diff --git a/modules/cloud-config-container/squid/README.md b/modules/cloud-config-container/squid/README.md
index c2ed92aa5..be982fb99 100644
--- a/modules/cloud-config-container/squid/README.md
+++ b/modules/cloud-config-container/squid/README.md
@@ -25,10 +25,8 @@ This example will create a `cloud-config` that allows any client in the 10.0.0.0
 ```hcl
 module "cos-squid" {
   source           = "./modules/cos-container/squid"
-  config_variables = {
-    whitelist = [".github.com"]
-    clients   = ["10.0.0.0/8"]
-  }
+  whitelist = [".github.com"]
+  clients   = ["10.0.0.0/8"]
 }
 
 # use it as metadata in a compute instance or template
@@ -45,10 +43,8 @@ This example shows how to create the single instance optionally managed by the m
 ```hcl
 module "cos-squid" {
   source           = "./modules/cos-container/squid"
-  config_variables = {
-    whitelist = ["github.com"]
-    clients   = ["10.0.0.0/8"]
-  }
+  whitelist = ["github.com"]
+  clients   = ["10.0.0.0/8"]
   test_instance = {
     project_id = "my-project"
     zone       = "europe-west1-b"
@@ -65,13 +61,15 @@ module "cos-squid" {
 
 | name | description | type | required | default |
 |---|---|:---: |:---:|:---:|
+| *clients* | List of CIDRs from which Squid will allow connections | <code title="list&#40;string&#41;">list(string)</code> |  | <code title="">[]</code> |
 | *cloud_config* | Cloud config template path. If null default will be used. | <code title="">string</code> |  | <code title="">null</code> |
-| *config_variables* | Additional variables used to render the cloud-config template. This module requires at least whitelist and clients to be specified (as lists). | |  | <code title="">{}</code> |
-| *squid_config* | Squid configuration path, if null default will be used. | <code title="">string</code> |  | <code title="">null</code> |
+| *config_variables* | Additional variables used to render the cloud-config and Squid templates. | <code title="map&#40;any&#41;">map(any)</code> |  | <code title="">{}</code> |
 | *file_defaults* | Default owner and permissions for files. | <code title="object&#40;&#123;&#10;owner       &#61; string&#10;permissions &#61; string&#10;&#125;&#41;">object({...})</code> |  | <code title="&#123;&#10;owner       &#61; &#34;root&#34;&#10;permissions &#61; &#34;0644&#34;&#10;&#125;">...</code> |
 | *files* | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | <code title="map&#40;object&#40;&#123;&#10;content     &#61; string&#10;owner       &#61; string&#10;permissions &#61; string&#10;&#125;&#41;&#41;">map(object({...}))</code> |  | <code title="">{}</code> |
+| *squid_config* | Squid configuration path, if null default will be used. | <code title="">string</code> |  | <code title="">null</code> |
 | *test_instance* | Test/development instance attributes, leave null to skip creation. | <code title="object&#40;&#123;&#10;project_id &#61; string&#10;zone       &#61; string&#10;name       &#61; string&#10;type &#61; string&#10;network    &#61; string&#10;subnetwork &#61; string&#10;&#125;&#41;">object({...})</code> |  | <code title="">null</code> |
-| *test_instance_defaults* | Test/development instance defaults used for optional configuration. | <code title="object&#40;&#123;&#10;disks &#61; map&#40;object&#40;&#123;&#10;read_only &#61; bool&#10;size      &#61; number&#10;&#125;&#41;&#41;&#10;metadata              &#61; map&#40;string&#41;&#10;service_account_roles &#61; list&#40;string&#41;&#10;tags                  &#61; list&#40;string&#41;&#10;&#125;&#41;">object({...})</code> |  | <code title="&#123;&#10;disks    &#61; &#123;&#125;&#10;metadata &#61; &#123;&#125;&#10;service_account_roles &#61; &#91;&#10;&#34;roles&#47;logging.logWriter&#34;,&#10;&#34;roles&#47;monitoring.metricWriter&#34;&#10;&#93;&#10;tags &#61; &#91;&#34;ssh&#34;&#93;&#10;&#125;">...</code> |
+| *test_instance_defaults* | Test/development instance defaults used for optional configuration. If image is null, COS stable will be used. | <code title="object&#40;&#123;&#10;disks &#61; map&#40;object&#40;&#123;&#10;read_only &#61; bool&#10;size      &#61; number&#10;&#125;&#41;&#41;&#10;image                 &#61; string&#10;metadata              &#61; map&#40;string&#41;&#10;nat                   &#61; bool&#10;service_account_roles &#61; list&#40;string&#41;&#10;tags                  &#61; list&#40;string&#41;&#10;&#125;&#41;">object({...})</code> |  | <code title="&#123;&#10;disks    &#61; &#123;&#125;&#10;image    &#61; null&#10;metadata &#61; &#123;&#125;&#10;nat      &#61; false&#10;service_account_roles &#61; &#91;&#10;&#34;roles&#47;logging.logWriter&#34;,&#10;&#34;roles&#47;monitoring.metricWriter&#34;&#10;&#93;&#10;tags &#61; &#91;&#34;ssh&#34;&#93;&#10;&#125;">...</code> |
+| *whitelist* | List of domains Squid will allow connections to | <code title="list&#40;string&#41;">list(string)</code> |  | <code title="">[]</code> |
 
 ## Outputs
 
diff --git a/modules/cloud-config-container/squid/main.tf b/modules/cloud-config-container/squid/main.tf
index f10e2c358..d2c7aca0c 100644
--- a/modules/cloud-config-container/squid/main.tf
+++ b/modules/cloud-config-container/squid/main.tf
@@ -39,7 +39,7 @@ locals {
     : var.cloud_config
   )
   config_variables = merge(var.config_variables, {
-    whitelist = lookup(var.config_variables, "whitelist", [])
-    clients   = lookup(var.config_variables, "clients", [])
+    whitelist = var.whitelist
+    clients   = var.clients
   })
 }
diff --git a/modules/cloud-config-container/squid/variables.tf b/modules/cloud-config-container/squid/variables.tf
index 18ef05636..cb8804016 100644
--- a/modules/cloud-config-container/squid/variables.tf
+++ b/modules/cloud-config-container/squid/variables.tf
@@ -22,8 +22,8 @@ variable "cloud_config" {
 
 variable "config_variables" {
   description = "Additional variables used to render the cloud-config and Squid templates."
-  # type        = map(any)
-  default = {}
+  type        = map(any)
+  default     = {}
 }
 
 variable "squid_config" {
@@ -53,3 +53,15 @@ variable "files" {
   }))
   default = {}
 }
+
+variable "whitelist" {
+  description = "List of domains Squid will allow connections to"
+  type        = list(string)
+  default     = []
+}
+
+variable "clients" {
+  description = "List of CIDRs from which Squid will allow connections"
+  type        = list(string)
+  default     = []
+}