From d54369fdddf47af8cf21f68ee190e80adce3b03f Mon Sep 17 00:00:00 2001
From: badra001 <donald.e.badrak.ii@census.gov>
Date: Fri, 8 May 2026 11:37:13 -0400
Subject: [PATCH] * 2.14.0 -- 2026-05-08   - routing     - update to associate
 nat-gateway on public subnet if boc:vpc:attach-nat-gateway=true

---
 CHANGELOG.md      | 3 +++
 common/version.tf | 2 +-
 routing/main.tf   | 3 ++-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 074e7a7..56be768 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -498,3 +498,6 @@
     - add variable for dns_support, default to false (disabled)
     - this comes from the resolution of AWS support case 176963314006987 from ent-gov-operations-prod account
 
+* 2.14.0 -- 2026-05-08
+  - routing
+    - update to associate nat-gateway on public subnet if boc:vpc:attach-nat-gateway=true
diff --git a/common/version.tf b/common/version.tf
index bc14e09..0b3bb2c 100644
--- a/common/version.tf
+++ b/common/version.tf
@@ -1,5 +1,5 @@
 locals {
-  _module_version = "2.13.1"
+  _module_version = "2.14.0"
   _module_names = {
     "_main_" = "aws-vpc-setup"
 
diff --git a/routing/main.tf b/routing/main.tf
index d52b38f..5597159 100644
--- a/routing/main.tf
+++ b/routing/main.tf
@@ -115,8 +115,9 @@ resource "aws_internet_gateway" "gateway" {
 
 # assume only 1 public subnet block (per AZ)
 # should figure out the first one
+# looks at boc:vpc:attach-nat-gateway=true
 locals {
-  public_subnets_ids_az = { for subnet in var.public_subnets_ids : subnet.availability_zone => subnet }
+  public_subnets_ids_az = { for subnet in var.public_subnets_ids : subnet.availability_zone => subnet if try(subnet.tags["boc:vpc:attach-nat-gateway"] == "true", false) }
 }
 
 resource "aws_nat_gateway" "nat" {