Generate a production-grade Terraform module for <module-name> under modules/<module-name>/.

Module description: <description>
Namespace: <namespace>
Provider: aws

This module is for enterprise AWS infrastructure. It must be production-grade, complete, and correct. Do not cut corners or stub out resources.

## Design principles

- Enterprise-grade but not over-engineered — expose enough inputs to be flexible across environments (dev/staging/prod) without exposing every possible AWS API knob as a variable
- A consumer should be able to use this module with only the required inputs and get a secure, working, production-ready resource
- Optional inputs should have sensible, secure defaults — encryption on by default, logging on by default, least-privilege by default
- Related resources always included — e.g. s3-bucket also covers versioning, encryption, lifecycle, logging; vpc also covers subnets, route tables, igw, nat, flow logs
- No hardcoded values anywhere — variables and locals only
- Use data blocks for resource lookups instead of accepting IDs as inputs where it makes sense
- Use for_each exclusively, never count
- No backend block anywhere

## Input variable standards

- Every variable must have a description
- Every variable must have a type constraint
- String variables that accept a fixed set of values must have a validation block with a clear error message
- Numeric variables with known bounds must have a validation block
- Required variables have no default
- Optional variables have a sensible, secure default
- tags input always present: type map(string), default {}, description "Resource tags to apply to all resources"
- Do not expose variables that wrap low-level AWS API details consumers shouldn't need to think about

## Required files — all six must be present

- main.tf
- variables.tf
- outputs.tf
- locals.tf
- versions.tf
- README.md

## File conventions

versions.tf:
terraform {
required_version = ">= 1.15.6"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 6.50"
}
}
}

locals.tf:

- All derived values go here
- Tag merging goes here — merge var.tags with any module-level defaults
- No inline expressions in main.tf resources — reference locals only

main.tf:

- Clean resource definitions only
- References locals and var only, never hardcoded values
- Use for_each exclusively, never count
- No backend block anywhere

outputs.tf:

- Expose at minimum: primary resource ID and ARN
- Only expose what consuming modules would realistically need
- Every output must have a description

README.md:

# <module title>

<one line description>

<brief paragraph covering what the module provisions>

## Usage

\`\`\`hcl
module "<module_name>" {
source = "hcassc.jfrog.io/iac-terraform-modules-virtual/<namespace>/<module-name>/aws"
version = "0.1.0"

# required inputs only

}
\`\`\`

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->

## Commenting style

- Section banners capped at 80 chars: # heading ===...= for top-level, # heading ---... for sub-sections
- Minimal inline comments only where genuinely needed
- No noise, no obvious comments

## Resource naming

- Use `this` as the primary resource name when there is a single logical resource of that type
- All resource names lowercase with hyphens