` module)[../vmseries/README.md]. The key is the VM name. By using those keys, we can loop through all vmseries modules and take the private IP from the interface that is assigned to the subnet we require. The subnet can be identified by the subnet set name (like above). In other words, the `for` loop returns the following map:
{
  vm01 = "1.1.1.1"
  vm02 = "2.2.2.2"
  ...
}

Healthchecks are by default of type TCP. Reason for that is the fact, that HTTP requests might flow through the FW to the actual application. So instead of checking the status of the FW we might check the status of the application.

You have an option to specify a health check port. This way you can set up a Management Profile with an Administrative Management Service limited only to NLBs private IPs and use a port for that service as the health check port. This way you make sure you separate the actual health check from the application rule's port.


EXAMPLE
balance\_rules = {
  "HTTPS-APP" = {
    protocol          = "TCP"
    port              = "443"
    health\_check\_port = "80"
    threshold         = 2
    interval          = 10
    target\_port       = 8443
    target\_type       = "ip"
    targets           = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private\_ip }
    target\_az         = "all"
    stickiness        = true
  }
}
 | `any` | n/a | yes |
 |  [configure\_access\_logs](#input\_configure\_access\_logs) | Configure Load Balancer to store access logs in an S3 Bucket.

When used with `access_logs_byob` set to `false` forces creation of a new bucket.
If, however, `access_logs_byob` is set to `true` an existing bucket can be used.

The name of the newly created or existing bucket is controlled via `access_logs_s3_bucket_name`. | `bool` | `false` | no |
 |  [create\_dedicated\_eips](#input\_create\_dedicated\_eips) | If set to `true`, a set of EIPs will be created for each zone/subnet. Otherwise AWS will handle IP management. | `bool` | `false` | no |
 |  [enable\_cross\_zone\_load\_balancing](#input\_enable\_cross\_zone\_load\_balancing) | Enable load balancing between instances in different AZs. Defaults to `true`.
Change to `false` only if absolutely necessary. By default, there is only one FW in each AZ.
Turning this off means 1:1 correlation between a public IP assigned to an AZ and a FW deployed in that AZ. | `bool` | `true` | no |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/panorama.md b/products/terraform/docs/swfw/aws/vmseries/modules/panorama.md
index da9c7266d..f6d49d4e3 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/panorama.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/panorama.md
@@ -22,7 +22,7 @@ A Terraform module for deploying Panorama in AWS cloud.
 
 Panorama deployed on AWS is Bring Your Own License (BYOL), supports all deployment modes (Panorama, Log Collector, and Management Only), and shares the same processes and functionality as the M-Series hardware appliances. For more information on Panorama modes, see [Panorama Models](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/panorama-models).
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/panorama) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/panorama)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/panorama) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/panorama)
 
 ## Usage
 
@@ -35,13 +35,13 @@ For usage, check the "examples" folder in the root of the repository.
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -68,6 +68,7 @@ No modules.
 |  [ebs\_encrypted](#input\_ebs\_encrypted) | Whether to enable EBS encryption on root volume. | `bool` | `true` | no |
 |  [ebs\_kms\_key\_alias](#input\_ebs\_kms\_key\_alias) | The alias for the customer managed KMS key to use for volume encryption.
If this is set to `null` the default master key that protects EBS volumes will be used | `string` | `null` | no |
 |  [ebs\_volumes](#input\_ebs\_volumes) | List of EBS volumes to create and attach to Panorama.
Available options:
- `name`              (Optional) Name tag for the EBS volume. If not provided defaults to the value of `var.name`.
- `ebs_device_name`   (Required) The EBS device name to expose to the instance (for example, /dev/sdh or xvdh). 
See [Device Naming on Linux Instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html#available-ec2-device-names) for more information.
- `ebs_size`          (Optional) The size of the EBS volume in GiBs. Defaults to 2000 GiB.
- `force_detach`      (Optional) Set to true if you want to force the volume to detach. Useful if previous attempts failed, but use this option only as a last resort, as this can result in data loss.
- `skip_destroy`      (Optional) Set this to true if you do not wish to detach the volume from the instance to which it is attached at destroy time, and instead just remove the attachment from Terraform state. 
This is useful when destroying an instance attached to third-party volumes.

Note: Terraform must be running with credentials which have the `GenerateDataKeyWithoutPlaintext` permission on the specified KMS key 
as required by the [EBS KMS CMK volume provisioning process](https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html#ebs-cmk) to prevent a volume from being created and almost immediately deleted.
If null, the default EBS encryption KMS key in the current region is used.

Example:
ebs\_volumes = [
  {
    name              = "ebs-1"
    ebs\_device\_name   = "/dev/sdb"
    ebs\_size          = "2000"
  },
  {
    name              = "ebs-2"
    ebs\_device\_name   = "/dev/sdb"
    ebs\_size          = "2000"
  },
  {
    name              = "ebs-3"
    ebs\_device\_name   = "/dev/sdb"
    ebs\_size          = "2000"
  },
]
 | `list(any)` | `[]` | no |
+|  [eip\_domain](#input\_eip\_domain) | Indicates if this EIP is for use in VPC | `string` | `"vpc"` | no |
 |  [enable\_imdsv2](#input\_enable\_imdsv2) | Whether to enable IMDSv2 on the EC2 instance.
Support for this feature has been added in VM-Series Plugin [3.0.0](https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/vm-series-plugin/vm-series-plugin-30/vm-series-plugin-300#id126d0957-95d7-4b29-9147-fff20027986e), which in turn requires PAN-OS version 10.2.0 at minimum. | `string` | `false` | no |
 |  [global\_tags](#input\_global\_tags) | A map of tags to assign to the resources.
If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level." | `map(any)` | `{}` | no |
 |  [instance\_type](#input\_instance\_type) | EC2 instance type for Panorama. Default set to Palo Alto Networks recommended instance type. | `string` | `"c5.4xlarge"` | no |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/subnet_set.md b/products/terraform/docs/swfw/aws/vmseries/modules/subnet_set.md
index 1943e0530..3704bc079 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/subnet_set.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/subnet_set.md
@@ -20,7 +20,7 @@ title: Palo Alto Networks Subnet-Set Module for AWS
 
 A Terraform module for deploying a subnet-set in AWS cloud. The "set" means that the module will create an identical/similar subnet in each specified Availability Zone.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/subnet_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/subnet_set)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/subnet_set) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/subnet_set)
 
 ## Usage
 
@@ -55,13 +55,13 @@ module "subnet_sets" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -88,7 +88,7 @@ No modules.
 |  [global\_tags](#input\_global\_tags) | Optional map of arbitrary tags to apply to all the created resources. | `map(string)` | `{}` | no |
 |  [has\_secondary\_cidrs](#input\_has\_secondary\_cidrs) | The input that depends on the secondary CIDR ranges of the VPC `vpc_id`. The actual value (true or false) is ignored, the input is used only to delay subnet creation until the secondary CIDR ranges are processed by Terraform. | `bool` | `true` | no |
 |  [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | See the [provider's documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch). | `bool` | `null` | no |
-|  [nacl\_associations](#input\_nacl\_associations) | NACLs associations with subnets | `map(string)` | `null` | no |
+|  [nacl\_associations](#input\_nacl\_associations) | NACLs associations with subnets | `map(string)` | `{}` | no |
 |  [name](#input\_name) | Subnet set name, used to construct default subnet names. | `string` | `null` | no |
 |  [propagating\_vgws](#input\_propagating\_vgws) | See the [provider's documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table). | `list(string)` | `[]` | no |
 |  [vpc\_id](#input\_vpc\_id) | Id of the VPC to create resource in. | `string` | n/a | yes |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway.md b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway.md
index ef67d8a3a..7305af387 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway.md
@@ -23,7 +23,7 @@ tables explicitly through respective input variables.
 
 >A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/transit_gateway) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/transit_gateway)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/transit_gateway) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/transit_gateway)
 
 ## Usage
 
@@ -36,13 +36,13 @@ For example usage, please refer to the [Examples](https://github.com/PaloAltoNet
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_attachment.md b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_attachment.md
index 8a502fa6d..43a26297c 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_attachment.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_attachment.md
@@ -22,7 +22,7 @@ A Terraform module for deploying AWS Transit Gateways Attachments.
 
 >AWS provides a network transit hub called a Transit Gateway. One or more VPCs can connect to a Transit Gateway through a Transit Gateway (TGW) Attachment.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/transit_gateway_attachment) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/transit_gateway_attachment)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/transit_gateway_attachment) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/transit_gateway_attachment)
 
 ## Usage
 
@@ -35,13 +35,13 @@ For example usage, please refer to the [Examples](https://github.com/PaloAltoNet
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_peering.md b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_peering.md
index eb8804cc3..cf312b3ce 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_peering.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/transit_gateway_peering.md
@@ -18,7 +18,7 @@ title: AWS Transit Gateway Peering
 
 # AWS Transit Gateway Peering
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/transit_gateway_peering) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/transit_gateway_peering)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/transit_gateway_peering) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/transit_gateway_peering)
 
 ## Usage
 
@@ -60,14 +60,14 @@ The static routes are currently not handled by this module.
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
-|  [aws.remote](#provider\_aws.remote) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
+|  [aws.remote](#provider\_aws.remote) | ~> 5.17 |
 
 ### Modules
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/vmseries.md b/products/terraform/docs/swfw/aws/vmseries/modules/vmseries.md
index 41e78bca0..c4f6cd3f6 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/vmseries.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/vmseries.md
@@ -20,7 +20,7 @@ title: Palo Alto Networks VM-Series Module for AWS
 
 A Terraform module for deploying a VM-Series firewall in AWS cloud.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/vmseries) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/vmseries)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/vmseries) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/vmseries)
 
 ## Usage
 
@@ -37,13 +37,13 @@ The changes in user data bootstrap entries will not affect the existing VM-Serie
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -69,6 +69,7 @@ No modules.
 |  [bootstrap\_options](#input\_bootstrap\_options) | VM-Series bootstrap options to provide using instance user data. Contents determine type of bootstap method to use.
If empty (the default), bootstrap process is not triggered at all.
For more information on available methods, please refer to VM-Series documentation for specific version.
For 10.0 docs are available [here](https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/bootstrap-the-vm-series-firewall.html). | `string` | `""` | no |
 |  [ebs\_encrypted](#input\_ebs\_encrypted) | Whether to enable EBS encryption on volumes. | `bool` | `true` | no |
 |  [ebs\_kms\_key\_alias](#input\_ebs\_kms\_key\_alias) | The alias for the customer managed KMS key to use for volume encryption. Should be prepended with the word "alias" followed by a forward slash (alias/example-key-alias).
If `null` (the default), the default master key that protects EBS volumes will be used. | `string` | `null` | no |
+|  [eip\_domain](#input\_eip\_domain) | Indicates if this EIP is for use in VPC | `string` | `"vpc"` | no |
 |  [enable\_imdsv2](#input\_enable\_imdsv2) | Whether to enable IMDSv2 on the EC2 instance.
Support for this feature has been added in VM-Series Plugin [3.0.0](https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/vm-series-plugin/vm-series-plugin-30/vm-series-plugin-300#id126d0957-95d7-4b29-9147-fff20027986e), which in turn requires VM-Series version 10.2.0 at minimum. | `string` | `false` | no |
 |  [enable\_instance\_termination\_protection](#input\_enable\_instance\_termination\_protection) | Whether to enable termination protection on the EC2 instance. | `bool` | `false` | no |
 |  [iam\_instance\_profile](#input\_iam\_instance\_profile) | IAM instance profile. | `string` | `null` | no |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/vpc.md b/products/terraform/docs/swfw/aws/vmseries/modules/vpc.md
index 414363251..e3d861d03 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/vpc.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/vpc.md
@@ -25,7 +25,7 @@ module is that it does not create multiple resources based on Terraform `count`
 [easier removal](https://github.com/PaloAltoNetworks/terraform-best-practices#22-looping) of any single subnet,
 without the need to briefly destroy and re-create any other subnet.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/vpc) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/vpc)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/vpc) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/vpc)
 
 ## Usage
 
@@ -50,13 +50,13 @@ module "vpc" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -100,9 +100,13 @@ No modules.
 |  [instance\_tenancy](#input\_instance\_tenancy) | VPC level [instance tenancy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc#instance_tenancy). | `string` | `null` | no |
 |  [nacls](#input\_nacls) | The `nacls` variable is a map of maps, where each map represents an AWS NACL.

  Example:
nacls = {
    trusted\_path\_monitoring = {
      name = "trusted-path-monitoring"
      rules = {
        block\_outbound\_icmp = {
          rule\_number = 110
          egress      = true
          protocol    = "icmp"
          rule\_action = "deny"
          cidr\_block  = "10.100.1.0/24"
          from\_port   = null
          to\_port     = null
        }
        allow\_inbound = {
          rule\_number = 300
          egress      = false
          protocol    = "-1"
          rule\_action = "allow"
          cidr\_block  = "0.0.0.0/0"
          from\_port   = null
          to\_port     = null
        }
      }
    }
  }
 | `any` | `{}` | no |
 |  [name](#input\_name) | Name of the VPC to create or use. | `string` | n/a | yes |
+|  [name\_internet\_gateway](#input\_name\_internet\_gateway) | Name of the IGW to create or use. | `string` | `null` | no |
+|  [name\_vpn\_gateway](#input\_name\_vpn\_gateway) | Name of the VPN gateway to create. | `string` | `null` | no |
 |  [ntp\_servers](#input\_ntp\_servers) | Specify a list of NTP server addresses for DHCP options set, default to AWS provided | `list(string)` | `[]` | no |
+|  [route\_table\_internet\_gateway](#input\_route\_table\_internet\_gateway) | Name of route table for the IGW. | `string` | `null` | no |
+|  [route\_table\_vpn\_gateway](#input\_route\_table\_vpn\_gateway) | Name of the route table for VPN gateway. | `string` | `null` | no |
 |  [secondary\_cidr\_blocks](#input\_secondary\_cidr\_blocks) | Secondary CIDR block to assign to a new VPC. | `list(string)` | `[]` | no |
-|  [security\_groups](#input\_security\_groups) | The `security_groups` variable is a map of maps, where each map represents an AWS Security Group.
  The key of each entry acts as the Security Group name.
  List of available attributes of each Security Group entry:
  - `rules`: A list of objects representing a Security Group rule. The key of each entry acts as the name of the rule and
      needs to be unique across all rules in the Security Group.
      List of attributes available to define a Security Group rule:
      - `description`: Security Group description.
      - `type`: Specifies if rule will be evaluated on ingress (inbound) or egress (outbound) traffic.
      - `cidr_blocks`: List of CIDR blocks - for ingress, determines the traffic that can reach your instance. For egress
      Determines the traffic that can leave your instance, and where it can go.
      - `prefix_list_ids`: List of Prefix List IDs


  Example:
security\_groups = {
    vmseries-mgmt = {
      name = "vmseries-mgmt"
      rules = {
        all-outbound = {
          description = "Permit All traffic outbound"
          type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
          cidr\_blocks = ["0.0.0.0/0"]
        }
        https-inbound-private = {
          description = "Permit HTTPS for VM-Series Management"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          cidr\_blocks = ["10.0.0.0/8"]
        }
        https-inbound-eip = {
          description = "Permit HTTPS for VM-Series Management from known public IPs"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          cidr\_blocks = ["100.100.100.100/32"]
        }
        ssh-inbound-eip = {
          description = "Permit SSH for VM-Series Management from known public IPs"
          type        = "ingress", from\_port = "22", to\_port = "22", protocol = "tcp"
          cidr\_blocks = ["100.100.100.100/32"]
        }
        https-inbound-prefix-list = {
          description = "Permit HTTPS for VM-Series Management for IPs in managed prefix list"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          prefix\_list\_ids = ["pl-1a2b3c4d5e6f7g8h9i"]
        }
      }
    }
  }
 | `any` | `{}` | no |
+|  [security\_groups](#input\_security\_groups) | The `security_groups` variable is a map of maps, where each map represents an AWS Security Group.
  The key of each entry acts as the Security Group name.
  List of available attributes of each Security Group entry:
  - `rules`: A list of objects representing a Security Group rule. The key of each entry acts as the name of the rule and
      needs to be unique across all rules in the Security Group.
      List of attributes available to define a Security Group rule:
      - `description`: Security Group description.
      - `type`: Specifies if rule will be evaluated on ingress (inbound) or egress (outbound) traffic.
      - `cidr_blocks`: List of CIDR blocks - for ingress, determines the traffic that can reach your instance. For egress
      Determines the traffic that can leave your instance, and where it can go.
      - `prefix_list_ids`: List of Prefix List IDs
      - `self`: security group itself will be added as a source to the rule.  Cannot be specified with cidr\_blocks, or security\_groups.
      - `source_security_groups`: list of security group IDs to be used as a source to the rule. Cannot be specified with cidr\_blocks, or self.


  Example:
security\_groups = {
    vmseries-mgmt = {
      name = "vmseries-mgmt"
      rules = {
        all-outbound = {
          description = "Permit All traffic outbound"
          type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
          cidr\_blocks = ["0.0.0.0/0"]
        }
        https-inbound-private = {
          description = "Permit HTTPS for VM-Series Management"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          cidr\_blocks = ["10.0.0.0/8"]
        }
        https-inbound-eip = {
          description = "Permit HTTPS for VM-Series Management from known public IPs"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          cidr\_blocks = ["100.100.100.100/32"]
        }
        ssh-inbound-eip = {
          description = "Permit SSH for VM-Series Management from known public IPs"
          type        = "ingress", from\_port = "22", to\_port = "22", protocol = "tcp"
          cidr\_blocks = ["100.100.100.100/32"]
        }
        https-inbound-self = {
          description = "Permit HTTPS from instances with the same security group"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          self        = true
        }
        https-inbound-security-groups = {
          description = "Permit HTTPS traffic for the resources associated with the specified security group"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          source\_security\_groups = ["sg-1a2b3c4d5e6f7g8h9i"]
        }
        https-inbound-prefix-list = {
          description = "Permit HTTPS for VM-Series Management for IPs in managed prefix list"
          type        = "ingress", from\_port = "443", to\_port = "443", protocol = "tcp"
          prefix\_list\_ids = ["pl-1a2b3c4d5e6f7g8h9i"]
        }
      }
    }
  }
 | `any` | `{}` | no |
 |  [use\_internet\_gateway](#input\_use\_internet\_gateway) | If an existing VPC is provided and has IG attached, set to `true` to reuse it. | `bool` | `false` | no |
 |  [vpc\_tags](#input\_vpc\_tags) | Optional map of arbitrary tags to apply to VPC resource. | `map` | `{}` | no |
 |  [vpn\_gateway\_amazon\_side\_asn](#input\_vpn\_gateway\_amazon\_side\_asn) | ASN for the Amazon side of the gateway. | `string` | `null` | no |
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/vpc_endpoint.md b/products/terraform/docs/swfw/aws/vmseries/modules/vpc_endpoint.md
new file mode 100644
index 000000000..c3ae00ecd
--- /dev/null
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/vpc_endpoint.md
@@ -0,0 +1,77 @@
+---
+hide_title: true
+id: vpc_endpoint
+keywords:
+- pan-os
+- panos
+- firewall
+- configuration
+- terraform
+- vmseries
+- vm-series
+- aws
+pagination_next: null
+pagination_prev: null
+sidebar_label: VPC Endpoint
+title: VPC Endpoint Module for AWS
+---
+
+# VPC Endpoint Module for AWS
+
+A Terraform module for deploying a VPC Endpoint for VM-Series firewalls.
+
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/vpc_endpoint) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/vpc_endpoint)
+
+## Reference
+
+### Requirements
+
+| Name | Version |
+|------|---------|
+|  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
+
+### Providers
+
+| Name | Version |
+|------|---------|
+|  [aws](#provider\_aws) | ~> 5.17 |
+
+### Modules
+
+No modules.
+
+### Resources
+
+| Name | Type |
+|------|------|
+| [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
+| [aws_vpc_endpoint_route_table_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_route_table_association) | resource |
+| [aws_vpc_endpoint_subnet_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_subnet_association) | resource |
+| [aws_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint) | data source |
+| [aws_vpc_endpoint_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc_endpoint_service) | data source |
+
+### Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+|  [auto\_accept](#input\_auto\_accept) | If a service connection requires service owner's acceptance, the request will be approved automatically, provided that both parties are members of the same AWS account. | `bool` | `null` | no |
+|  [create](#input\_create) | If false, does not create a new AWS VPC Endpoint, but instead uses a pre-existing one. The inputs `name`, `service_name`, `simple_service_name`, `tags`, `type`, and `vpc_id` can be used to match the pre-existing endpoint. | `bool` | `true` | no |
+|  [name](#input\_name) | n/a | `string` | `null` | no |
+|  [policy](#input\_policy) | n/a | `string` | `null` | no |
+|  [private\_dns\_enabled](#input\_private\_dns\_enabled) | n/a | `bool` | `null` | no |
+|  [route\_table\_ids](#input\_route\_table\_ids) | n/a | `map(string)` | `{}` | no |
+|  [security\_group\_ids](#input\_security\_group\_ids) | n/a | `list(string)` | `[]` | no |
+|  [service\_name](#input\_service\_name) | The exact service name. This input is ignored if `simple_service_name` is defined. Typically "com.amazonaws.REGION.SERVICE", for example: "com.amazonaws.us-west-2.s3" | `string` | `null` | no |
+|  [simple\_service\_name](#input\_simple\_service\_name) | The simplified service name for AWS service, for example: "s3". Uses the service from the current region. If null, the `service_name` input is used instead. | `string` | `null` | no |
+|  [subnets](#input\_subnets) | Map of Subnets where to create the Endpoints. Each map's key is the availability zone name and each map's object has an attribute
`id` identifying AWS Subnet. Importantly, the traffic returning from the Endpoint uses the Subnet's route table.
The keys of this input map are used for the output map `endpoints`.
Example for users of module `subnet_set`:
subnets = module.subnet\_set.subnets
Example:
subnets = {
  "us-east-1a" = { id = "snet-123007" }
  "us-east-1b" = { id = "snet-123008" }
}
 | 
map(object({
    id = string
  }))
 | `{}` | no |
+|  [tags](#input\_tags) | n/a | `map(string)` | `{}` | no |
+|  [type](#input\_type) | The type of the service.
The type "Gateway" does not tolerate inputs `subnets`,  `security_group_ids`, and `private_dns_enabled`.
The type "Interface" does not tolerate input `route_table_ids`.
The type "GatewayLoadBalancer" is similar to "Gateway", but can be deployed with the dedicated module `gwlb_endpoint_set`.
If null, "Gateway" is used by default. | `string` | n/a | yes |
+|  [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes |
+
+### Outputs
+
+| Name | Description |
+|------|-------------|
+|  [endpoint](#output\_endpoint) | The created `aws_vpc_endpoint` object. Alternatively, the data resource if the input `create` is false. |
+
\ No newline at end of file
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/vpc_route.md b/products/terraform/docs/swfw/aws/vmseries/modules/vpc_route.md
index 31dd549e4..0ce5e19de 100644
--- a/products/terraform/docs/swfw/aws/vmseries/modules/vpc_route.md
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/vpc_route.md
@@ -20,7 +20,7 @@ title: Palo Alto Networks VPC Route Module for AWS
 
 A Terraform module for deploying a VPC route in AWS cloud.
 
-[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/examples/vpc_route) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/examples/vpc_route)
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/vpc_route) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/vpc_route)
 
 ## Usage
 
@@ -86,13 +86,13 @@ module "vpc_route" {
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/modules/vpn.md b/products/terraform/docs/swfw/aws/vmseries/modules/vpn.md
new file mode 100644
index 000000000..49ab6c552
--- /dev/null
+++ b/products/terraform/docs/swfw/aws/vmseries/modules/vpn.md
@@ -0,0 +1,85 @@
+---
+hide_title: true
+id: vpn
+keywords:
+- pan-os
+- panos
+- firewall
+- configuration
+- terraform
+- vmseries
+- vm-series
+- aws
+pagination_next: null
+pagination_prev: null
+sidebar_label: VPN
+title: VPN Module for AWS
+---
+
+# VPN Module for AWS
+
+A Terraform module for deploying a VPN for VM-Series firewalls.
+
+[![GitHub Logo](/img/view_on_github.png)](https://github.com/PaloAltoNetworks/terraform-aws-vmseries-modules/tree/main/modules/vpn) [![Terraform Logo](/img/view_on_terraform_registry.png)](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/aws/latest/submodules/vpn)
+
+## Reference
+
+### Requirements
+
+| Name | Version |
+|------|---------|
+|  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
+
+### Providers
+
+| Name | Version |
+|------|---------|
+|  [aws](#provider\_aws) | ~> 5.17 |
+
+### Modules
+
+No modules.
+
+### Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_log_group.tunnel1_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_cloudwatch_log_group.tunnel2_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_customer_gateway.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/customer_gateway) | resource |
+| [aws_ec2_transit_gateway_route_table_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_association) | resource |
+| [aws_ec2_transit_gateway_route_table_propagation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_transit_gateway_route_table_propagation) | resource |
+| [aws_kms_alias.tunnel1_kms_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
+| [aws_kms_alias.tunnel2_kms_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
+| [aws_kms_key.tunnel1_kms_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
+| [aws_kms_key.tunnel2_kms_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
+| [aws_vpn_connection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpn_connection) | resource |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
+
+### Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+|  [customer\_gateway](#input\_customer\_gateway) | Customer gateway defined by attributes:
- bgp\_asn - (Required) The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
- certificate\_arn - (Optional) The Amazon Resource Name (ARN) for the customer gateway certificate.
- device\_name - (Optional) A name for the customer gateway device.
- ip\_address - (Optional) The IPv4 address for the customer gateway device's outside interface.
- type - (Required) The type of customer gateway. The only type AWS supports at this time is "ipsec.1".
- tags - (Optional) Tags to apply to the gateway. If configured with a provider default\_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level. | `any` | n/a | yes |
+|  [name\_prefix](#input\_name\_prefix) | A prefix added to all resource names created by this module | `string` | `""` | no |
+|  [name\_suffix](#input\_name\_suffix) | A sufix added to all resource names created by this module | `string` | `""` | no |
+|  [region](#input\_region) | AWS region used to deploy whole infrastructure | `string` | n/a | yes |
+|  [tags](#input\_tags) | Optional map of arbitrary tags to apply to all the created resources. | `map(string)` | `{}` | no |
+|  [transit\_gateway\_associate\_route\_table\_id](#input\_transit\_gateway\_associate\_route\_table\_id) | TGW route table ID used to associate VPN attachments created by VPN connections | `string` | n/a | yes |
+|  [transit\_gateway\_id](#input\_transit\_gateway\_id) | TGW's ID used by VPN connection | `string` | n/a | yes |
+|  [transit\_gateway\_propagate\_route\_table\_id](#input\_transit\_gateway\_propagate\_route\_table\_id) | TGW route table ID into which VPN attachment will propagate routes received by BGP | `string` | n/a | yes |
+|  [vpn\_connection](#input\_vpn\_connection) | VPN connection defined by attributes:
- customer\_gateway\_id - (Required) The ID of the customer gateway.
- type - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
- transit\_gateway\_id - (Optional) The ID of the EC2 Transit Gateway.
- static\_routes\_only - (Optional, Default false) Whether the VPN connection uses static routes exclusively. Static routes must be used for devices that don't support BGP.
- enable\_acceleration - (Optional, Default false) Indicate whether to enable acceleration for the VPN connection. Supports only EC2 Transit Gateway.
- tags - (Optional) Tags to apply to the connection. If configured with a provider default\_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- local\_ipv4\_network\_cidr - (Optional, Default 0.0.0.0/0) The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.
- local\_ipv6\_network\_cidr - (Optional, Default ::/0) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
- outside\_ip\_address\_type - (Optional, Default PublicIpv4) Indicates if a Public S2S VPN or Private S2S VPN over AWS Direct Connect. Valid values are PublicIpv4 \| PrivateIpv4
- remote\_ipv4\_network\_cidr - (Optional, Default 0.0.0.0/0) The IPv4 CIDR on the AWS side of the VPN connection.
- remote\_ipv6\_network\_cidr - (Optional, Default ::/0) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
- transport\_transit\_gateway\_attachment\_id - (Required when outside\_ip\_address\_type is set to PrivateIpv4). The attachment ID of the Transit Gateway attachment to Direct Connect Gateway. The ID is obtained through a data source only.
- tunnel\_inside\_ip\_version - (Optional, Default ipv4) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are ipv4 \| ipv6. ipv6 Supports only EC2 Transit Gateway.
- tunnel1\_inside\_cidr - (Optional) The CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
- tunnel2\_inside\_cidr - (Optional) The CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
- tunnel1\_inside\_ipv6\_cidr - (Optional) The range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
- tunnel2\_inside\_ipv6\_cidr - (Optional) The range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
- tunnel1\_preshared\_key - (Optional) The preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(\_).
- tunnel2\_preshared\_key - (Optional) The preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(\_).
- tunnel1\_dpd\_timeout\_action - (Optional, Default clear) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear \| none \| restart.
- tunnel2\_dpd\_timeout\_action - (Optional, Default clear) The action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are clear \| none \| restart.
- tunnel1\_dpd\_timeout\_seconds - (Optional, Default 30) The number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than 30.
- tunnel2\_dpd\_timeout\_seconds - (Optional, Default 30) The number of seconds after which a DPD timeout occurs for the second VPN tunnel. Valid value is equal or higher than 30.
- tunnel1\_enable\_tunnel\_lifecycle\_control - (Optional, Default false) Turn on or off tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are true \| false.
- tunnel2\_enable\_tunnel\_lifecycle\_control - (Optional, Default false) Turn on or off tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are true \| false.
- tunnel1\_ike\_versions - (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are ikev1 \| ikev2.
- tunnel2\_ike\_versions - (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are ikev1 \| ikev2.
- tunnel1\_log\_options - (Required) Options for logging VPN tunnel activity:
  - enabled - (Required) true if logs need to stored in CloudWatch logs
  - log\_group - (Required) The name of the log group.
  - retention\_in\_days - (Required) Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.
  - encrypted - (Required) true if logs need to be encrypted
- tunnel2\_log\_options - (Required) Options for logging VPN tunnel activity:
  - enabled - (Required) Required if logs need to stored in CloudWatch logs
  - log\_group - (Required) The name of the log group.
  - retention\_in\_days - (Required) Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.
  - encrypted - (Required) true if logs need to be encrypted
- tunnel1\_phase1\_dh\_group\_numbers - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are 2 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24.
- tunnel2\_phase1\_dh\_group\_numbers - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are 2 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24.
- tunnel1\_phase1\_encryption\_algorithms - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16.
- tunnel2\_phase1\_encryption\_algorithms - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16.
- tunnel1\_phase1\_integrity\_algorithms - (Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512.
- tunnel2\_phase1\_integrity\_algorithms - (Optional) One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512.
- tunnel1\_phase1\_lifetime\_seconds - (Optional, Default 28800) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 28800.
- tunnel2\_phase1\_lifetime\_seconds - (Optional, Default 28800) The lifetime for phase 1 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between 900 and 28800.
- tunnel1\_phase2\_dh\_group\_numbers - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are 2 \| 5 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24.
- tunnel2\_phase2\_dh\_group\_numbers - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are 2 \| 5 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24.
- tunnel1\_phase2\_encryption\_algorithms - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16.
- tunnel2\_phase2\_encryption\_algorithms - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are AES128 \| AES256 \| AES128-GCM-16 \| AES256-GCM-16.
- tunnel1\_phase2\_integrity\_algorithms - (Optional) List of one or more integrity algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512.
- tunnel2\_phase2\_integrity\_algorithms - (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are SHA1 \| SHA2-256 \| SHA2-384 \| SHA2-512.
- tunnel1\_phase2\_lifetime\_seconds - (Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between 900 and 3600.
- tunnel2\_phase2\_lifetime\_seconds - (Optional, Default 3600) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between 900 and 3600.
- tunnel1\_rekey\_fuzz\_percentage - (Optional, Default 100) The percentage of the rekey window for the first VPN tunnel (determined by tunnel1\_rekey\_margin\_time\_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100.
- tunnel2\_rekey\_fuzz\_percentage - (Optional, Default 100) The percentage of the rekey window for the second VPN tunnel (determined by tunnel2\_rekey\_margin\_time\_seconds) during which the rekey time is randomly selected. Valid value is between 0 and 100.
- tunnel1\_rekey\_margin\_time\_seconds - (Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel1\_rekey\_fuzz\_percentage. Valid value is between 60 and half of tunnel1\_phase2\_lifetime\_seconds.
- tunnel2\_rekey\_margin\_time\_seconds - (Optional, Default 540) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for tunnel2\_rekey\_fuzz\_percentage. Valid value is between 60 and half of tunnel2\_phase2\_lifetime\_seconds.
- tunnel1\_replay\_window\_size - (Optional, Default 1024) The number of packets in an IKE replay window for the first VPN tunnel. Valid value is between 64 and 2048.
- tunnel2\_replay\_window\_size - (Optional, Default 1024) The number of packets in an IKE replay window for the second VPN tunnel. Valid value is between 64 and 2048.
- tunnel1\_startup\_action - (Optional, Default add) The action to take when the establishing the tunnel for the first VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are add \| start.
- tunnel2\_startup\_action - (Optional, Default add) The action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are add \| start. | `any` | n/a | yes |
+|  [vpn\_gateway\_id](#input\_vpn\_gateway\_id) | Virtual Private Gateway's ID used by VPN connection | `string` | n/a | yes |
+
+### Outputs
+
+| Name | Description |
+|------|-------------|
+|  [customer\_gateway](#output\_customer\_gateway) | Object describing created customer gateway |
+|  [tunnel1](#output\_tunnel1) | Tunnel 1 details (public IP address, inside IP addresses, BGP ASN) |
+|  [tunnel2](#output\_tunnel2) | Tunnel 2 details (public IP address, inside IP addresses, BGP ASN) |
+|  [vpn\_connection](#output\_vpn\_connection) | Object describing created Site-to-Site VPN connection |
+
\ No newline at end of file
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design.md
index 213c59932..ddb27294c 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design.md
@@ -70,14 +70,14 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 |  [local](#requirement\_local) | ~> 2.4.0 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -110,8 +110,10 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 | [aws_instance.spoke_vms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
 | [aws_lb_target_group_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -129,7 +131,7 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [tgw](#input\_tgw) | A object defining Transit Gateway.

Following properties are available:
- `create`: set to false, if existing TGW needs to be reused
- `id`:  id of existing TGW or null
- `name`: name of TGW to create or use
- `asn`: ASN number
- `route_tables`: map of route tables
- `attachments`: map of TGW attachments

Example:
tgw = {
  create = true
  id     = null
  name   = "tgw"
  asn    = "64512"
  route\_tables = {
    "from\_security\_vpc" = {
      create = true
      name   = "from\_security"
    }
  }
  attachments = {
    security = {
      name                = "vmseries"
      vpc\_subnet          = "security\_vpc-tgw\_attach"
      route\_table         = "from\_security\_vpc"
      propagate\_routes\_to = "from\_spoke\_vpc"
    }
  }
}
 | 
object({
    create = bool
    id     = string
    name   = string
    asn    = string
    route\_tables = map(object({
      create = bool
      name   = string
    }))
    attachments = map(object({
      name                = string
      vpc\_subnet          = string
      route\_table         = string
      propagate\_routes\_to = string
    }))
  })
 | `null` | no |
 |  [vmseries](#input\_vmseries) | A map defining VM-Series instances

Following properties are available:
- `instances`: map of VM-Series instances
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `system_services`: map of system services
- `application_lb`: ALB placed in front of the Firewalls' public interfaces
- `network_lb`: NLB placed in front of the Firewalls' public interfaces

Example:
vmseries = {
  vmseries = {
    instances = {
      "01" = { az = "eu-central-1a" }
      "02" = { az = "eu-central-1b" }
    }

    # Value of `panorama-server`, `auth-key`, `dgname`, `tplname` can be taken from plugin `sw\_fw\_license`
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable"
      dhcp-send-hostname          = "yes"
      dhcp-send-client-id         = "yes"
      dhcp-accept-server-hostname = "yes"
      dhcp-accept-server-domain   = "yes"
    }

    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here

    # Value of `vpc` must match key of objects stored in `vpcs`
    vpc = "security\_vpc"

    # Value of `gwlb` must match key of objects stored in `gwlbs`
    gwlb = "security\_gwlb"

    interfaces = {
      private = {
        device\_index      = 0
        security\_group    = "vmseries\_private"
        vpc\_subnet        = "security\_vpc-private"
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index      = 1
        security\_group    = "vmseries\_mgmt"
        vpc\_subnet        = "security\_vpc-mgmt"
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index      = 2
        security\_group    = "vmseries\_public"
        vpc\_subnet        = "security\_vpc-public"
        create\_public\_ip  = true
        source\_dest\_check = false
      }
    }

    # Value of `gwlb\_endpoint` must match key of objects stored in `gwlb\_endpoints`
    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }

    system\_services = {
      dns\_primary = "4.2.2.2"      # TODO: update here
      dns\_secondy = null           # TODO: update here
      ntp\_primary = "pool.ntp.org" # TODO: update here
      ntp\_secondy = null           # TODO: update here
    }

    application\_lb = null
    network\_lb     = null
  }
}
 | 
map(object({
    instances = map(object({
      az = string
    }))

    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      vpc\_subnet        = string
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    system\_services = object({
      dns\_primary = string
      dns\_secondy = string
      ntp\_primary = string
      ntp\_secondy = string
    })

    application\_lb = object({
      name  = string
      rules = any
    })

    network\_lb = object({
      name  = string
      rules = any
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design_autoscale.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design_autoscale.md
index b893042fc..1a9896bec 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design_autoscale.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/centralized_design_autoscale.md
@@ -151,14 +151,14 @@ statistic    = "Maximum"
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 |  [local](#requirement\_local) | ~> 2.4.0 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -190,8 +190,10 @@ statistic    = "Maximum"
 | [aws_iam_role_policy.vm_series_ec2_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_instance.spoke_vms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -209,7 +211,7 @@ statistic    = "Maximum"
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [tgw](#input\_tgw) | A object defining Transit Gateway.

Following properties are available:
- `create`: set to false, if existing TGW needs to be reused
- `id`:  id of existing TGW or null
- `name`: name of TGW to create or use
- `asn`: ASN number
- `route_tables`: map of route tables
- `attachments`: map of TGW attachments

Example:
tgw = {
  create = true
  id     = null
  name   = "tgw"
  asn    = "64512"
  route\_tables = {
    "from\_security\_vpc" = {
      create = true
      name   = "from\_security"
    }
  }
  attachments = {
    security = {
      name                = "vmseries"
      vpc\_subnet          = "security\_vpc-tgw\_attach"
      route\_table         = "from\_security\_vpc"
      propagate\_routes\_to = "from\_spoke\_vpc"
    }
  }
}
 | 
object({
    create = bool
    id     = string
    name   = string
    asn    = string
    route\_tables = map(object({
      create = bool
      name   = string
    }))
    attachments = map(object({
      name                = string
      vpc\_subnet          = string
      route\_table         = string
      propagate\_routes\_to = string
    }))
  })
 | `null` | no |
 |  [vmseries\_asgs](#input\_vmseries\_asgs) | A map defining Autoscaling Groups with VM-Series instances.

Following properties are available:
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `interfaces`: configuration of network interfaces for VM-Series used by Lamdba while provisioning new VM-Series in autoscaling group
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `asg`: the number of Amazon EC2 instances that should be running in the group (desired, minimum, maximum)
- `scaling_plan`: scaling plan with attributes
  - `enabled`: `true` if automatic dynamic scaling policy should be created
  - `metric_name`: name of the metric used in dynamic scaling policy
  - `target_value`: target value for the metric used in dynamic scaling policy
  - `statistic`: statistic of the metric. Valid values: Average, Maximum, Minimum, SampleCount, Sum
  - `cloudwatch_namespace`: name of CloudWatch namespace, where metrics are available (it should be the same as namespace configured in VM-Series plugin in PAN-OS)
  - `tags`: tags configured for dynamic scaling policy

Example:
vmseries\_asgs = {
  main\_asg = {
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable" # TODO: update here
      panorama-server             = ""                                                                                   # TODO: update here
      auth-key                    = ""                                                                                   # TODO: update here
      dgname                      = ""                                                                                   # TODO: update here
      tplname                     = ""                                                                                   # TODO: update here
      dhcp-send-hostname          = "yes"                                                                                # TODO: update here
      dhcp-send-client-id         = "yes"                                                                                # TODO: update here
      dhcp-accept-server-hostname = "yes"                                                                                # TODO: update here
      dhcp-accept-server-domain   = "yes"                                                                                # TODO: update here
    }

    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here

    vpc               = "security\_vpc"
    gwlb              = "security\_gwlb"

    interfaces = {
      private = {
        device\_index   = 0
        security\_group = "vmseries\_private"
        subnet = {
          "privatea" = "eu-central-1a",
          "privateb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index   = 1
        security\_group = "vmseries\_mgmt"
        subnet = {
          "mgmta" = "eu-central-1a",
          "mgmtb" = "eu-central-1b"
        }
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index   = 2
        security\_group = "vmseries\_public"
        subnet = {
          "publica" = "eu-central-1a",
          "publicb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
    }

    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }

    asg = {
      desired\_cap = 2
      min\_size    = 2
      max\_size    = 4
    }

    scaling\_plan = {
      enabled              = true               # TODO: update here
      metric\_name          = "panSessionActive" # TODO: update here
      target\_value         = 75                 # TODO: update here
      statistic            = "Average"          # TODO: update here
      cloudwatch\_namespace = "example-vmseries" # TODO: update here
      tags = {
        ManagedBy = "terraform"
      }
    }

    application\_lb = null
    network\_lb     = null      
  }
}
 | 
map(object({
    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      subnet            = map(string)
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    asg = object({
      desired\_cap = number
      min\_size    = number
      max\_size    = number
    })

    scaling\_plan = object({
      enabled              = bool
      metric\_name          = string
      target\_value         = number
      statistic            = string
      cloudwatch\_namespace = string
      tags                 = map(string)
    })

    application\_lb = object({
      name  = string
      rules = any
    })

    network\_lb = object({
      name  = string
      rules = any
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design.md
index ba413ac8f..785798fa0 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design.md
@@ -105,13 +105,13 @@ If no errors occurred during deployment, configure the VM-Series machines as exp
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -143,8 +143,10 @@ If no errors occurred during deployment, configure the VM-Series machines as exp
 | [aws_instance.spoke_vms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
 | [aws_lb_target_group_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -163,7 +165,7 @@ If no errors occurred during deployment, configure the VM-Series machines as exp
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [tgw](#input\_tgw) | A object defining Transit Gateway.

Following properties are available:
- `create`: set to false, if existing TGW needs to be reused
- `id`:  id of existing TGW or null
- `name`: name of TGW to create or use
- `asn`: ASN number
- `route_tables`: map of route tables
- `attachments`: map of TGW attachments

Example:
tgw = {
  create = true
  id     = null
  name   = "tgw"
  asn    = "64512"
  route\_tables = {
    "from\_security\_vpc" = {
      create = true
      name   = "from\_security"
    }
  }
  attachments = {
    security = {
      name                = "vmseries"
      vpc\_subnet          = "security\_vpc-tgw\_attach"
      route\_table         = "from\_security\_vpc"
      propagate\_routes\_to = "from\_spoke\_vpc"
    }
  }
}
 | 
object({
    create = bool
    id     = string
    name   = string
    asn    = string
    route\_tables = map(object({
      create = bool
      name   = string
    }))
    attachments = map(object({
      name                = string
      vpc\_subnet          = string
      route\_table         = string
      propagate\_routes\_to = string
    }))
  })
 | `null` | no |
 |  [vmseries](#input\_vmseries) | A map defining VM-Series instances
Following properties are available:
- `instances`: map of VM-Series instances
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `system_services`: map of system services
- `application_lb`: ALB placed in front of the Firewalls' public interfaces
- `network_lb`: NLB placed in front of the Firewalls' public interfaces
Example:
vmseries = {
  vmseries = {
    instances = {
      "01" = { az = "eu-central-1a" }
      "02" = { az = "eu-central-1b" }
    }
    # Value of `panorama-server`, `auth-key`, `dgname`, `tplname` can be taken from plugin `sw\_fw\_license`
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable"
      dhcp-send-hostname          = "yes"
      dhcp-send-client-id         = "yes"
      dhcp-accept-server-hostname = "yes"
      dhcp-accept-server-domain   = "yes"
    }
    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here
    # Value of `vpc` must match key of objects stored in `vpcs`
    vpc = "security\_vpc"
    # Value of `gwlb` must match key of objects stored in `gwlbs`
    gwlb = "security\_gwlb"
    interfaces = {
      private = {
        device\_index      = 0
        security\_group    = "vmseries\_private"
        vpc\_subnet        = "security\_vpc-private"
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index      = 1
        security\_group    = "vmseries\_mgmt"
        vpc\_subnet        = "security\_vpc-mgmt"
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index      = 2
        security\_group    = "vmseries\_public"
        vpc\_subnet        = "security\_vpc-public"
        create\_public\_ip  = true
        source\_dest\_check = false
      }
    }
    # Value of `gwlb\_endpoint` must match key of objects stored in `gwlb\_endpoints`
    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }
    system\_services = {
      dns\_primary = "4.2.2.2"      # TODO: update here
      dns\_secondy = null           # TODO: update here
      ntp\_primary = "pool.ntp.org" # TODO: update here
      ntp\_secondy = null           # TODO: update here
    }
    application\_lb = null
    network\_lb     = null
  }
}
 | 
map(object({
    instances = map(object({
      az = string
    }))

    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      vpc\_subnet        = string
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    system\_services = object({
      dns\_primary = string
      dns\_secondy = string
      ntp\_primary = string
      ntp\_secondy = string
    })

    application\_lb = object({
      name  = string
      rules = any
    })

    network\_lb = object({
      name  = string
      rules = any
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design_autoscale.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design_autoscale.md
index 9a1aa17c3..fb2ab7b93 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design_autoscale.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/combined_design_autoscale.md
@@ -61,7 +61,9 @@ The following steps should be followed before deploying the Terraform code prese
 7. Configure interface management profile to enable health checks from GWLB
 8. Configure network interfaces and subinterfaces, zones and virtual router in template
 9. Configure [static routes with path monitoring](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/static-routes/configure-path-monitoring-for-a-static-route)
-Details
+10. Configure VPC peering between VPC with Panorama and VPC with VM-Series in autoscaling group (after deploying that example)
+
+### Details - static routes with path monitoring
 
 Using multiple template stacks, one for each AZ complicates autoscaling and the Panorama Licensing plugin configuration. The virtual router (VR) configuration combined with path monitoring outlined below avoids using AZ-specific template stacks and variables.
 
@@ -93,8 +95,6 @@ An example XML configuration snippet (for PANOS 10.2.3) of the described configu
 load config partial mode merge from-xpath /config/devices/entry/template/entry[@name='asg'] to-xpath /config/devices/entry/template/entry[@name='asg'] from template-asg-path-monitoring.xml
 ```
 
-10. Configure VPC peering between VPC with Panorama and VPC with VM-Series in autoscaling group (after deploying that example)
-
 ## Usage
 
 ### NAT Gateway Option
@@ -226,13 +226,13 @@ statistic    = "Maximum"
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -262,8 +262,10 @@ statistic    = "Maximum"
 | [aws_iam_role_policy.vm_series_ec2_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_instance.spoke_vms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -281,7 +283,7 @@ statistic    = "Maximum"
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [tgw](#input\_tgw) | A object defining Transit Gateway.

Following properties are available:
- `create`: set to false, if existing TGW needs to be reused
- `id`:  id of existing TGW or null
- `name`: name of TGW to create or use
- `asn`: ASN number
- `route_tables`: map of route tables
- `attachments`: map of TGW attachments

Example:
tgw = {
  create = true
  id     = null
  name   = "tgw"
  asn    = "64512"
  route\_tables = {
    "from\_security\_vpc" = {
      create = true
      name   = "from\_security"
    }
  }
  attachments = {
    security = {
      name                = "vmseries"
      vpc\_subnet          = "security\_vpc-tgw\_attach"
      route\_table         = "from\_security\_vpc"
      propagate\_routes\_to = "from\_spoke\_vpc"
    }
  }
}
 | 
object({
    create = bool
    id     = string
    name   = string
    asn    = string
    route\_tables = map(object({
      create = bool
      name   = string
    }))
    attachments = map(object({
      name                = string
      vpc\_subnet          = string
      route\_table         = string
      propagate\_routes\_to = string
    }))
  })
 | `null` | no |
 |  [vmseries\_asgs](#input\_vmseries\_asgs) | A map defining Autoscaling Groups with VM-Series instances.

Following properties are available:
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `interfaces`: configuration of network interfaces for VM-Series used by Lamdba while provisioning new VM-Series in autoscaling group
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `asg`: the number of Amazon EC2 instances that should be running in the group (desired, minimum, maximum)
- `scaling_plan`: scaling plan with attributes
  - `enabled`: `true` if automatic dynamic scaling policy should be created
  - `metric_name`: name of the metric used in dynamic scaling policy
  - `target_value`: target value for the metric used in dynamic scaling policy
  - `statistic`: statistic of the metric. Valid values: Average, Maximum, Minimum, SampleCount, Sum
  - `cloudwatch_namespace`: name of CloudWatch namespace, where metrics are available (it should be the same as namespace configured in VM-Series plugin in PAN-OS)
  - `tags`: tags configured for dynamic scaling policy

Example:
vmseries\_asgs = {
  main\_asg = {
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable" # TODO: update here
      panorama-server             = ""                                                                                   # TODO: update here
      auth-key                    = ""                                                                                   # TODO: update here
      dgname                      = ""                                                                                   # TODO: update here
      tplname                     = ""                                                                                   # TODO: update here
      dhcp-send-hostname          = "yes"                                                                                # TODO: update here
      dhcp-send-client-id         = "yes"                                                                                # TODO: update here
      dhcp-accept-server-hostname = "yes"                                                                                # TODO: update here
      dhcp-accept-server-domain   = "yes"                                                                                # TODO: update here
    }

    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here

    vpc               = "security\_vpc"
    gwlb              = "security\_gwlb"

    interfaces = {
      private = {
        device\_index   = 0
        security\_group = "vmseries\_private"
        subnet = {
          "privatea" = "eu-central-1a",
          "privateb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index   = 1
        security\_group = "vmseries\_mgmt"
        subnet = {
          "mgmta" = "eu-central-1a",
          "mgmtb" = "eu-central-1b"
        }
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index   = 2
        security\_group = "vmseries\_public"
        subnet = {
          "publica" = "eu-central-1a",
          "publicb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
    }

    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }

    asg = {
      desired\_cap = 2
      min\_size    = 2
      max\_size    = 4
    }

    scaling\_plan = {
      enabled              = true               # TODO: update here
      metric\_name          = "panSessionActive" # TODO: update here
      target\_value         = 75                 # TODO: update here
      statistic            = "Average"          # TODO: update here
      cloudwatch\_namespace = "example-vmseries" # TODO: update here
      tags = {
        ManagedBy = "terraform"
      }
    }

    delicense = {
      enabled = true
      ssm\_param\_name = "example\_param\_store\_delicense" # TODO: update here
    }
  }
}
 | 
map(object({
    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      subnet            = map(string)
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    asg = object({
      desired\_cap = number
      min\_size    = number
      max\_size    = number
    })

    scaling\_plan = object({
      enabled              = bool
      metric\_name          = string
      target\_value         = number
      statistic            = string
      cloudwatch\_namespace = string
      tags                 = map(string)
    })

    delicense = object({
      enabled        = bool
      ssm\_param\_name = string
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design.md
index 8f2b24c0f..0bdf95828 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design.md
@@ -76,13 +76,13 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -110,8 +110,10 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 | [aws_lb_target_group_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | resource |
 | [aws_vpc_peering_connection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -128,7 +130,7 @@ In example VM-Series are licensed using [Panorama-Based Software Firewall Licens
 |  [spoke\_vms](#input\_spoke\_vms) | A map defining VMs in spoke VPCs.

Following properties are available:
- `az`: name of the Availability Zone
- `vpc`: name of the VPC (needs to be one of the keys in map `vpcs`)
- `vpc_subnet`: key of the VPC and subnet connected by '-' character
- `security_group`: security group assigned to ENI used by VM
- `type`: EC2 type VM

Example:
spoke\_vms = {
  "app1\_vm01" = {
    az             = "eu-central-1a"
    vpc            = "app1\_vpc"
    vpc\_subnet     = "app1\_vpc-app1\_vm"
    security\_group = "app1\_vm"
    type           = "t2.micro"
  }
}
 | 
map(object({
    az             = string
    vpc            = string
    vpc\_subnet     = string
    security\_group = string
    type           = string
  }))
 | `{}` | no |
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [vmseries](#input\_vmseries) | A map defining VM-Series instances
Following properties are available:
- `instances`: map of VM-Series instances
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `system_services`: map of system services
- `application_lb`: ALB placed in front of the Firewalls' public interfaces
- `network_lb`: NLB placed in front of the Firewalls' public interfaces
Example:
vmseries = {
  vmseries = {
    instances = {
      "01" = { az = "eu-central-1a" }
      "02" = { az = "eu-central-1b" }
    }
    # Value of `panorama-server`, `auth-key`, `dgname`, `tplname` can be taken from plugin `sw\_fw\_license`
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable"
      dhcp-send-hostname          = "yes"
      dhcp-send-client-id         = "yes"
      dhcp-accept-server-hostname = "yes"
      dhcp-accept-server-domain   = "yes"
    }
    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here
    # Value of `vpc` must match key of objects stored in `vpcs`
    vpc = "security\_vpc"
    # Value of `gwlb` must match key of objects stored in `gwlbs`
    gwlb = "security\_gwlb"
    interfaces = {
      private = {
        device\_index      = 0
        security\_group    = "vmseries\_private"
        vpc\_subnet        = "security\_vpc-private"
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index      = 1
        security\_group    = "vmseries\_mgmt"
        vpc\_subnet        = "security\_vpc-mgmt"
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index      = 2
        security\_group    = "vmseries\_public"
        vpc\_subnet        = "security\_vpc-public"
        create\_public\_ip  = true
        source\_dest\_check = false
      }
    }
    # Value of `gwlb\_endpoint` must match key of objects stored in `gwlb\_endpoints`
    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }
    system\_services = {
      dns\_primary = "4.2.2.2"      # TODO: update here
      dns\_secondy = null           # TODO: update here
      ntp\_primary = "pool.ntp.org" # TODO: update here
      ntp\_secondy = null           # TODO: update here
    }
    application\_lb = null
    network\_lb     = null
  }
}
 | 
map(object({
    instances = map(object({
      az = string
    }))

    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      vpc\_subnet        = string
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    system\_services = object({
      dns\_primary = string
      dns\_secondy = string
      ntp\_primary = string
      ntp\_secondy = string
    })

    application\_lb = object({
      name  = string
      rules = any
    })

    network\_lb = object({
      name  = string
      rules = any
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs
 
diff --git a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design_autoscale.md b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design_autoscale.md
index 22d315838..d7b16478e 100644
--- a/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design_autoscale.md
+++ b/products/terraform/docs/swfw/aws/vmseries/reference-architectures/isolated_design_autoscale.md
@@ -57,7 +57,9 @@ The following steps should be followed before deploying the Terraform code prese
 7. Configure interface management profile to enable health checks from GWLB
 8. Configure network interfaces and subinterfaces, zones and virtual router in template
 9. Configure [static routes with path monitoring](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/static-routes/configure-path-monitoring-for-a-static-route)
-Details
+10. Configure VPC peering between VPC with Panorama and VPC with VM-Series in autoscaling group (after deploying that example)
+
+### Details - static routes with path monitoring
 
 Using multiple template stacks, one for each AZ complicates autoscaling and the Panorama Licensing plugin configuration. The virtual router (VR) configuration combined with path monitoring outlined below avoids using AZ-specific template stacks and variables.
 
@@ -89,8 +91,6 @@ An example XML configuration snippet (for PANOS 10.2.3) of the described configu
 load config partial mode merge from-xpath /config/devices/entry/template/entry[@name='asg'] to-xpath /config/devices/entry/template/entry[@name='asg'] from template-asg-path-monitoring.xml
 ```
 
-10. Configure VPC peering between VPC with Panorama and VPC with VM-Series in autoscaling group (after deploying that example)
-
 ## Usage
 
 1. Copy `example.tfvars` into `terraform.tfvars`
@@ -185,13 +185,13 @@ statistic    = "Maximum"
 | Name | Version |
 |------|---------|
 |  [terraform](#requirement\_terraform) | >= 1.0.0, < 2.0.0 |
-|  [aws](#requirement\_aws) | ~> 4.25 |
+|  [aws](#requirement\_aws) | ~> 5.17 |
 
 ### Providers
 
 | Name | Version |
 |------|---------|
-|  [aws](#provider\_aws) | ~> 4.25 |
+|  [aws](#provider\_aws) | ~> 5.17 |
 
 ### Modules
 
@@ -218,8 +218,10 @@ statistic    = "Maximum"
 | [aws_instance.spoke_vms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) | resource |
 | [aws_vpc_peering_connection.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection) | resource |
 | [aws_ami.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
+| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
 | [aws_kms_alias.current_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source |
+| [aws_partition.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ### Inputs
 
@@ -236,7 +238,7 @@ statistic    = "Maximum"
 |  [spoke\_vms](#input\_spoke\_vms) | A map defining VMs in spoke VPCs.

Following properties are available:
- `az`: name of the Availability Zone
- `vpc`: name of the VPC (needs to be one of the keys in map `vpcs`)
- `vpc_subnet`: key of the VPC and subnet connected by '-' character
- `security_group`: security group assigned to ENI used by VM
- `type`: EC2 type VM

Example:
spoke\_vms = {
  "app1\_vm01" = {
    az             = "eu-central-1a"
    vpc            = "app1\_vpc"
    vpc\_subnet     = "app1\_vpc-app1\_vm"
    security\_group = "app1\_vm"
    type           = "t2.micro"
  }
}
 | 
map(object({
    az             = string
    vpc            = string
    vpc\_subnet     = string
    security\_group = string
    type           = string
  }))
 | `{}` | no |
 |  [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes |
 |  [vmseries\_asgs](#input\_vmseries\_asgs) | A map defining Autoscaling Groups with VM-Series instances.

Following properties are available:
- `bootstrap_options`: VM-Seriess bootstrap options used to connect to Panorama
- `panos_version`: PAN-OS version used for VM-Series
- `ebs_kms_id`: alias for AWS KMS used for EBS encryption in VM-Series
- `vpc`: key of VPC
- `gwlb`: key of GWLB
- `interfaces`: configuration of network interfaces for VM-Series used by Lamdba while provisioning new VM-Series in autoscaling group
- `subinterfaces`: configuration of network subinterfaces used to map with GWLB endpoints
- `asg`: the number of Amazon EC2 instances that should be running in the group (desired, minimum, maximum)
- `scaling_plan`: scaling plan with attributes
  - `enabled`: `true` if automatic dynamic scaling policy should be created
  - `metric_name`: name of the metric used in dynamic scaling policy
  - `target_value`: target value for the metric used in dynamic scaling policy
  - `statistic`: statistic of the metric. Valid values: Average, Maximum, Minimum, SampleCount, Sum
  - `cloudwatch_namespace`: name of CloudWatch namespace, where metrics are available (it should be the same as namespace configured in VM-Series plugin in PAN-OS)
  - `tags`: tags configured for dynamic scaling policy

Example:
vmseries\_asgs = {
  main\_asg = {
    bootstrap\_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable" # TODO: update here
      panorama-server             = ""                                                                                   # TODO: update here
      auth-key                    = ""                                                                                   # TODO: update here
      dgname                      = ""                                                                                   # TODO: update here
      tplname                     = ""                                                                                   # TODO: update here
      dhcp-send-hostname          = "yes"                                                                                # TODO: update here
      dhcp-send-client-id         = "yes"                                                                                # TODO: update here
      dhcp-accept-server-hostname = "yes"                                                                                # TODO: update here
      dhcp-accept-server-domain   = "yes"                                                                                # TODO: update here
    }

    panos\_version = "10.2.3"        # TODO: update here
    ebs\_kms\_id    = "alias/aws/ebs" # TODO: update here

    vpc               = "security\_vpc"
    gwlb              = "security\_gwlb"

    interfaces = {
      private = {
        device\_index   = 0
        security\_group = "vmseries\_private"
        subnet = {
          "privatea" = "eu-central-1a",
          "privateb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
      mgmt = {
        device\_index   = 1
        security\_group = "vmseries\_mgmt"
        subnet = {
          "mgmta" = "eu-central-1a",
          "mgmtb" = "eu-central-1b"
        }
        create\_public\_ip  = true
        source\_dest\_check = true
      }
      public = {
        device\_index   = 2
        security\_group = "vmseries\_public"
        subnet = {
          "publica" = "eu-central-1a",
          "publicb" = "eu-central-1b"
        }
        create\_public\_ip  = false
        source\_dest\_check = false
      }
    }

    subinterfaces = {
      inbound = {
        app1 = {
          gwlb\_endpoint = "app1\_inbound"
          subinterface  = "ethernet1/1.11"
        }
        app2 = {
          gwlb\_endpoint = "app2\_inbound"
          subinterface  = "ethernet1/1.12"
        }
      }
      outbound = {
        only\_1\_outbound = {
          gwlb\_endpoint = "security\_gwlb\_outbound"
          subinterface  = "ethernet1/1.20"
        }
      }
      eastwest = {
        only\_1\_eastwest = {
          gwlb\_endpoint = "security\_gwlb\_eastwest"
          subinterface  = "ethernet1/1.30"
        }
      }
    }

    asg = {
      desired\_cap = 2
      min\_size    = 2
      max\_size    = 4
    }

    scaling\_plan = {
      enabled              = true               # TODO: update here
      metric\_name          = "panSessionActive" # TODO: update here
      target\_value         = 75                 # TODO: update here
      statistic            = "Average"          # TODO: update here
      cloudwatch\_namespace = "example-vmseries" # TODO: update here
      tags = {
        ManagedBy = "terraform"
      }
    }
  }
}
 | 
map(object({
    bootstrap\_options = object({
      mgmt-interface-swap         = string
      plugin-op-commands          = string
      panorama-server             = string
      auth-key                    = string
      dgname                      = string
      tplname                     = string
      dhcp-send-hostname          = string
      dhcp-send-client-id         = string
      dhcp-accept-server-hostname = string
      dhcp-accept-server-domain   = string
    })

    panos\_version = string
    ebs\_kms\_id    = string

    vpc  = string
    gwlb = string

    interfaces = map(object({
      device\_index      = number
      security\_group    = string
      subnet            = map(string)
      create\_public\_ip  = bool
      source\_dest\_check = bool
    }))

    subinterfaces = map(map(object({
      gwlb\_endpoint = string
      subinterface  = string
    })))

    asg = object({
      desired\_cap = number
      min\_size    = number
      max\_size    = number
    })

    scaling\_plan = object({
      enabled              = bool
      metric\_name          = string
      target\_value         = number
      statistic            = string
      cloudwatch\_namespace = string
      tags                 = map(string)
    })
  }))
 | `{}` | no |
-|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = map(object({
      name = string
      rules = map(object({
        description = string
        type        = string,
        from\_port   = string
        to\_port     = string,
        protocol    = string
        cidr\_blocks = list(string)
      }))
    }))
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
+|  [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `nacls`: map of network ACLs
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
   - `az`: availability zone
   - `set`: internal identifier referenced by main.tf
   - `nacl`: key of NACL (can be null)
- `routes`: map of routes with properties:
   - `vpc_subnet` - built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
   - `next_hop_key` - must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
   - `next_hop_type` - internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
vpcs = {
  example\_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted\_path\_monitoring = {
        name               = "trusted-path-monitoring"
        rules = {
          allow\_inbound = {
            rule\_number = 300
            egress      = false
            protocol    = "-1"
            rule\_action = "allow"
            cidr\_block  = "0.0.0.0/0"
            from\_port   = null
            to\_port     = null
          }
        }
      }
    }
    security\_groups = {
      example\_vm = {
        name = "example\_vm"
        rules = {
          all\_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from\_port = "0", to\_port = "0", protocol = "-1"
            cidr\_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", set = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", set = "vm", nacl = null }
    }
    routes = {
      vm\_default = {
        vpc\_subnet    = "app1\_vpc-app1\_vm"
        to\_cidr       = "0.0.0.0/0"
        next\_hop\_key  = "app1"
        next\_hop\_type = "transit\_gateway\_attachment"
      }
    }
  }
}
 | 
map(object({
    name = string
    cidr = string
    nacls = map(object({
      name = string
      rules = map(object({
        rule\_number = number
        egress      = bool
        protocol    = string
        rule\_action = string
        cidr\_block  = string
        from\_port   = string
        to\_port     = string
      }))
    }))
    security\_groups = any
    subnets = map(object({
      az   = string
      set  = string
      nacl = string
    }))
    routes = map(object({
      vpc\_subnet    = string
      to\_cidr       = string
      next\_hop\_key  = string
      next\_hop\_type = string
    }))
  }))
 | `{}` | no |
 
 ### Outputs