# main.tf — ORG violations fixture
# Triggers all 8 ORG policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# ORG-001 + ORG-002 + ORG-003 — Wrong feature set, missing policy types and trusted services
resource "aws_organizations_organization" "bad_org" {
  feature_set = "CONSOLIDATED_BILLING"

  aws_service_access_principals = [
    "cloudtrail.amazonaws.com"
  ]

  enabled_policy_types = [
    "TAG_POLICY"
  ]
}

# ORG-004 — Only one delegated admin, missing others
resource "aws_organizations_delegated_administrator" "bad_delegated" {
  account_id        = "123456789012"
  service_principal = "securityhub.amazonaws.com"
}

# ORG-005 — Only SECURITY contact, missing BILLING and OPERATIONS
resource "aws_account_alternate_contact" "bad_security" {
  alternate_contact_type = "SECURITY"
  name                   = "Security Team"
  title                  = "Security"
  email_address          = "security@example.com"
  phone_number           = "+1-555-0100"
}

# ORG-006 — TAG_POLICY exists but not attached
resource "aws_organizations_policy" "bad_tag_policy" {
  name = "bad-tag-policy"
  type = "TAG_POLICY"
  content = jsonencode({
    tags = {
      Environment = { tag_value = { "@@assign" = ["prod", "dev", "staging"] } }
    }
  })
}

# No aws_organizations_policy_attachment for bad_tag_policy = ORG-006 violation

# ORG-007 — No BACKUP_POLICY at all = ORG-007 violation

# ORG-008 — No OUs = ORG-008 violation