diff --git a/0-bootstrap/modules/cb-private-pool/README.md b/0-bootstrap/modules/cb-private-pool/README.md
index fa1d9e5a0..1e6969997 100644
--- a/0-bootstrap/modules/cb-private-pool/README.md
+++ b/0-bootstrap/modules/cb-private-pool/README.md
@@ -5,6 +5,7 @@
 |------|-------------|------|---------|:--------:|
 | private\_worker\_pool | name: Name of the worker pool. A name with a random suffix is generated if not set.<br>  region: The private worker pool region. See https://cloud.google.com/build/docs/locations for available locations.<br>  disk\_size\_gb: Size of the disk attached to the worker, in GB.<br>  machine\_type: Machine type of a worker.<br>  no\_external\_ip: If true, workers are created without any public address, which prevents network egress to public IPs.<br>  enable\_network\_peering: Set to true to enable configuration of networking peering for the private worker pool.<br>  create\_peered\_network: If true a network will be created to stablish the network peering.<br>  peered\_network\_id: The ID of the existing network to configure peering for the private worker pool if create\_peered\_network false. The project containing the network must have Service Networking API (`servicenetworking.googleapis.com`) enabled.<br>  peered\_network\_subnet\_ip: The IP range to be used for the subnet that a will created in the peered network if create\_peered\_network true.<br>  peering\_address: The IP address or beginning of the peering address range. This can be supplied as an input to reserve a specific address or omitted to allow GCP to choose a valid one.<br>  peering\_prefix\_length: The prefix length of the IP peering range. If not present, it means the address field is a single IP address. | <pre>object({<br>    name                     = optional(string, "")<br>    region                   = optional(string, "us-central1")<br>    disk_size_gb             = optional(number, 100)<br>    machine_type             = optional(string, "e2-medium")<br>    no_external_ip           = optional(bool, false)<br>    enable_network_peering   = optional(bool, false)<br>    create_peered_network    = optional(bool, false)<br>    peered_network_id        = optional(string, "")<br>    peered_network_subnet_ip = optional(string, "")<br>    peering_address          = optional(string, null)<br>    peering_prefix_length    = optional(number, 24)<br>  })</pre> | `{}` | no |
 | project\_id | ID of the project where the private pool will be created | `string` | n/a | yes |
+| vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | vpn\_configuration | enable\_vpn: set to true to create VPN connection to on prem. If true, the following values must be valid.<br>  on\_prem\_public\_ip\_address0: The first public IP address for on prem VPN connection.<br>  on\_prem\_public\_ip\_address1: The second public IP address for on prem VPN connection.<br>  router\_asn: Border Gateway Protocol (BGP) Autonomous System Number (ASN) for cloud routes.<br>  bgp\_peer\_asn: Border Gateway Protocol (BGP) Autonomous System Number (ASN) for peer cloud routes.<br>  shared\_secret: The shared secret used in the VPN.<br>  psk\_secret\_project\_id: The ID of the project that contains the secret from secret manager that holds the VPN pre-shared key.<br>  psk\_secret\_name: The name of the secret to retrieve from secret manager that holds the VPN pre-shared key.<br>  tunnel0\_bgp\_peer\_address: BGP peer address for tunnel 0.<br>  tunnel0\_bgp\_session\_range: BGP session range for tunnel 0.<br>  tunnel1\_bgp\_peer\_address: BGP peer address for tunnel 1.<br>  tunnel1\_bgp\_session\_range: BGP session range for tunnel 1. | <pre>object({<br>    enable_vpn                 = optional(bool, false)<br>    on_prem_public_ip_address0 = optional(string, "")<br>    on_prem_public_ip_address1 = optional(string, "")<br>    router_asn                 = optional(number, 64515)<br>    bgp_peer_asn               = optional(number, 64513)<br>    psk_secret_project_id      = optional(string, "")<br>    psk_secret_name            = optional(string, "")<br>    tunnel0_bgp_peer_address   = optional(string, "")<br>    tunnel0_bgp_session_range  = optional(string, "")<br>    tunnel1_bgp_peer_address   = optional(string, "")<br>    tunnel1_bgp_session_range  = optional(string, "")<br>  })</pre> | `{}` | no |
 
 ## Outputs
diff --git a/0-bootstrap/modules/cb-private-pool/network.tf b/0-bootstrap/modules/cb-private-pool/network.tf
index 44acca4fc..8c62d210e 100644
--- a/0-bootstrap/modules/cb-private-pool/network.tf
+++ b/0-bootstrap/modules/cb-private-pool/network.tf
@@ -20,7 +20,7 @@ locals {
 
 module "peered_network" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
   count   = var.private_worker_pool.create_peered_network ? 1 : 0
 
   project_id                             = var.project_id
@@ -29,12 +29,17 @@ module "peered_network" {
 
   subnets = [
     {
-      subnet_name           = "sb-b-cbpools-${var.private_worker_pool.region}"
-      subnet_ip             = var.private_worker_pool.peered_network_subnet_ip
-      subnet_region         = var.private_worker_pool.region
-      subnet_private_access = "true"
-      subnet_flow_logs      = "true"
-      description           = "Peered subnet for Cloud Build private pool"
+      subnet_name                      = "sb-b-cbpools-${var.private_worker_pool.region}"
+      subnet_ip                        = var.private_worker_pool.peered_network_subnet_ip
+      subnet_region                    = var.private_worker_pool.region
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = "true"
+      subnet_flow_logs_interval        = var.vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.vpc_flow_logs.filter_expr
+      description                      = "Peered subnet for Cloud Build private pool"
     }
   ]
 
diff --git a/0-bootstrap/modules/cb-private-pool/variables.tf b/0-bootstrap/modules/cb-private-pool/variables.tf
index f49c2b65a..5dfcbb6a0 100644
--- a/0-bootstrap/modules/cb-private-pool/variables.tf
+++ b/0-bootstrap/modules/cb-private-pool/variables.tf
@@ -106,3 +106,21 @@ variable "vpn_configuration" {
     error_message = "If VPN configuration is enabled, all values are required."
   }
 }
+
+variable "vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
diff --git a/0-bootstrap/modules/jenkins-agent/main.tf b/0-bootstrap/modules/jenkins-agent/main.tf
index ee765c07c..f8afe9375 100644
--- a/0-bootstrap/modules/jenkins-agent/main.tf
+++ b/0-bootstrap/modules/jenkins-agent/main.tf
@@ -143,6 +143,7 @@ resource "google_compute_subnetwork" "jenkins_agents_subnet" {
     aggregation_interval = "INTERVAL_5_SEC"
     flow_sampling        = 0.5
     metadata             = "INCLUDE_ALL_METADATA"
+    metadata_fields      = null
     filter_expr          = true
   }
 }
diff --git a/3-networks-dual-svpc/envs/shared/README.md b/3-networks-dual-svpc/envs/shared/README.md
index 88d0209b2..0f710e916 100644
--- a/3-networks-dual-svpc/envs/shared/README.md
+++ b/3-networks-dual-svpc/envs/shared/README.md
@@ -19,8 +19,8 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 | firewall\_policies\_enable\_logging | Toggle hierarchical firewall logging. | `bool` | `true` | no |
 | preactivate\_partner\_interconnect | Preactivate Partner Interconnect VLAN attachment in the environment. | `bool` | `false` | no |
 | remote\_state\_bucket | Backend bucket to load Terraform Remote State Data from previous steps. | `string` | n/a | yes |
-| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
 | target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
+| vpc\_flow\_logs | enable\_logging: set to true to enable VPC flow logging for the subnetworks.<br>  aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    enable_logging       = optional(string, "true")<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 
 ## Outputs
 
diff --git a/3-networks-dual-svpc/envs/shared/dns-hub.tf b/3-networks-dual-svpc/envs/shared/dns-hub.tf
index 2003af12e..c47fa1387 100644
--- a/3-networks-dual-svpc/envs/shared/dns-hub.tf
+++ b/3-networks-dual-svpc/envs/shared/dns-hub.tf
@@ -20,7 +20,7 @@
 
 module "dns_hub_vpc" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = local.dns_hub_project_id
   network_name                           = "vpc-c-dns-hub"
@@ -28,19 +28,29 @@ module "dns_hub_vpc" {
   delete_default_internet_gateway_routes = "true"
 
   subnets = [{
-    subnet_name           = "sb-c-dns-hub-${local.default_region1}"
-    subnet_ip             = "172.16.0.0/25"
-    subnet_region         = local.default_region1
-    subnet_private_access = "true"
-    subnet_flow_logs      = var.subnetworks_enable_logging
-    description           = "DNS hub subnet for region 1."
+    subnet_name                      = "sb-c-dns-hub-${local.default_region1}"
+    subnet_ip                        = "172.16.0.0/25"
+    subnet_region                    = local.default_region1
+    subnet_private_access            = "true"
+    subnet_flow_logs                 = var.vpc_flow_logs.enable_logging
+    subnet_flow_logs_interval        = var.vpc_flow_logs.aggregation_interval
+    subnet_flow_logs_sampling        = var.vpc_flow_logs.flow_sampling
+    subnet_flow_logs_metadata        = var.vpc_flow_logs.metadata
+    subnet_flow_logs_metadata_fields = var.vpc_flow_logs.metadata_fields
+    subnet_flow_logs_filter          = var.vpc_flow_logs.filter_expr
+    description                      = "DNS hub subnet for region 1."
     }, {
-    subnet_name           = "sb-c-dns-hub-${local.default_region2}"
-    subnet_ip             = "172.16.0.128/25"
-    subnet_region         = local.default_region2
-    subnet_private_access = "true"
-    subnet_flow_logs      = var.subnetworks_enable_logging
-    description           = "DNS hub subnet for region 2."
+    subnet_name                      = "sb-c-dns-hub-${local.default_region2}"
+    subnet_ip                        = "172.16.0.128/25"
+    subnet_region                    = local.default_region2
+    subnet_private_access            = "true"
+    subnet_flow_logs                 = var.vpc_flow_logs.enable_logging
+    subnet_flow_logs_interval        = var.vpc_flow_logs.aggregation_interval
+    subnet_flow_logs_sampling        = var.vpc_flow_logs.flow_sampling
+    subnet_flow_logs_metadata        = var.vpc_flow_logs.metadata
+    subnet_flow_logs_metadata_fields = var.vpc_flow_logs.metadata_fields
+    subnet_flow_logs_filter          = var.vpc_flow_logs.filter_expr
+    description                      = "DNS hub subnet for region 2."
   }]
 
   routes = [{
diff --git a/3-networks-dual-svpc/envs/shared/variables.tf b/3-networks-dual-svpc/envs/shared/variables.tf
index a0354aabb..09bc69c00 100644
--- a/3-networks-dual-svpc/envs/shared/variables.tf
+++ b/3-networks-dual-svpc/envs/shared/variables.tf
@@ -25,10 +25,24 @@ variable "dns_enable_logging" {
   default     = true
 }
 
-variable "subnetworks_enable_logging" {
-  type        = bool
-  description = "Toggle subnetworks flow logging for VPC Subnetworks."
-  default     = true
+variable "vpc_flow_logs" {
+  description = <<EOT
+  enable_logging: set to true to enable VPC flow logging for the subnetworks.
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    enable_logging       = optional(string, "true")
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
 }
 
 variable "domain" {
diff --git a/3-networks-dual-svpc/modules/base_env/README.md b/3-networks-dual-svpc/modules/base_env/README.md
index 52e50d22f..56cf18c6a 100644
--- a/3-networks-dual-svpc/modules/base_env/README.md
+++ b/3-networks-dual-svpc/modules/base_env/README.md
@@ -8,6 +8,7 @@
 | base\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC | `string` | n/a | yes |
 | base\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
 | base\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Base Shared Vpc. | `map(list(map(string)))` | n/a | yes |
+| base\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | custom\_restricted\_services | List of custom services to be protected by the VPC-SC perimeter. If empty, all supported services (https://cloud.google.com/vpc-service-controls/docs/supported-products) will be protected. | `list(string)` | `[]` | no |
 | default\_region1 | First subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
 | default\_region2 | Second subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
@@ -24,6 +25,7 @@
 | restricted\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC | `string` | n/a | yes |
 | restricted\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
 | restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
+| restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 
 ## Outputs
 
diff --git a/3-networks-dual-svpc/modules/base_env/main.tf b/3-networks-dual-svpc/modules/base_env/main.tf
index 85ecd2c6a..5defc061f 100644
--- a/3-networks-dual-svpc/modules/base_env/main.tf
+++ b/3-networks-dual-svpc/modules/base_env/main.tf
@@ -221,20 +221,30 @@ module "restricted_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-${var.environment_code}-shared-restricted-${var.default_region1}"
-      subnet_ip             = var.restricted_subnet_primary_ranges[var.default_region1]
-      subnet_region         = var.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "First ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-restricted-${var.default_region1}"
+      subnet_ip                        = var.restricted_subnet_primary_ranges[var.default_region1]
+      subnet_region                    = var.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+      description                      = "First ${var.env} subnet example."
     },
     {
-      subnet_name           = "sb-${var.environment_code}-shared-restricted-${var.default_region2}"
-      subnet_ip             = var.restricted_subnet_primary_ranges[var.default_region2]
-      subnet_region         = var.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "Second ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-restricted-${var.default_region2}"
+      subnet_ip                        = var.restricted_subnet_primary_ranges[var.default_region2]
+      subnet_region                    = var.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+      description                      = "Second ${var.env} subnet example."
     }
   ]
   secondary_ranges = {
@@ -263,20 +273,30 @@ module "base_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-${var.environment_code}-shared-base-${var.default_region1}"
-      subnet_ip             = var.base_subnet_primary_ranges[var.default_region1]
-      subnet_region         = var.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "First ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-base-${var.default_region1}"
+      subnet_ip                        = var.base_subnet_primary_ranges[var.default_region1]
+      subnet_region                    = var.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "First ${var.env} subnet example."
     },
     {
-      subnet_name           = "sb-${var.environment_code}-shared-base-${var.default_region2}"
-      subnet_ip             = var.base_subnet_primary_ranges[var.default_region2]
-      subnet_region         = var.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "Second ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-base-${var.default_region2}"
+      subnet_ip                        = var.base_subnet_primary_ranges[var.default_region2]
+      subnet_region                    = var.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "Second ${var.env} subnet example."
     }
   ]
   secondary_ranges = {
diff --git a/3-networks-dual-svpc/modules/base_env/variables.tf b/3-networks-dual-svpc/modules/base_env/variables.tf
index 1b656ba15..5c30bfb75 100644
--- a/3-networks-dual-svpc/modules/base_env/variables.tf
+++ b/3-networks-dual-svpc/modules/base_env/variables.tf
@@ -81,6 +81,24 @@ variable "base_private_service_connect_ip" {
   description = "The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC"
 }
 
+variable "base_vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "restricted_private_service_cidr" {
   type        = string
   description = "CIDR range for private service networking. Used for Cloud SQL and other managed services in the Restricted Shared Vpc."
@@ -101,6 +119,24 @@ variable "restricted_private_service_connect_ip" {
   description = "The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC"
 }
 
+variable "restricted_vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "egress_policies" {
   description = "A list of all [egress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference), each list object has a `from` and `to` value that describes egress_from and egress_to.\n\nExample: `[{ from={ identities=[], identity_type=\"ID_TYPE\" }, to={ resources=[], operations={ \"SRV_NAME\"={ OP_TYPE=[] }}}}]`\n\nValid Values:\n`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`\n`SRV_NAME` = \"`*`\" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)\n`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions)"
   type = list(object({
diff --git a/3-networks-dual-svpc/modules/base_shared_vpc/README.md b/3-networks-dual-svpc/modules/base_shared_vpc/README.md
index f0b838fab..4a8099725 100644
--- a/3-networks-dual-svpc/modules/base_shared_vpc/README.md
+++ b/3-networks-dual-svpc/modules/base_shared_vpc/README.md
@@ -22,7 +22,7 @@
 | private\_service\_connect\_ip | Internal IP to be used as the private service connect endpoint | `string` | n/a | yes |
 | project\_id | Project ID for Private Shared VPC. | `string` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
-| subnets | The list of subnets being created | `list(map(string))` | `[]` | no |
+| subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/3-networks-dual-svpc/modules/base_shared_vpc/main.tf b/3-networks-dual-svpc/modules/base_shared_vpc/main.tf
index c10e255e4..b481a37e1 100644
--- a/3-networks-dual-svpc/modules/base_shared_vpc/main.tf
+++ b/3-networks-dual-svpc/modules/base_shared_vpc/main.tf
@@ -26,7 +26,7 @@ locals {
 
 module "main" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = var.project_id
   network_name                           = local.network_name
diff --git a/3-networks-dual-svpc/modules/base_shared_vpc/variables.tf b/3-networks-dual-svpc/modules/base_shared_vpc/variables.tf
index 4a8e779fd..5c4b1346d 100644
--- a/3-networks-dual-svpc/modules/base_shared_vpc/variables.tf
+++ b/3-networks-dual-svpc/modules/base_shared_vpc/variables.tf
@@ -69,7 +69,24 @@ variable "bgp_asn_subnet" {
 }
 
 variable "subnets" {
-  type        = list(map(string))
+  type = list(object({
+    subnet_name                      = string
+    subnet_ip                        = string
+    subnet_region                    = string
+    subnet_private_access            = optional(string, "false")
+    subnet_private_ipv6_access       = optional(string)
+    subnet_flow_logs                 = optional(string, "false")
+    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")
+    subnet_flow_logs_sampling        = optional(string, "0.5")
+    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")
+    subnet_flow_logs_filter          = optional(string, "true")
+    subnet_flow_logs_metadata_fields = optional(list(string), [])
+    description                      = optional(string)
+    purpose                          = optional(string)
+    role                             = optional(string)
+    stack_type                       = optional(string)
+    ipv6_access_type                 = optional(string)
+  }))
   description = "The list of subnets being created"
   default     = []
 }
diff --git a/3-networks-dual-svpc/modules/restricted_shared_vpc/README.md b/3-networks-dual-svpc/modules/restricted_shared_vpc/README.md
index b6cebf542..35d56c4ed 100644
--- a/3-networks-dual-svpc/modules/restricted_shared_vpc/README.md
+++ b/3-networks-dual-svpc/modules/restricted_shared_vpc/README.md
@@ -28,7 +28,7 @@
 | project\_number | Project number for Restricted Shared VPC. It is the project INSIDE the regular service perimeter. | `number` | n/a | yes |
 | restricted\_services | List of services to restrict. | `list(string)` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
-| subnets | The list of subnets being created | `list(map(string))` | `[]` | no |
+| subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/3-networks-dual-svpc/modules/restricted_shared_vpc/main.tf b/3-networks-dual-svpc/modules/restricted_shared_vpc/main.tf
index ee31c424e..a37a4dea1 100644
--- a/3-networks-dual-svpc/modules/restricted_shared_vpc/main.tf
+++ b/3-networks-dual-svpc/modules/restricted_shared_vpc/main.tf
@@ -26,7 +26,7 @@ locals {
 
 module "main" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = var.project_id
   network_name                           = local.network_name
diff --git a/3-networks-dual-svpc/modules/restricted_shared_vpc/variables.tf b/3-networks-dual-svpc/modules/restricted_shared_vpc/variables.tf
index 47bb94ab0..fceb6f26b 100644
--- a/3-networks-dual-svpc/modules/restricted_shared_vpc/variables.tf
+++ b/3-networks-dual-svpc/modules/restricted_shared_vpc/variables.tf
@@ -79,7 +79,24 @@ variable "default_region2" {
 }
 
 variable "subnets" {
-  type        = list(map(string))
+  type = list(object({
+    subnet_name                      = string
+    subnet_ip                        = string
+    subnet_region                    = string
+    subnet_private_access            = optional(string, "false")
+    subnet_private_ipv6_access       = optional(string)
+    subnet_flow_logs                 = optional(string, "false")
+    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")
+    subnet_flow_logs_sampling        = optional(string, "0.5")
+    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")
+    subnet_flow_logs_filter          = optional(string, "true")
+    subnet_flow_logs_metadata_fields = optional(list(string), [])
+    description                      = optional(string)
+    purpose                          = optional(string)
+    role                             = optional(string)
+    stack_type                       = optional(string)
+    ipv6_access_type                 = optional(string)
+  }))
   description = "The list of subnets being created"
   default     = []
 }
diff --git a/3-networks-hub-and-spoke/envs/shared/README.md b/3-networks-hub-and-spoke/envs/shared/README.md
index cf8a7bb90..310bc9930 100644
--- a/3-networks-hub-and-spoke/envs/shared/README.md
+++ b/3-networks-hub-and-spoke/envs/shared/README.md
@@ -21,9 +21,11 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 | base\_hub\_nat\_num\_addresses\_region1 | Number of external IPs to reserve for first Cloud NAT in Base Hub. | `number` | `2` | no |
 | base\_hub\_nat\_num\_addresses\_region2 | Number of external IPs to reserve for second Cloud NAT in Base Hub. | `number` | `2` | no |
 | base\_hub\_windows\_activation\_enabled | Enable Windows license activation for Windows workloads in Base Hub | `bool` | `false` | no |
+| base\_vpc\_flow\_logs | enable\_logging: set to true to enable VPC flow logging for the subnetworks.<br>  aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    enable_logging       = optional(string, "true")<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | bgp\_asn\_dns | BGP Autonomous System Number (ASN). | `number` | `64667` | no |
 | custom\_restricted\_services | List of custom services to be protected by the VPC-SC perimeter. If empty, all supported services (https://cloud.google.com/vpc-service-controls/docs/supported-products) will be protected. | `list(string)` | `[]` | no |
 | dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
+| dns\_vpc\_flow\_logs | enable\_logging: set to true to enable VPC flow logging for the subnetworks.<br>  aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    enable_logging       = optional(string, "true")<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | domain | The DNS name of forwarding managed zone, for instance 'example.com'. Must end with a period. | `string` | n/a | yes |
 | egress\_policies | A list of all [egress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference), each list object has a `from` and `to` value that describes egress\_from and egress\_to.<br><br>Example: `[{ from={ identities=[], identity_type="ID_TYPE" }, to={ resources=[], operations={ "SRV_NAME"={ OP_TYPE=[] }}}}]`<br><br>Valid Values:<br>`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`<br>`SRV_NAME` = "`*`" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)<br>`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) | <pre>list(object({<br>    from = any<br>    to   = any<br>  }))</pre> | `[]` | no |
 | enable\_dedicated\_interconnect | Enable Dedicated Interconnect in the environment. | `bool` | `false` | no |
@@ -42,7 +44,7 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 | restricted\_hub\_nat\_num\_addresses\_region1 | Number of external IPs to reserve for first Cloud NAT in Restricted Hub. | `number` | `2` | no |
 | restricted\_hub\_nat\_num\_addresses\_region2 | Number of external IPs to reserve for second Cloud NAT in Restricted Hub. | `number` | `2` | no |
 | restricted\_hub\_windows\_activation\_enabled | Enable Windows license activation for Windows workloads in Restricted Hub. | `bool` | `false` | no |
-| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
+| restricted\_vpc\_flow\_logs | enable\_logging: set to true to enable VPC flow logging for the subnetworks.<br>  aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    enable_logging       = optional(string, "true")<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/envs/shared/dns-hub.tf b/3-networks-hub-and-spoke/envs/shared/dns-hub.tf
index 2782ae277..c377e4f7f 100644
--- a/3-networks-hub-and-spoke/envs/shared/dns-hub.tf
+++ b/3-networks-hub-and-spoke/envs/shared/dns-hub.tf
@@ -20,7 +20,7 @@
 
 module "dns_hub_vpc" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = local.dns_hub_project_id
   network_name                           = "vpc-c-dns-hub"
@@ -28,19 +28,29 @@ module "dns_hub_vpc" {
   delete_default_internet_gateway_routes = "true"
 
   subnets = [{
-    subnet_name           = "sb-c-dns-hub-${local.default_region1}"
-    subnet_ip             = "172.16.0.0/25"
-    subnet_region         = local.default_region1
-    subnet_private_access = "true"
-    subnet_flow_logs      = var.subnetworks_enable_logging
-    description           = "DNS hub subnet for region 1."
+    subnet_name                      = "sb-c-dns-hub-${local.default_region1}"
+    subnet_ip                        = "172.16.0.0/25"
+    subnet_region                    = local.default_region1
+    subnet_private_access            = "true"
+    subnet_flow_logs                 = var.dns_vpc_flow_logs.enable_logging
+    subnet_flow_logs_interval        = var.dns_vpc_flow_logs.aggregation_interval
+    subnet_flow_logs_sampling        = var.dns_vpc_flow_logs.flow_sampling
+    subnet_flow_logs_metadata        = var.dns_vpc_flow_logs.metadata
+    subnet_flow_logs_metadata_fields = var.dns_vpc_flow_logs.metadata_fields
+    subnet_flow_logs_filter          = var.dns_vpc_flow_logs.filter_expr
+    description                      = "DNS hub subnet for region 1."
     }, {
-    subnet_name           = "sb-c-dns-hub-${local.default_region2}"
-    subnet_ip             = "172.16.0.128/25"
-    subnet_region         = local.default_region2
-    subnet_private_access = "true"
-    subnet_flow_logs      = var.subnetworks_enable_logging
-    description           = "DNS hub subnet for region 2."
+    subnet_name                      = "sb-c-dns-hub-${local.default_region2}"
+    subnet_ip                        = "172.16.0.128/25"
+    subnet_region                    = local.default_region2
+    subnet_private_access            = "true"
+    subnet_flow_logs                 = var.dns_vpc_flow_logs.enable_logging
+    subnet_flow_logs_interval        = var.dns_vpc_flow_logs.aggregation_interval
+    subnet_flow_logs_sampling        = var.dns_vpc_flow_logs.flow_sampling
+    subnet_flow_logs_metadata        = var.dns_vpc_flow_logs.metadata
+    subnet_flow_logs_metadata_fields = var.dns_vpc_flow_logs.metadata_fields
+    subnet_flow_logs_filter          = var.dns_vpc_flow_logs.filter_expr
+    description                      = "DNS hub subnet for region 2."
   }]
 
   routes = [{
diff --git a/3-networks-hub-and-spoke/envs/shared/net-hubs.tf b/3-networks-hub-and-spoke/envs/shared/net-hubs.tf
index af7fe0415..feacd24e9 100644
--- a/3-networks-hub-and-spoke/envs/shared/net-hubs.tf
+++ b/3-networks-hub-and-spoke/envs/shared/net-hubs.tf
@@ -186,20 +186,30 @@ module "base_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-c-shared-base-hub-${local.default_region1}"
-      subnet_ip             = local.base_subnet_primary_ranges[local.default_region1]
-      subnet_region         = local.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = var.subnetworks_enable_logging
-      description           = "Base network hub subnet for ${local.default_region1}"
+      subnet_name                      = "sb-c-shared-base-hub-${local.default_region1}"
+      subnet_ip                        = local.base_subnet_primary_ranges[local.default_region1]
+      subnet_region                    = local.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = var.base_vpc_flow_logs.enable_logging
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "Base network hub subnet for ${local.default_region1}"
     },
     {
-      subnet_name           = "sb-c-shared-base-hub-${local.default_region2}"
-      subnet_ip             = local.base_subnet_primary_ranges[local.default_region2]
-      subnet_region         = local.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = var.subnetworks_enable_logging
-      description           = "Base network hub subnet for ${local.default_region2}"
+      subnet_name                      = "sb-c-shared-base-hub-${local.default_region2}"
+      subnet_ip                        = local.base_subnet_primary_ranges[local.default_region2]
+      subnet_region                    = local.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = var.base_vpc_flow_logs.enable_logging
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "Base network hub subnet for ${local.default_region2}"
     }
   ]
   secondary_ranges = {}
@@ -242,20 +252,32 @@ module "restricted_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-c-shared-restricted-hub-${local.default_region1}"
-      subnet_ip             = local.restricted_subnet_primary_ranges[local.default_region1]
-      subnet_region         = local.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = var.subnetworks_enable_logging
-      description           = "Restricted network hub subnet for ${local.default_region1}"
+      subnet_name                      = "sb-c-shared-restricted-hub-${local.default_region1}"
+      subnet_ip                        = local.restricted_subnet_primary_ranges[local.default_region1]
+      subnet_region                    = local.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = var.restricted_vpc_flow_logs.enable_logging
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+
+      description = "Restricted network hub subnet for ${local.default_region1}"
     },
     {
-      subnet_name           = "sb-c-shared-restricted-hub-${local.default_region2}"
-      subnet_ip             = local.restricted_subnet_primary_ranges[local.default_region2]
-      subnet_region         = local.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = var.subnetworks_enable_logging
-      description           = "Restricted network hub subnet for ${local.default_region2}"
+      subnet_name                      = "sb-c-shared-restricted-hub-${local.default_region2}"
+      subnet_ip                        = local.restricted_subnet_primary_ranges[local.default_region2]
+      subnet_region                    = local.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = var.restricted_vpc_flow_logs.enable_logging
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+
+      description = "Restricted network hub subnet for ${local.default_region2}"
     }
   ]
   secondary_ranges = {}
diff --git a/3-networks-hub-and-spoke/envs/shared/variables.tf b/3-networks-hub-and-spoke/envs/shared/variables.tf
index 52e105c99..880b8f463 100644
--- a/3-networks-hub-and-spoke/envs/shared/variables.tf
+++ b/3-networks-hub-and-spoke/envs/shared/variables.tf
@@ -35,10 +35,24 @@ variable "dns_enable_logging" {
   default     = true
 }
 
-variable "subnetworks_enable_logging" {
-  type        = bool
-  description = "Toggle subnetworks flow logging for VPC Subnetworks."
-  default     = true
+variable "dns_vpc_flow_logs" {
+  description = <<EOT
+  enable_logging: set to true to enable VPC flow logging for the subnetworks.
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    enable_logging       = optional(string, "true")
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
 }
 
 variable "domain" {
@@ -153,6 +167,46 @@ variable "restricted_hub_nat_num_addresses_region2" {
   default     = 2
 }
 
+variable "base_vpc_flow_logs" {
+  description = <<EOT
+  enable_logging: set to true to enable VPC flow logging for the subnetworks.
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    enable_logging       = optional(string, "true")
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
+variable "restricted_vpc_flow_logs" {
+  description = <<EOT
+  enable_logging: set to true to enable VPC flow logging for the subnetworks.
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    enable_logging       = optional(string, "true")
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "firewall_policies_enable_logging" {
   type        = bool
   description = "Toggle hierarchical firewall logging."
diff --git a/3-networks-hub-and-spoke/modules/base_env/README.md b/3-networks-hub-and-spoke/modules/base_env/README.md
index f89dc0429..9bf470c4f 100644
--- a/3-networks-hub-and-spoke/modules/base_env/README.md
+++ b/3-networks-hub-and-spoke/modules/base_env/README.md
@@ -8,6 +8,7 @@
 | base\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC | `string` | n/a | yes |
 | base\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
 | base\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Base Shared Vpc. | `map(list(map(string)))` | n/a | yes |
+| base\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | custom\_restricted\_services | List of custom services to be protected by the VPC-SC perimeter. If empty, all supported services (https://cloud.google.com/vpc-service-controls/docs/supported-products) will be protected. | `list(string)` | `[]` | no |
 | default\_region1 | First subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
 | default\_region2 | Second subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
@@ -24,6 +25,7 @@
 | restricted\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC | `string` | n/a | yes |
 | restricted\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
 | restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
+| restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 
 ## Outputs
 
diff --git a/3-networks-hub-and-spoke/modules/base_env/main.tf b/3-networks-hub-and-spoke/modules/base_env/main.tf
index 74aee203b..af3889736 100644
--- a/3-networks-hub-and-spoke/modules/base_env/main.tf
+++ b/3-networks-hub-and-spoke/modules/base_env/main.tf
@@ -216,20 +216,30 @@ module "restricted_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-${var.environment_code}-shared-restricted-${var.default_region1}"
-      subnet_ip             = var.restricted_subnet_primary_ranges[var.default_region1]
-      subnet_region         = var.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "First ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-restricted-${var.default_region1}"
+      subnet_ip                        = var.restricted_subnet_primary_ranges[var.default_region1]
+      subnet_region                    = var.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+      description                      = "First ${var.env} subnet example."
     },
     {
-      subnet_name           = "sb-${var.environment_code}-shared-restricted-${var.default_region2}"
-      subnet_ip             = var.restricted_subnet_primary_ranges[var.default_region2]
-      subnet_region         = var.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "Second ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-restricted-${var.default_region2}"
+      subnet_ip                        = var.restricted_subnet_primary_ranges[var.default_region2]
+      subnet_region                    = var.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.restricted_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.restricted_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.restricted_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.restricted_vpc_flow_logs.filter_expr
+      description                      = "Second ${var.env} subnet example."
     }
   ]
   secondary_ranges = {
@@ -260,20 +270,30 @@ module "base_shared_vpc" {
 
   subnets = [
     {
-      subnet_name           = "sb-${var.environment_code}-shared-base-${var.default_region1}"
-      subnet_ip             = var.base_subnet_primary_ranges[var.default_region1]
-      subnet_region         = var.default_region1
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "First ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-base-${var.default_region1}"
+      subnet_ip                        = var.base_subnet_primary_ranges[var.default_region1]
+      subnet_region                    = var.default_region1
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "First ${var.env} subnet example."
     },
     {
-      subnet_name           = "sb-${var.environment_code}-shared-base-${var.default_region2}"
-      subnet_ip             = var.base_subnet_primary_ranges[var.default_region2]
-      subnet_region         = var.default_region2
-      subnet_private_access = "true"
-      subnet_flow_logs      = true
-      description           = "Second ${var.env} subnet example."
+      subnet_name                      = "sb-${var.environment_code}-shared-base-${var.default_region2}"
+      subnet_ip                        = var.base_subnet_primary_ranges[var.default_region2]
+      subnet_region                    = var.default_region2
+      subnet_private_access            = "true"
+      subnet_flow_logs                 = true
+      subnet_flow_logs_interval        = var.base_vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.base_vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.base_vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.base_vpc_flow_logs.filter_expr
+      description                      = "Second ${var.env} subnet example."
     }
   ]
   secondary_ranges = {
diff --git a/3-networks-hub-and-spoke/modules/base_env/variables.tf b/3-networks-hub-and-spoke/modules/base_env/variables.tf
index 83d05ccf9..e80215472 100644
--- a/3-networks-hub-and-spoke/modules/base_env/variables.tf
+++ b/3-networks-hub-and-spoke/modules/base_env/variables.tf
@@ -81,6 +81,24 @@ variable "base_private_service_connect_ip" {
   description = "The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC"
 }
 
+variable "base_vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "restricted_private_service_cidr" {
   type        = string
   description = "CIDR range for private service networking. Used for Cloud SQL and other managed services in the Restricted Shared Vpc."
@@ -101,6 +119,24 @@ variable "restricted_private_service_connect_ip" {
   description = "The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC"
 }
 
+variable "restricted_vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "egress_policies" {
   description = "A list of all [egress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference), each list object has a `from` and `to` value that describes egress_from and egress_to.\n\nExample: `[{ from={ identities=[], identity_type=\"ID_TYPE\" }, to={ resources=[], operations={ \"SRV_NAME\"={ OP_TYPE=[] }}}}]`\n\nValid Values:\n`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`\n`SRV_NAME` = \"`*`\" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)\n`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions)"
   type = list(object({
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md
index 66e6248c4..e9d33c423 100644
--- a/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md
+++ b/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md
@@ -24,7 +24,7 @@
 | private\_service\_connect\_ip | Internal IP to be used as the private service connect endpoint. | `string` | n/a | yes |
 | project\_id | Project ID for Private Shared VPC. | `string` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
-| subnets | The list of subnets being created | `list(map(string))` | `[]` | no |
+| subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf
index 220901027..cfb65759e 100644
--- a/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf
+++ b/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf
@@ -27,7 +27,7 @@ locals {
 
 module "main" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = var.project_id
   network_name                           = local.network_name
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf
index efb21c323..f9d92a43d 100644
--- a/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf
+++ b/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf
@@ -81,7 +81,24 @@ variable "bgp_asn_subnet" {
 }
 
 variable "subnets" {
-  type        = list(map(string))
+  type = list(object({
+    subnet_name                      = string
+    subnet_ip                        = string
+    subnet_region                    = string
+    subnet_private_access            = optional(string, "false")
+    subnet_private_ipv6_access       = optional(string)
+    subnet_flow_logs                 = optional(string, "false")
+    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")
+    subnet_flow_logs_sampling        = optional(string, "0.5")
+    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")
+    subnet_flow_logs_filter          = optional(string, "true")
+    subnet_flow_logs_metadata_fields = optional(list(string), [])
+    description                      = optional(string)
+    purpose                          = optional(string)
+    role                             = optional(string)
+    stack_type                       = optional(string)
+    ipv6_access_type                 = optional(string)
+  }))
   description = "The list of subnets being created"
   default     = []
 }
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md
index 0b1970f8d..63291e27a 100644
--- a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md
+++ b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md
@@ -31,7 +31,7 @@
 | restricted\_net\_hub\_project\_number | The restricted net hub project number | `string` | `""` | no |
 | restricted\_services | List of services to restrict. | `list(string)` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
-| subnets | The list of subnets being created | `list(map(string))` | `[]` | no |
+| subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf
index 34d60a593..b00723e24 100644
--- a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf
+++ b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf
@@ -27,7 +27,7 @@ locals {
 
 module "main" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = var.project_id
   network_name                           = local.network_name
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf
index 77836a925..55f9fb0d6 100644
--- a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf
+++ b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf
@@ -97,7 +97,24 @@ variable "default_region2" {
 }
 
 variable "subnets" {
-  type        = list(map(string))
+  type = list(object({
+    subnet_name                      = string
+    subnet_ip                        = string
+    subnet_region                    = string
+    subnet_private_access            = optional(string, "false")
+    subnet_private_ipv6_access       = optional(string)
+    subnet_flow_logs                 = optional(string, "false")
+    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")
+    subnet_flow_logs_sampling        = optional(string, "0.5")
+    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")
+    subnet_flow_logs_filter          = optional(string, "true")
+    subnet_flow_logs_metadata_fields = optional(list(string), [])
+    description                      = optional(string)
+    purpose                          = optional(string)
+    role                             = optional(string)
+    stack_type                       = optional(string)
+    ipv6_access_type                 = optional(string)
+  }))
   description = "The list of subnets being created"
   default     = []
 }
diff --git a/4-projects/modules/base_env/README.md b/4-projects/modules/base_env/README.md
index df4179109..87da96b12 100644
--- a/4-projects/modules/base_env/README.md
+++ b/4-projects/modules/base_env/README.md
@@ -21,6 +21,7 @@
 | secrets\_prj\_suffix | Name suffix to use for secrets project created. | `string` | `"env-secrets"` | no |
 | subnet\_ip\_range | IP range for the peered subnetwork. If "peering\_iap\_fw\_rules\_enabled" is true, this field should not be null. | `string` | `null` | no |
 | subnet\_region | Region which the peered subnet will be created. If "peering\_iap\_fw\_rules\_enabled" is true, this field should not be null. | `string` | `null` | no |
+| vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/4-projects/modules/base_env/example_peering_project.tf b/4-projects/modules/base_env/example_peering_project.tf
index 0c10e2283..4e900180d 100644
--- a/4-projects/modules/base_env/example_peering_project.tf
+++ b/4-projects/modules/base_env/example_peering_project.tf
@@ -74,7 +74,7 @@ module "peering_project" {
 
 module "peering_network" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = module.peering_project.project_id
   network_name                           = "vpc-${local.env_code}-peering-base"
@@ -83,12 +83,17 @@ module "peering_network" {
 
   subnets = [
     {
-      subnet_name           = "sb-${local.env_code}-${var.business_code}-peered-${var.subnet_region}"
-      subnet_ip             = var.subnet_ip_range
-      subnet_region         = var.subnet_region
-      subnet_private_access = "true"
-      subnet_flow_logs      = "true"
-      description           = "Peered subnetwork on region ${var.subnet_region}."
+      subnet_name                      = "sb-${local.env_code}-${var.business_code}-peered-${var.subnet_region}"
+      subnet_ip                        = var.subnet_ip_range
+      subnet_region                    = var.subnet_region
+      subnet_private_access            = "true"
+      description                      = "Peered subnetwork on region ${var.subnet_region}."
+      subnet_flow_logs                 = "true"
+      subnet_flow_logs_interval        = var.vpc_flow_logs.aggregation_interval
+      subnet_flow_logs_sampling        = var.vpc_flow_logs.flow_sampling
+      subnet_flow_logs_metadata        = var.vpc_flow_logs.metadata
+      subnet_flow_logs_metadata_fields = var.vpc_flow_logs.metadata_fields
+      subnet_flow_logs_filter          = var.vpc_flow_logs.filter_expr
     }
   ]
 }
diff --git a/4-projects/modules/base_env/variables.tf b/4-projects/modules/base_env/variables.tf
index 011d61559..824ccb780 100644
--- a/4-projects/modules/base_env/variables.tf
+++ b/4-projects/modules/base_env/variables.tf
@@ -53,6 +53,24 @@ variable "windows_activation_enabled" {
   default     = false
 }
 
+variable "vpc_flow_logs" {
+  description = <<EOT
+  aggregation_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN.
+  flow_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].
+  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE_ALL_METADATA, INCLUDE_ALL_METADATA, CUSTOM_METADATA.
+  metadata_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+  filter_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field.
+EOT
+  type = object({
+    aggregation_interval = optional(string, "INTERVAL_5_SEC")
+    flow_sampling        = optional(string, "0.5")
+    metadata             = optional(string, "INCLUDE_ALL_METADATA")
+    metadata_fields      = optional(list(string), [])
+    filter_expr          = optional(string, "true")
+  })
+  default = {}
+}
+
 variable "project_budget" {
   description = <<EOT
   Budget configuration.