diff --git a/README.md b/README.md
index 08fb5409f..a4991c89c 100644
--- a/README.md
+++ b/README.md
@@ -122,9 +122,15 @@ If `one_nat_gateway_per_az = true` and `single_nat_gateway = false`, then the mo
 * The variable `var.azs` **must** be specified.
 * The number of public subnet CIDR blocks specified in `public_subnets` **must** be greater than or equal to the number of availability zones specified in `var.azs`. This is to ensure that each NAT Gateway has a dedicated public subnet to deploy to.
 
-## Private Versus Intra Subnets ##
+## "private" versus "intra" subnets
 
-By default, if NAT Gateways are enabled, `private` subnets will be configured with routes for Internet traffic that point at the NAT Gateways configured by use of the above options.  If you need private subnets that should have no Internet routing (in the sense of RFC1918 Category 1 subnets), `intra_subnets` are available.  An example use case is configuration of Lambda functions within a VPC, where the Lambda functions only need to pass traffic to internal resources or VPC endpoints for AWS services.  Since Lambda functions allocate Elastic Network Interfaces in proportion to the traffic received, it can be useful to allocate a large private subnet for such allocations, while keeping the traffic they generate entirely internal to the VPC.  You can add additional tags with `intra_subnet_tags` as with other subnet types.
+By default, if NAT Gateways are enabled, private subnets will be configured with routes for Internet traffic that point at the NAT Gateways configured by use of the above options.
+
+If you need private subnets that should have no Internet routing (in the sense of [RFC1918 Category 1 subnets](https://tools.ietf.org/html/rfc1918)), `intra_subnets` should be specified. An example use case is configuration of AWS Lambda functions within a VPC, where AWS Lambda functions only need to pass traffic to internal resources or VPC endpoints for AWS services.
+ 
+Since AWS Lambda functions allocate Elastic Network Interfaces in proportion to the traffic received ([read more](https://docs.aws.amazon.com/lambda/latest/dg/vpc.html)), it can be useful to allocate a large private subnet for such allocations, while keeping the traffic they generate entirely internal to the VPC.
+
+You can add additional tags with `intra_subnet_tags` as with other subnet types.
 
 ## Conditional creation
 
@@ -186,6 +192,7 @@ Terraform version 0.10.3 or newer is required for this module to work.
 | enable_vpn_gateway | Should be true if you want to create a new VPN Gateway resource and attach it to the VPC | string | `false` | no |
 | external_nat_ip_ids | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips) | list | `<list>` | no |
 | instance_tenancy | A tenancy option for instances launched into the VPC | string | `default` | no |
+| intra_route_table_tags | Additional tags for the intra route tables | string | `<map>` | no |
 | intra_subnet_tags | Additional tags for the intra subnets | string | `<map>` | no |
 | intra_subnets | A list of intra subnets | list | `<list>` | no |
 | manage_default_vpc | Should be true to adopt and manage Default VPC | string | `false` | no |
@@ -232,6 +239,7 @@ Terraform version 0.10.3 or newer is required for this module to work.
 | elasticache_subnets | List of IDs of elasticache subnets |
 | elasticache_subnets_cidr_blocks | List of cidr_blocks of elasticache subnets |
 | igw_id | Internet Gateway |
+| intra_route_table_ids | List of IDs of intra route tables |
 | intra_subnets | List of IDs of intra subnets |
 | intra_subnets_cidr_blocks | List of cidr_blocks of intra subnets |
 | nat_ids | List of allocation ID of Elastic IPs created for AWS NAT Gateway |
diff --git a/examples/complete-vpc/README.md b/examples/complete-vpc/README.md
index dddba26bc..c8d26a451 100644
--- a/examples/complete-vpc/README.md
+++ b/examples/complete-vpc/README.md
@@ -2,7 +2,7 @@
 
 Configuration in this directory creates set of VPC resources which may be sufficient for staging or production environment (look into [simple-vpc](../simple-vpc) for more simplified setup).
 
-There are public, private, database, ElastiCache subnets, intra (private w/o Internet access) subnets, and NAT Gateways created in each availability zone.
+There are public, private, database, ElastiCache, intra (private w/o Internet access) subnets, and NAT Gateways created in each availability zone.
 
 ## Usage
 
@@ -24,11 +24,11 @@ Note that this example may create resources which can cost money (AWS Elastic IP
 |------|-------------|
 | database_subnets | List of IDs of database subnets |
 | elasticache_subnets | List of IDs of elasticache subnets |
+| intra_subnets | List of IDs of intra subnets |
 | nat_public_ips | NAT gateways |
 | private_subnets | Subnets |
 | public_subnets | List of IDs of public subnets |
 | redshift_subnets | List of IDs of redshift subnets |
-| intra_subnets | List of IDs of intra subnets |
 | vpc_id | VPC |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/examples/complete-vpc/main.tf b/examples/complete-vpc/main.tf
index f4b6c519d..67e3d2bc0 100644
--- a/examples/complete-vpc/main.tf
+++ b/examples/complete-vpc/main.tf
@@ -20,6 +20,8 @@ module "vpc" {
   create_database_subnet_group = false
 
   enable_nat_gateway = true
+  single_nat_gateway = true
+
   enable_vpn_gateway = true
 
   enable_s3_endpoint       = true
diff --git a/examples/complete-vpc/outputs.tf b/examples/complete-vpc/outputs.tf
index 72a9dbe46..3cbd012be 100644
--- a/examples/complete-vpc/outputs.tf
+++ b/examples/complete-vpc/outputs.tf
@@ -30,6 +30,11 @@ output "redshift_subnets" {
   value       = ["${module.vpc.redshift_subnets}"]
 }
 
+output "intra_subnets" {
+  description = "List of IDs of intra subnets"
+  value       = ["${module.vpc.intra_subnets}"]
+}
+
 # NAT gateways
 output "nat_public_ips" {
   description = "List of public Elastic IPs created for AWS NAT Gateway"
diff --git a/main.tf b/main.tf
index fc41fdaa4..ea64f9fbf 100644
--- a/main.tf
+++ b/main.tf
@@ -98,6 +98,17 @@ resource "aws_route_table" "private" {
   }
 }
 
+#################
+# Intra routes
+#################
+resource "aws_route_table" "intra" {
+  count = "${var.create_vpc && length(var.intra_subnets) > 0 ? 1 : 0}"
+
+  vpc_id = "${aws_vpc.this.id}"
+
+  tags = "${merge(var.tags, var.intra_route_table_tags, map("Name", "${var.name}-intra"))}"
+}
+
 ################
 # Public subnet
 ################
@@ -274,6 +285,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_s3" {
   route_table_id  = "${element(aws_route_table.private.*.id, count.index)}"
 }
 
+resource "aws_vpc_endpoint_route_table_association" "intra_s3" {
+  count = "${var.create_vpc && var.enable_s3_endpoint ? 1 : 0}"
+
+  vpc_endpoint_id = "${aws_vpc_endpoint.s3.id}"
+  route_table_id  = "${element(aws_route_table.intra.*.id, 0)}"
+}
+
 resource "aws_vpc_endpoint_route_table_association" "public_s3" {
   count = "${var.create_vpc && var.enable_s3_endpoint && length(var.public_subnets) > 0 ? 1 : 0}"
 
@@ -304,6 +322,13 @@ resource "aws_vpc_endpoint_route_table_association" "private_dynamodb" {
   route_table_id  = "${element(aws_route_table.private.*.id, count.index)}"
 }
 
+resource "aws_vpc_endpoint_route_table_association" "intra_dynamodb" {
+  count = "${var.create_vpc && var.enable_dynamodb_endpoint ? 1 : 0}"
+
+  vpc_endpoint_id = "${aws_vpc_endpoint.dynamodb.id}"
+  route_table_id  = "${element(aws_route_table.intra.*.id, 0)}"
+}
+
 resource "aws_vpc_endpoint_route_table_association" "public_dynamodb" {
   count = "${var.create_vpc && var.enable_dynamodb_endpoint && length(var.public_subnets) > 0 ? 1 : 0}"
 
@@ -346,7 +371,7 @@ resource "aws_route_table_association" "intra" {
   count = "${var.create_vpc && length(var.intra_subnets) > 0 ? length(var.intra_subnets) : 0}"
 
   subnet_id      = "${element(aws_subnet.intra.*.id, count.index)}"
-  route_table_id = "${element(aws_route_table.private.*.id, (var.single_nat_gateway ? 0 : count.index))}"
+  route_table_id = "${element(aws_route_table.intra.*.id, 0)}"
 }
 
 resource "aws_route_table_association" "public" {
@@ -375,7 +400,7 @@ resource "aws_vpn_gateway_attachment" "this" {
 }
 
 resource "aws_vpn_gateway_route_propagation" "public" {
-  count = "${var.create_vpc && var.propagate_public_route_tables_vgw && (var.enable_vpn_gateway  || var.vpn_gateway_id != "") ? 1 : 0}"
+  count = "${var.create_vpc && var.propagate_public_route_tables_vgw && (var.enable_vpn_gateway || var.vpn_gateway_id != "") ? 1 : 0}"
 
   route_table_id = "${element(aws_route_table.public.*.id, count.index)}"
   vpn_gateway_id = "${element(concat(aws_vpn_gateway.this.*.id, aws_vpn_gateway_attachment.this.*.vpn_gateway_id), count.index)}"
diff --git a/outputs.tf b/outputs.tf
index 4e71f12bb..33118e555 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -151,6 +151,11 @@ output "private_route_table_ids" {
   value       = ["${aws_route_table.private.*.id}"]
 }
 
+output "intra_route_table_ids" {
+  description = "List of IDs of intra route tables"
+  value       = ["${aws_route_table.intra.*.id}"]
+}
+
 output "nat_ids" {
   description = "List of allocation ID of Elastic IPs created for AWS NAT Gateway"
   value       = ["${aws_eip.nat.*.id}"]
diff --git a/variables.tf b/variables.tf
index 0098c353f..6df338702 100644
--- a/variables.tf
+++ b/variables.tf
@@ -168,6 +168,11 @@ variable "private_route_table_tags" {
   default     = {}
 }
 
+variable "intra_route_table_tags" {
+  description = "Additional tags for the intra route tables"
+  default     = {}
+}
+
 variable "database_subnet_tags" {
   description = "Additional tags for the database subnets"
   default     = {}