# Management account settings ===============================================

resource "aws_iam_account_password_policy" "this" {
  count = var.manage_iam_password_policy ? 1 : 0

  minimum_password_length        = var.password_min_length
  require_lowercase_characters   = var.password_require_lowercase_characters
  require_uppercase_characters   = var.password_require_uppercase_characters
  require_numbers                = var.password_require_numbers
  require_symbols                = var.password_require_symbols
  allow_users_to_change_password = var.password_allow_users_to_change_password
  max_password_age               = var.password_max_age_days
  password_reuse_prevention      = var.password_reuse_prevention
  hard_expiry                    = var.password_hard_expiry
}

resource "aws_s3_account_public_access_block" "this" {
  count = var.manage_s3_account_public_access_block ? 1 : 0

  block_public_acls       = var.s3_block_public_acls
  block_public_policy     = var.s3_block_public_policy
  ignore_public_acls      = var.s3_ignore_public_acls
  restrict_public_buckets = var.s3_restrict_public_buckets
}

resource "aws_ebs_encryption_by_default" "this" {
  count = var.enable_ebs_encryption_by_default ? 1 : 0

  enabled = true
}

resource "aws_iam_account_alias" "this" {
  count = var.account_alias != null && var.account_alias != "" ? 1 : 0

  account_alias = var.account_alias
}