# Naming Standards — Module Reference Table > **Note:** This table is a **reference, not an exhaustive audit**. The purpose of this document is to illustrate the approach to nomenclature consistently, at a glance, across the module set. ## Rubric (recap) ``` ${var.name}-[-] ``` - `var.name` — caller-supplied identity prefix (environment/workload/stack) - `` — short, fixed abbreviation for the resource type - `` — tier or `for_each` map key, only when multiple instances exist --- ## Reference Table | AWS Resource | Token | Naming Convention (var syntax) | Comments / Rubric Elaboration | Example | | ------------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | **account** | `acct` | `${var.name}-acct` | AWS Organizations account; qualifier usually unnecessary (module is typically singleton per invocation) | `hca-shared-services-acct` | | **account-contacts** | `acct-contact` | `${var.name}-acct-contact-${each.key}` | Qualifier = contact type key (billing/security/operations) | `hca-shared-services-acct-contact-billing` | | **acm** | `cert` | `${var.name}-cert-${each.key}` | Qualifier = domain/SAN key when multiple certs are issued per module call | `hca-app-cert-primary` | | **api-gateway** | `apigw` | `${var.name}-apigw` | Stage as separate qualifier if multiple stages are managed in one call | `hca-orders-apigw` | | **backup** | `bkp-plan` / `bkp-vault` | `${var.name}-bkp-vault`, `${var.name}-bkp-plan-${each.key}` | Vault likely singleton; plan qualifier = schedule/tier key (daily/weekly) | `hca-prod-bkp-vault`, `hca-prod-bkp-plan-daily` | | **cloudfront** | `cf` | `${var.name}-cf-${each.key}` | Qualifier only if multiple distributions per call | `hca-static-cf` | | **cloudtrail** | `ct` | `${var.name}-ct` | Org-level trail, typically singleton per account | `hca-shared-services-ct` | | **cloudwatch** | `cw-log` / `cw-alarm` | `${var.name}-cw-log-${each.key}`, `${var.name}-cw-alarm-${each.key}` | Qualifier = log group purpose or alarm metric key | `hca-app-cw-log-access`, `hca-app-cw-alarm-cpu-high` | | **config** | `cfg` | `${var.name}-cfg-recorder`, `${var.name}-cfg-rule-${each.key}` | Config recorder as fixed-key singleton (mirrors `igw` pattern); rules use qualifier per rule name | `hca-shared-services-cfg-recorder`, `hca-shared-services-cfg-rule-s3-encrypted` | | **dynamodb** | `ddb` | `${var.name}-ddb-${each.key}` | Qualifier = table logical key when multiple tables per call | `hca-orders-ddb-transactions` | | **ebs** | `ebs` | `${var.name}-ebs-${each.key}` | Qualifier = volume purpose/mount key | `hca-app01-ebs-data` | | **ec2-autoscaling** | `asg` | `${var.name}-asg-${each.key}` | Qualifier = workload/tier key when multiple ASGs per call | `hca-web-asg-frontend` | | **ec2-node** | `ec2` | `${var.name}-ec2-${each.key}` | Qualifier = instance role/index key | `hca-mecm-ec2` | | **efs** | `efs` | `${var.name}-efs` | Singleton per call unless multiple file systems are provisioned together | `hca-shared-efs` | | **eks-cluster** | `eks` | `${var.name}-eks` | Cluster name itself; node groups handled by companion module | `hca-platform-eks` | | **eks-nodes** | `eks-ng` | `${var.name}-eks-ng-${each.key}` | Qualifier = node group key (e.g. spot/on-demand, workload class) | `hca-platform-eks-ng-general` | | **elasticache** | `cache` | `${var.name}-cache-${each.key}` | Qualifier = cluster/replication group key | `hca-session-cache-redis` | | **eventbridge** | `evb` | `${var.name}-evb-${each.key}` | Qualifier = bus or rule key | `hca-orders-evb-bus` | | **fsx-windows** | `fsx` | `${var.name}-fsx` | Singleton per call | `hca-bbwd-fsx` | | **guardduty** | `gd` | `${var.name}-gd` | Detector is typically singleton per account | `hca-shared-services-gd` | | **guardduty-member** | `gd-member` | `${var.name}-gd-member-${each.key}` | Qualifier = member account key when inviting multiple accounts | `hca-org-gd-member-workloads` | | **iam-access-analyzer** | `iam-aa` | `${var.name}-iam-aa` | Singleton analyzer per account/org | `hca-shared-services-iam-aa` | | **iam-identity-provider** | `iam-idp` | `${var.name}-iam-idp-${each.key}` | Qualifier = provider key (OIDC/SAML source) | `hca-shared-services-iam-idp-bitbucket` | | **iam-policy** | `iam-pol` | `${var.name}-iam-pol-${each.key}` | Qualifier = policy purpose key | `hca-platform-iam-pol-readonly` | | **iam-role** | `iam-role` | `${var.name}-iam-role-${each.key}` | Qualifier = role purpose key (mirrors `flow-log-role` pattern in VPC module) | `hca-platform-iam-role-flow-log` | | **inspector** | `insp` | `${var.name}-insp` | Singleton scan configuration per account | `hca-shared-services-insp` | | **kms** | `kms` | `${var.name}-kms-${each.key}` | Qualifier = key purpose (e.g. s3, ebs, secrets) | `hca-platform-kms-s3` | | **lambda** | `fn` | `${var.name}-fn-${each.key}` | Qualifier = function purpose key | `hca-orders-fn-processor` | | **load-balancer** | `lb` | `${var.name}-lb-${each.key}` | Qualifier = tier/type key (internal/external, alb/nlb) | `hca-web-lb-external` | | **nacl** | `nacl` | `${var.name}-nacl-${each.key}` | Qualifier = subnet tier key, mirrors VPC module's subnet tiering | `hca-shared-services-nacl-private` | | **organization** | `org` | `${var.name}-org` | Singleton per AWS Organization | `hca-org` | | **ou** | `ou` | `${var.name}-ou-${each.key}` | Qualifier = OU key | `hca-ou-workloads` | | **ram-acceptance** | `ram-accept` | `${var.name}-ram-accept-${each.key}` | Qualifier = share/resource key being accepted | `hca-shared-services-ram-accept-vpc-subnets` | | **ram-share** | `ram-share` | `${var.name}-ram-share-${each.key}` | Qualifier = shared resource key; pairs with `ram-acceptance` on the participant side | `hca-networking-ram-share-vpc-subnets` | | **rds-oracle** | `rds-ora` | `${var.name}-rds-ora-${each.key}` | Qualifier = instance/cluster key | `hca-erp-rds-ora-primary` | | **rds-postgres** | `rds-pg` | `${var.name}-rds-pg-${each.key}` | Qualifier = instance/cluster key | `hca-app-rds-pg-primary` | | **redshift** | `rs` | `${var.name}-rs-${each.key}` | Qualifier = cluster key | `hca-analytics-rs-main` | | **route53** | `r53` | `${var.name}-r53-${each.key}` | Qualifier = zone or record-set purpose key | `hca-platform-r53-internal` | | **s3-bucket** | `s3` | `${var.name}-s3-${each.key}` | Qualifier = bucket purpose key (must also satisfy S3 global-uniqueness separately) | `hca-platform-s3-logs` | | **scp** | `scp` | `${var.name}-scp-${each.key}` | Qualifier = policy purpose key | `hca-org-scp-deny-root` | | **secrets-manager** | `secret` | `${var.name}-secret-${each.key}` | Qualifier = secret purpose key | `hca-app-secret-db-creds` | | **security-groups** | `sg` | `${var.name}-sg-${each.key}` | Qualifier = tier/role key | `hca-web-sg-frontend` | | **security-hub** | `sh` | `${var.name}-sh` | Singleton per account | `hca-shared-services-sh` | | **sns** | `sns` | `${var.name}-sns-${each.key}` | Qualifier = topic purpose key | `hca-platform-sns-alerts` | | **sqs** | `sqs` | `${var.name}-sqs-${each.key}` | Qualifier = queue purpose key | `hca-orders-sqs-processing` | | **ssm-automation** | `ssm-auto` | `${var.name}-ssm-auto-${each.key}` | Qualifier = document/automation purpose key | `hca-platform-ssm-auto-patch` | | **ssm-parameter** | `ssm-param` | `${var.name}-ssm-param-${each.key}` | Qualifier = parameter purpose key | `hca-platform-ssm-param-db-host` | | **sso-assignment** | `sso-assign` | `${var.name}-sso-assign-${each.key}` | Qualifier = permission set/account key | `hca-workloads-sso-assign-admin` | | **tgw-attachment** | `tgw-attach` | `${var.name}-tgw-attach-${each.key}` | Qualifier = source VPC/account key; distinct from `transit-gateway` module itself | `hca-shared-services-tgw-attach` | | **transit-gateway** | `tgw` | `${var.name}-tgw` | Singleton per hub deployment | `hca-core-tgw` | | **vpc** | `vpc` (+ `subnet`, `rt`, `nat`, `igw`, `nat-eip`, `flow-log`) | `${var.name}-vpc`, `${var.name}-subnet--${each.key}`, etc. | **Verified from actual module source** — see VPC-specific naming standards doc | `hca-shared-services-prod-vpc`, `hca-shared-services-prod-subnet-public-az1` | | **vpc-endpoints** | `vpce` | `${var.name}-vpce-${each.key}` | Qualifier = service key (s3, dynamodb, ssm, etc.) | `hca-shared-services-vpce-s3` | | **vpc-peering** | `vpc-peer` | `${var.name}-vpc-peer-${each.key}` | Qualifier = peer VPC/account key | `hca-networking-vpc-peer-legacy` |