variable "auto_enable_controls" {
  description = "Automatically enable new controls in enabled standards"
  type        = bool
  default     = true
}

variable "control_finding_generator" {
  description = "Finding generator mode — SECURITY_CONTROL or STANDARD_CONTROL"
  type        = string
  default     = "SECURITY_CONTROL"
}

variable "delegated_admin_account_id" {
  description = "Account ID to designate as Security Hub delegated administrator"
  type        = string
  default     = null
}

variable "auto_enable_org_members" {
  description = "Auto-enable Security Hub for new organization member accounts"
  type        = bool
  default     = true
}

variable "standards" {
  description = "Map of security standard ARN suffix to enable. Keys are logical names."
  type        = map(string)
  default = {
    cis_aws_foundations = "ruleset/cis-aws-foundations-benchmark/v/1.4.0"
    fsbp                = "standards/aws-foundational-security-best-practices/v/1.0.0"
    pci_dss             = "standards/pci-dss/v/3.2.1"
  }
}

variable "disabled_controls" {
  description = "Map of standard logical key to list of control IDs to disable"
  type        = map(list(string))
  default     = {}
}

variable "finding_aggregation_region" {
  description = "Region to aggregate findings from all linked regions (home region)"
  type        = string
  default     = null
}

variable "member_accounts" {
  description = "Map of member account logical keys to account IDs and email addresses"
  type = map(object({
    account_id = string
    email      = string
  }))
  default = {}
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}

variable "enable_delegation" {
  description = "Enable the registration of the delegated administrator account (run in Org Management account)"
  type        = bool
  default     = true
}

variable "enable_organization_config" {
  description = "Enable organization-level member auto-enablement (run in Security/Delegated Admin account)"
  type        = bool
  default     = true
}