# main.tf — ORG compliance fixture
# Produces zero ORG policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"

  default_tags {
    tags = {
      Owner       = "platform-team"
      CostCenter  = "CC-1234"
      Environment = "prod"
    }
  }
}

# ORG-001 + ORG-002 + ORG-003 — All features, all policy types, all trusted services
resource "aws_organizations_organization" "good_org" {
  feature_set = "ALL"

  aws_service_access_principals = [
    "cloudtrail.amazonaws.com",
    "config.amazonaws.com",
    "securityhub.amazonaws.com",
    "guardduty.amazonaws.com",
    "access-analyzer.amazonaws.com",
    "ram.amazonaws.com",
  ]

  enabled_policy_types = [
    "TAG_POLICY",
    "BACKUP_POLICY",
    "AISERVICES_OPT_OUT_POLICY",
  ]
}

# ORG-004 — Delegated admins for all required services
resource "aws_organizations_delegated_administrator" "securityhub" {
  account_id        = "123456789012"
  service_principal = "securityhub.amazonaws.com"
}

resource "aws_organizations_delegated_administrator" "guardduty" {
  account_id        = "123456789012"
  service_principal = "guardduty.amazonaws.com"
}

resource "aws_organizations_delegated_administrator" "config" {
  account_id        = "123456789012"
  service_principal = "config.amazonaws.com"
}

resource "aws_organizations_delegated_administrator" "access_analyzer" {
  account_id        = "123456789012"
  service_principal = "access-analyzer.amazonaws.com"
}

# ORG-005 — All three alternate contacts
resource "aws_account_alternate_contact" "security" {
  alternate_contact_type = "SECURITY"
  name                   = "Security Team"
  title                  = "Security"
  email_address          = "security@example.com"
  phone_number           = "+1-555-0100"
}

resource "aws_account_alternate_contact" "billing" {
  alternate_contact_type = "BILLING"
  name                   = "Billing Team"
  title                  = "Billing"
  email_address          = "billing@example.com"
  phone_number           = "+1-555-0200"
}

resource "aws_account_alternate_contact" "operations" {
  alternate_contact_type = "OPERATIONS"
  name                   = "Operations Team"
  title                  = "Operations"
  email_address          = "operations@example.com"
  phone_number           = "+1-555-0300"
}

# ORG-006 — Tag Policy defined and attached
resource "aws_organizations_policy" "good_tag_policy" {
  name = "good-tag-policy"
  type = "TAG_POLICY"
  content = jsonencode({
    tags = {
      Environment = { tag_value = { "@@assign" = ["prod", "dev", "staging"] } }
      Owner       = { tag_value = { "@@assign" = ["*"] } }
      CostCenter  = { tag_value = { "@@assign" = ["*"] } }
    }
  })
}

resource "aws_organizations_policy_attachment" "tag_policy_attachment" {
  policy_id = aws_organizations_policy.good_tag_policy.id
  target_id = aws_organizations_organization.good_org.roots[0].id
}

# ORG-007 — Backup Policy defined and attached
resource "aws_organizations_policy" "good_backup_policy" {
  name = "good-backup-policy"
  type = "BACKUP_POLICY"
  content = jsonencode({
    plans = {
      daily_backup = {
        regions = { "@@assign" = ["ap-south-1"] }
        rules = {
          daily_rule = {
            schedule_expression      = { "@@assign" = "cron(0 3 * * ? *)" }
            target_backup_vault_name = { "@@assign" = "Default" }
            lifecycle = {
              delete_after_days = { "@@assign" = 35 }
            }
          }
        }
        selections = {
          all_resources = {
            iam_role_arn = { "@@assign" = "arn:aws:iam::$account:role/AWSBackupDefaultServiceRole" }
            resources    = { "@@assign" = ["*"] }
          }
        }
      }
    }
  })
}

resource "aws_organizations_policy_attachment" "backup_policy_attachment" {
  policy_id = aws_organizations_policy.good_backup_policy.id
  target_id = aws_organizations_organization.good_org.roots[0].id
}

# ORG-008 — OUs defined
resource "aws_organizations_organizational_unit" "security" {
  name      = "Security"
  parent_id = aws_organizations_organization.good_org.roots[0].id
}

resource "aws_organizations_organizational_unit" "workloads" {
  name      = "Workloads"
  parent_id = aws_organizations_organization.good_org.roots[0].id
}

resource "aws_organizations_organizational_unit" "sandbox" {
  name      = "Sandbox"
  parent_id = aws_organizations_organization.good_org.roots[0].id
}