# Variables ==================================================================

# Accounts -------------------------------------------------------------------
#
# Notes:
#  - Each key is a logical identifier used internally (e.g. 'security-audit')
#  - email must be globally unique across all AWS accounts
#  - ou_id must reference a valid OU ID (pulls from the governance/ou module)
#  - Per-account tags are merged with module defaults where per-account tags
#    take precedence on conflicts
#
# Example:
#   accounts = {
#     security-audit = {
#       name  = "Security Audit"
#       email = "aws-security@example.com"
#       ou_id = module.ou.all_ou_ids["security"]
#       tags  = { env = "security", owner = "platform-team" }
#     }
#     sandbox-01 = {
#       name  = "Sandbox 01"
#       email = "aws-sandbox-01@example.com"
#       ou_id = module.ou.all_ou_ids["sandbox"]
#       tags  = { env = "sandbox", owner = "platform-team" }
#     }
#   }
#
variable "accounts" {
  description = "Map of accounts to vend. Each entry creates an AWS Organization member account and places it in an OU."
  type = map(object({
    name                       = string
    email                      = string
    ou_id                      = string
    close_on_deletion          = optional(bool, false)
    iam_user_access_to_billing = optional(string, "DENY")
    account_access_role_name   = optional(string, "OrganizationAccountAccessRole")
    tags                       = optional(map(string), {})
  }))
}