[pablo19sc]

Description

Updates the Centralized VPC Endpoints pattern to show both ways of consuming centralized interface endpoints through VPC Lattice, side by side:

• Group model: one group resource configuration (group_domain = <region>.amazonaws.com) with one child per endpoint, associated with the service network once. VPC Lattice creates a private hosted zone for the whole group domain in the consumer VPC, so any AWS service under <region>.amazonaws.com that isn't a child returns NXDOMAIN. That suits environments where VPCs must have no other path to AWS services.
• Single model: one single resource configuration per endpoint, each associated with the service network. Only the centralized service names get a hosted zone, so other AWS services resolve normally.

Each model has its own service network and consumer VPC, because two resource configurations with the same custom domain can't be in the same service network. The endpoints VPC, interface endpoints and resource gateway are shared. The pattern README explains why there are two models, compares them, and lists what to take into account for each.

Other changes:

• IaC split by account role: centralized_endpoints, consumer_group, consumer_single, plus a small main / common for the items both consumers use. Terraform and CloudFormation have the same layout. CONVENTIONS.md §2 and deploy-and-test.md now note that a pattern may split per role.
• Access logging: four log groups (one per service network, one for the group resource configuration, one shared by the single resource configurations). The service-network subscriptions set service_network_log_type = RESOURCE, so resource traffic is recorded.
• Terraform: everything moves to hashicorp/aws except the group resource configuration, which stays on awscc until group_domain is supported (r/aws_vpclattice_resource_configuration: add support for group_domain attribute hashicorp/terraform-provider-aws#48843). The provider floors are unchanged.
• CloudFormation: the templates are renamed (vpc_endpoints.yaml → centralized_endpoints.yaml, consumer.yaml → consumer_group.yaml), and common.yaml and consumer_single.yaml are new. The Makefile deploys 4 stacks. The resource-configuration access-log subscriptions are chained with DependsOn, because creating them in parallel fails with a CloudWatch Logs OperationAbortedException.
• The architecture diagram is updated.

Where is the change?

• patterns/ — a new deployable pattern
• patterns/ — an update to an existing pattern
• patterns/4-auth_policies/ — the auth policies and signing reference toolkit
• SKILLS.md or skills/ — agent knowledge
• Repository docs or CI only (README.md, CONVENTIONS.md, CONTRIBUTING.md, AGENTS.md, llms.txt, .github/)

Checklist for every change

• I have read CONVENTIONS.md and this change conforms to it.
• pre-commit run --all-files passes locally (see CONTRIBUTING.md).
• I reviewed advisory Checkov findings, fixed applicable issues, and included a justification for every new suppression (baseline comment or inline :reason).
• Any pattern or page added, removed, or renamed is reflected in llms.txt.
• No file or heading linked from outside this repository was renamed or moved — the CloudFormation templates were renamed, but no repo doc or llms.txt links them.
• If a convention or a validation step changed, AGENTS.md reflects it.

If the change adds or updates a pattern

• CloudFormation and Terraform implementations are in parity, or the exception is stated in the pattern README and the pattern table (as for EKS).
• The catalogs agree, per Catalog and agent-index synchronization.
• Version pins follow CONVENTIONS.md; any pattern-specific floor is listed there.
• Every new IaC source file carries the MIT-0 license header.
• Secure defaults are kept: IMDSv2, encrypted EBS root volumes, access logging on by default, and AWS_IAM with an open auth policy on service-exposing patterns.
• The pattern README's Testing, Cost, and Cleanup sections reflect any resource changes.

Testing

• Terraform: deployed in eu-west-1 (single account). All 8 resource configurations (4 children, 4 singles) were created on the shared resource gateway.
• CloudFormation:
• Static: terraform fmt -check and terraform validate, terraform-docs --output-check (v0.21.0), and cfn-lint 1.57.2 on all 4 templates. Checkov reports 0 failed checks, but it can't parse templates using !Ref {Fn::Sub} inside ForEach; the existing 1-ec2_instance templates hit the same parse error. The full pre-commit run --all-files wasn't run.