# Account

Vends AWS Organization member accounts with OU placement and security baseline wiring.

Creates member accounts via `aws_organizations_account`, places each in the specified OU, and exposes a cross-account bootstrap role ARN so that calling stacks can assume into each new account to apply security baselines (default VPC removal, EBS encryption by default, S3 public access block, IAM password policy, GuardDuty/Security Hub/Config enrollment). Account destruction is guarded by `prevent_destroy`. Depends on the `governance/organization` and `governance/ou` modules.

## Usage

```hcl
module "accounts" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/account/aws"
  version = "0.1.0"

  accounts = {
    prod = {
      name  = "my-org-prod"
      email = "aws+prod@example.com"
      ou_id = module.ou.all_ou_ids["workloads_prod"]
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version |
| ------------------------------------------------------------------------ | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5  |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | ~> 6.50 |

## Providers

| Name                                             | Version |
| ------------------------------------------------ | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0  |

## Resources

| Name                                                                                                                                | Type     |
| ----------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_organizations_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_account) | resource |

## Inputs

| Name                                                      | Description                                                                                                                                     | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Default | Required |
| --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | :------: |
| <a name="input_accounts"></a> [accounts](#input_accounts) | Map of accounts to vend. Each entry creates an AWS Organization member account,<br/>places it in an OU, and applies baseline security settings. | <pre>map(object({<br/> name = string<br/> email = string<br/> ou_id = string<br/> close_on_deletion = optional(bool, false)<br/> iam_user_access_to_billing = optional(string, "DENY")<br/> # Baseline controls<br/> remove_default_vpc = optional(bool, true)<br/> enable_ebs_encryption = optional(bool, true)<br/> block_s3_public_access = optional(bool, true)<br/> # Cross-account bootstrap role<br/> bootstrap_role_name = optional(string, "OrganizationAccountAccessRole")<br/> }))</pre> | n/a     |   yes    |
| <a name="input_tags"></a> [tags](#input_tags)             | Resource tags to apply to all resources                                                                                                         | `map(string)`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `{}`    |    no    |

## Outputs

| Name                                                                                         | Description                                                        |
| -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| <a name="output_account_arns"></a> [account_arns](#output_account_arns)                      | Map of logical account key to account ARN                          |
| <a name="output_account_ids"></a> [account_ids](#output_account_ids)                         | Map of logical account key to AWS account ID                       |
| <a name="output_bootstrap_role_arns"></a> [bootstrap_role_arns](#output_bootstrap_role_arns) | Map of logical account key to the bootstrap cross-account role ARN |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->