variable "feature_set" {
  description = "Feature set for the organization — ALL or CONSOLIDATED_BILLING"
  type        = string
  default     = "ALL"
  validation {
    condition     = contains(["ALL", "CONSOLIDATED_BILLING"], var.feature_set)
    error_message = "feature_set must be ALL or CONSOLIDATED_BILLING."
  }
}

variable "aws_service_access_principals" {
  description = "AWS service principals to enable as trusted access in the organization"
  type        = list(string)
  default = [
    "cloudtrail.amazonaws.com",
    "config.amazonaws.com",
    "config-multiaccountsetup.amazonaws.com",
    "guardduty.amazonaws.com",
    "securityhub.amazonaws.com",
    "ram.amazonaws.com",
    "sso.amazonaws.com",
    "account.amazonaws.com",
    "inspector2.amazonaws.com",
    "malware-protection.guardduty.amazonaws.com",
  ]
}

variable "enabled_policy_types" {
  description = "Policy types to enable in the organization"
  type        = list(string)
  default     = ["SERVICE_CONTROL_POLICY", "TAG_POLICY"]
}

variable "delegated_administrators" {
  description = "Map of service principal to account ID for delegated administrator registration"
  type        = map(string)
  default     = {}
}

variable "tags" {
  description = "Standard tag map kept for interface consistency. Current organization and account setting resources do not support tags directly."
  type        = map(string)
  default     = {}
}

variable "manage_iam_password_policy" {
  description = "Whether to manage the IAM account password policy in the management account"
  type        = bool
  default     = true
}

variable "password_min_length" {
  description = "Minimum IAM user password length"
  type        = number
  default     = 14
}

variable "password_require_lowercase_characters" {
  description = "Require lowercase characters in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_uppercase_characters" {
  description = "Require uppercase characters in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_numbers" {
  description = "Require numbers in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_symbols" {
  description = "Require symbols in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_allow_users_to_change_password" {
  description = "Allow IAM users to change their own password"
  type        = bool
  default     = true
}

variable "password_max_age_days" {
  description = "Maximum IAM user password age in days. Use 0 for no expiration."
  type        = number
  default     = 90
}

variable "password_reuse_prevention" {
  description = "Number of previous IAM user passwords that cannot be reused. Valid range is 1 to 24."
  type        = number
  default     = 24
}

variable "password_hard_expiry" {
  description = "Whether IAM users are prevented from setting a new password after their password expires"
  type        = bool
  default     = false
}

variable "manage_s3_account_public_access_block" {
  description = "Whether to manage account-level S3 public access block in the management account"
  type        = bool
  default     = true
}

variable "s3_block_public_acls" {
  description = "Block public ACLs for S3 buckets and objects at account level"
  type        = bool
  default     = true
}

variable "s3_block_public_policy" {
  description = "Block public bucket policies at account level"
  type        = bool
  default     = true
}

variable "s3_ignore_public_acls" {
  description = "Ignore public ACLs for S3 buckets and objects at account level"
  type        = bool
  default     = true
}

variable "s3_restrict_public_buckets" {
  description = "Restrict public bucket policies at account level"
  type        = bool
  default     = true
}

variable "enable_ebs_encryption_by_default" {
  description = "Whether to enable EBS encryption by default in the current provider region"
  type        = bool
  default     = true
}

variable "account_alias" {
  description = "Optional friendly IAM account alias for the management account sign-in URL"
  type        = string
  default     = null
}