{
  "providers": {
    "AWS": "Amazon Web Services"
  },
  "categories": {
    "IAM": "Identity and Access Management",
    "STR": "Storage Services",
    "CMP": "Compute Services",
    "NCD": "Network and Content Delivery",
    "DAT": "Database Services",
    "EKM": "Encryption and Key Management",
    "LOM": "Logging, Observability and Monitoring",
    "ORG": "Organization and Accounts",
    "GAC": "Governance and Compliance"
  },
  "policies": {
    "ICP-TF-AWS-IAM-001": {
      "title": "Require Policy Attachment to Groups or Roles",
      "description": "Ensures IAM policies are attached to groups or roles rather than directly to individual IAM users.",
      "remediation": "Attach policies to IAM groups or roles; remove aws_iam_user_policy and aws_iam_user_policy_attachment direct-to-user attachments.",
      "severity": "LOW",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html"
      ]
    },
    "ICP-TF-AWS-IAM-002": {
      "title": "Prohibit Long-Term IAM User Access Keys",
      "description": "Ensures Terraform does not create long-term IAM user access keys, favouring roles and temporary credentials.",
      "remediation": "Remove aws_iam_access_key resources; use IAM roles / temporary STS credentials or federation instead.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
      ]
    },
    "ICP-TF-AWS-IAM-003": {
      "title": "Restrict Broad KMS Key Permissions",
      "description": "Ensures inline policies do not grant kms:Decrypt or kms:* across all KMS keys.",
      "remediation": "Scope KMS permissions to specific key ARNs and required actions; do not grant kms:* or kms:Decrypt on Resource \"*\".",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/controls-to-disable.html"
      ]
    },
    "ICP-TF-AWS-IAM-004": {
      "title": "Require Permissions Boundary on Delegated Roles",
      "description": "Ensures delegated or self-service IAM roles define a permissions boundary that caps their effective permissions.",
      "remediation": "Set permissions_boundary on the aws_iam_role to a boundary policy that caps effective permissions.",
      "severity": "LOW",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
      ]
    },
    "ICP-TF-AWS-IAM-005": {
      "title": "Prevent Confused-Deputy in Cross-Account Trust Policies",
      "description": "Ensures cross-account assume-role trust policies do not use Principal \"*\" without a scoping Condition, preventing confused-deputy access.",
      "remediation": "Restrict the assume_role_policy Principal to specific account/role ARNs, or add a scoping Condition (e.g. aws:PrincipalOrgID, sts:ExternalId).",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
      ]
    },
    "ICP-TF-AWS-IAM-006": {
      "title": "Detect Hardcoded Credentials and Secrets in Terraform",
      "description": "Ensures Terraform provider and variable blocks do not contain hardcoded credentials or secrets, and that human users authenticate via federation.",
      "remediation": "Remove hardcoded keys/secrets from provider and variable blocks; source credentials from environment, assumed roles, or a secrets manager.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-001": {
      "title": "Require S3 Block Public Access",
      "description": "Ensures each S3 bucket enables Block Public Access with all four settings set to true.",
      "remediation": "Add aws_s3_bucket_public_access_block with block_public_acls, block_public_policy, ignore_public_acls, and restrict_public_buckets all set to true.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-002": {
      "title": "Prohibit Public Read Access on S3 Buckets",
      "description": "Ensures no bucket policy or ACL grants public READ access to S3 buckets.",
      "remediation": "Remove public-read grants; ensure no bucket policy or ACL grants READ to AllUsers/AuthenticatedUsers or Principal \"*\".",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-003": {
      "title": "Prohibit Public Write Access on S3 Buckets",
      "description": "Ensures no bucket policy or ACL grants public WRITE access to S3 buckets.",
      "remediation": "Remove any bucket policy or ACL granting WRITE/PutObject to public principals.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-004": {
      "title": "Require Default S3 Server-Side Encryption",
      "description": "Ensures each S3 bucket configures default server-side encryption using SSE-S3 or SSE-KMS.",
      "remediation": "Add aws_s3_bucket_server_side_encryption_configuration with sse_algorithm AES256 (SSE-S3) or aws:kms (SSE-KMS).",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-005": {
      "title": "Require TLS-Only Access to S3 Buckets",
      "description": "Ensures each S3 bucket has a policy that denies requests made over non-TLS (aws:SecureTransport = false) connections.",
      "remediation": "Add a bucket policy statement that denies requests when aws:SecureTransport = false.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-006": {
      "title": "Restrict Cross-Account Grants in S3 Bucket Policies",
      "description": "Ensures S3 bucket policies do not grant access to broad or wildcard principals across accounts.",
      "remediation": "Scope bucket policy Principals to specific account/role ARNs; remove broad or wildcard principals.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html"
      ]
    },
    "ICP-TF-AWS-STR-007": {
      "title": "Enforce S3 Bucket Owner Object Ownership",
      "description": "Ensures S3 buckets disable ACLs by setting Object Ownership to BucketOwnerEnforced.",
      "remediation": "Set aws_s3_bucket_ownership_controls rule object_ownership to BucketOwnerEnforced.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/controltower/latest/controlreference/s3-rules.html"
      ]
    },
    "ICP-TF-AWS-CMP-001": {
      "title": "Require IMDSv2 on EC2 Instances",
      "description": "Ensures EC2 instances and launch templates require IMDSv2 by setting http_tokens to required.",
      "remediation": "Set metadata_options.http_tokens = \"required\" on aws_instance / aws_launch_template.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-002": {
      "title": "Restrict EC2 Metadata Hop Limit",
      "description": "Ensures the instance metadata response hop limit is set to 1.",
      "remediation": "Set metadata_options.http_put_response_hop_limit = 1.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html"
      ]
    },
    "ICP-TF-AWS-CMP-003": {
      "title": "Prohibit Public IPv4 Addresses on EC2 Instances",
      "description": "Ensures EC2 instances do not associate a public IPv4 address.",
      "remediation": "Set associate_public_ip_address = false on aws_instance.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-004": {
      "title": "Prevent Auto-Assignment of Public IPs on Subnets",
      "description": "Ensures subnets do not automatically assign public IP addresses on launch.",
      "remediation": "Set map_public_ip_on_launch = false on aws_subnet.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-005": {
      "title": "Prohibit Unrestricted SSH Ingress",
      "description": "Ensures security groups do not allow ingress from 0.0.0.0/0 or ::/0 to port 22 (SSH).",
      "remediation": "Remove 0.0.0.0/0 and ::/0 ingress rules to port 22; restrict SSH to specific CIDRs or use SSM Session Manager.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-006": {
      "title": "Prohibit Unrestricted RDP Ingress",
      "description": "Ensures security groups do not allow ingress from 0.0.0.0/0 or ::/0 to port 3389 (RDP).",
      "remediation": "Remove 0.0.0.0/0 and ::/0 ingress rules to port 3389; restrict RDP to specific trusted CIDRs.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-007": {
      "title": "Restrict Unrestricted Ingress to High-Risk Ports",
      "description": "Ensures security groups do not allow unrestricted ingress from 0.0.0.0/0 or ::/0 to high-risk ports.",
      "remediation": "Restrict ingress from 0.0.0.0/0 or ::/0 on high-risk ports to specific trusted CIDRs.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-008": {
      "title": "Require Empty Default Security Group Rules",
      "description": "Ensures the default security group allows no ingress or egress traffic.",
      "remediation": "Define aws_default_security_group with no ingress and no egress rules.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-009": {
      "title": "Require Encryption on Attached EBS Volumes",
      "description": "Ensures attached EBS volumes are encrypted at rest.",
      "remediation": "Set encrypted = true on aws_ebs_volume and on instance block device mappings.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-010": {
      "title": "Require EBS Default Encryption",
      "description": "Ensures EBS default encryption is enabled for the account and region.",
      "remediation": "Add aws_ebs_encryption_by_default with enabled = true.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html"
      ]
    },
    "ICP-TF-AWS-CMP-011": {
      "title": "Prohibit Privileged ECS Containers",
      "description": "Ensures ECS task definitions do not run containers in privileged mode.",
      "remediation": "Set privileged = false (or omit it) in container_definitions of aws_ecs_task_definition.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/controltower/latest/controlreference/proactive-controls.html"
      ]
    },
    "ICP-TF-AWS-NCD-001": {
      "title": "Restrict SSH Ingress from 0.0.0.0/0",
      "description": "Ensures no aws_security_group or aws_security_group_rule permits TCP port 22 ingress from 0.0.0.0/0 or ::/0.",
      "remediation": "Replace open CIDR ranges in the ingress block with a bastion or VPN CIDR, or adopt AWS Systems Manager Session Manager and remove SSH ingress entirely.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-13"
      ]
    },
    "ICP-TF-AWS-NCD-002": {
      "title": "Restrict RDP Ingress from 0.0.0.0/0",
      "description": "Ensures no aws_security_group or aws_security_group_rule permits TCP port 3389 ingress from 0.0.0.0/0 or ::/0.",
      "remediation": "Restrict source CIDR in the ingress block to admin subnets or VPN ranges, or replace RDP with AWS Systems Manager Fleet Manager.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-14"
      ]
    },
    "ICP-TF-AWS-NCD-003": {
      "title": "Block Unrestricted Access to High-Risk Ports",
      "description": "Denies aws_security_group ingress rules that permit 0.0.0.0/0 or ::/0 to high-risk ports.",
      "remediation": "Remove the offending ingress rule or scope cidr_blocks to internal CIDRs, prefix lists, or security_groups references.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-19"
      ]
    },
    "ICP-TF-AWS-NCD-004": {
      "title": "Default VPC Security Group Must Deny All Traffic",
      "description": "Requires aws_default_security_group to declare empty ingress and egress lists so the default security group provides no implicit access.",
      "remediation": "Declare aws_default_security_group with explicit empty ingress and egress blocks.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2"
      ]
    },
    "ICP-TF-AWS-NCD-005": {
      "title": "Restrict NACL Ingress to Remote Administration Ports",
      "description": "Rejects aws_network_acl_rule with egress=false, protocol=tcp, rule_action=allow and cidr_block=0.0.0.0/0 targeting port 22 or 3389.",
      "remediation": "Set rule_action to deny for administrative ports from 0.0.0.0/0, or scope cidr_block to trusted networks.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-21"
      ]
    },
    "ICP-TF-AWS-NCD-006": {
      "title": "Require VPC Endpoints for AWS Service Traffic",
      "description": "Requires declaration of aws_vpc_endpoint resources for S3, DynamoDB, KMS, and Secrets Manager when those services are consumed from private subnets.",
      "remediation": "Declare aws_vpc_endpoint resources with service_name set to the appropriate com.amazonaws.<region>.<service>.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html"
      ]
    },
    "ICP-TF-AWS-NCD-007": {
      "title": "Application Load Balancer Must Redirect HTTP to HTTPS",
      "description": "Requires aws_lb_listener on port 80 to declare default_action.type=redirect with default_action.redirect.protocol=HTTPS.",
      "remediation": "Set the default_action of the HTTP listener to type=redirect with protocol=HTTPS, port=443 and status_code=HTTP_301.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-1"
      ]
    },
    "ICP-TF-AWS-NCD-008": {
      "title": "CloudFront Distributions Must Enforce HTTPS to Viewers",
      "description": "Requires aws_cloudfront_distribution viewer_protocol_policy to be redirect-to-https or https-only and minimum_protocol_version to be TLSv1.2_2021 or higher.",
      "remediation": "Set viewer_protocol_policy to redirect-to-https and configure viewer_certificate with minimum_protocol_version=TLSv1.2_2021.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-3"
      ]
    },
    "ICP-TF-AWS-NCD-009": {
      "title": "Enable API Gateway REST Stage Execution Logging",
      "description": "Requires aws_api_gateway_method_settings with method_path=*/* to set settings.logging_level to ERROR or INFO.",
      "remediation": "Declare aws_api_gateway_method_settings with method_path=*/* and settings.logging_level=ERROR or INFO.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-1"
      ]
    },
    "ICP-TF-AWS-DAT-001": {
      "title": "RDS DB Instances Must Not Be Publicly Accessible",
      "description": "Denies aws_db_instance and aws_rds_cluster_instance resources with publicly_accessible=true.",
      "remediation": "Set publicly_accessible=false on aws_db_instance and aws_rds_cluster_instance.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-2"
      ]
    },
    "ICP-TF-AWS-DAT-002": {
      "title": "Enable RDS Storage Encryption At Rest",
      "description": "Requires aws_db_instance and aws_rds_cluster to set storage_encrypted=true.",
      "remediation": "Set storage_encrypted=true and kms_key_id to a customer-managed CMK ARN at resource creation.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-3"
      ]
    },
    "ICP-TF-AWS-DAT-003": {
      "title": "Publish RDS Engine Logs to CloudWatch",
      "description": "Requires aws_db_instance and aws_rds_cluster to set enabled_cloudwatch_logs_exports to a non-empty list.",
      "remediation": "Set enabled_cloudwatch_logs_exports to the log types applicable to the engine.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-9"
      ]
    },
    "ICP-TF-AWS-DAT-004": {
      "title": "Enable RDS Deletion Protection",
      "description": "Requires aws_db_instance and aws_rds_cluster to set deletion_protection=true.",
      "remediation": "Set deletion_protection=true, skip_final_snapshot=false, and provide a final_snapshot_identifier.",
      "severity": "LOW",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7"
      ]
    },
    "ICP-TF-AWS-DAT-005": {
      "title": "Enable RDS Automatic Minor Version Upgrades",
      "description": "Requires aws_db_instance to set auto_minor_version_upgrade=true.",
      "remediation": "Set auto_minor_version_upgrade=true and configure maintenance_window to a low-traffic period.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-13"
      ]
    },
    "ICP-TF-AWS-DAT-006": {
      "title": "Enable DynamoDB Point-in-Time Recovery",
      "description": "Requires aws_dynamodb_table to declare point_in_time_recovery with enabled=true.",
      "remediation": "Add a point_in_time_recovery block with enabled=true to every aws_dynamodb_table declaration.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-2"
      ]
    },
    "ICP-TF-AWS-DAT-007": {
      "title": "Redshift Clusters Must Not Be Publicly Accessible",
      "description": "Denies aws_redshift_cluster with publicly_accessible=true.",
      "remediation": "Set publicly_accessible=false and place the cluster in private subnets.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-1"
      ]
    },
    "ICP-TF-AWS-DAT-008": {
      "title": "Enable Redshift Audit Logging",
      "description": "Requires aws_redshift_cluster to declare a logging block with enable=true delivering logs to an S3 bucket.",
      "remediation": "Add a logging block to aws_redshift_cluster with enable=true and bucket_name pointing to a hardened S3 bucket.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-4"
      ]
    },
    "ICP-TF-AWS-DAT-009": {
      "title": "Enforce ElastiCache Redis Encryption in Transit and At Rest",
      "description": "Requires aws_elasticache_replication_group to set transit_encryption_enabled=true and at_rest_encryption_enabled=true.",
      "remediation": "Set transit_encryption_enabled=true and at_rest_encryption_enabled=true on aws_elasticache_replication_group.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html#elasticache-4"
      ]
    },
    "ICP-TF-AWS-EKM-001": {
      "title": "Enable Rotation for KMS Customer Managed Keys",
      "description": "Requires aws_kms_key with customer_master_key_spec=SYMMETRIC_DEFAULT to set enable_key_rotation=true.",
      "remediation": "Set enable_key_rotation=true on symmetric aws_kms_key resources.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-4"
      ]
    },
    "ICP-TF-AWS-EKM-002": {
      "title": "Enforce Minimum KMS Key Deletion Window",
      "description": "Rejects aws_kms_key with deletion_window_in_days less than 30.",
      "remediation": "Set deletion_window_in_days=30 on aws_kms_key.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-3"
      ]
    },
    "ICP-TF-AWS-EKM-003": {
      "title": "Prohibit kms:Decrypt on All KMS Keys",
      "description": "Rejects aws_iam_policy and aws_iam_role_policy JSON documents that grant kms:Decrypt or kms:ReEncryptFrom with Resource set to a wildcard.",
      "remediation": "Restrict the Resource element in KMS-related IAM policy statements to specific CMK ARNs.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-1"
      ]
    },
    "ICP-TF-AWS-EKM-004": {
      "title": "Require Conditions on KMS Key Policies Granting Full Access to Root",
      "description": "Warns when aws_kms_key policy grants kms:* to the root principal without a Condition block.",
      "remediation": "Add a Condition block to the root-principal statement using aws:PrincipalTag or kms:EncryptionContext keys.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html"
      ]
    },
    "ICP-TF-AWS-EKM-005": {
      "title": "Enforce SSE-KMS on S3 Buckets",
      "description": "Requires aws_s3_bucket_server_side_encryption_configuration to declare a rule with sse_algorithm=aws:kms and kms_master_key_id set to a customer-managed CMK.",
      "remediation": "Declare aws_s3_bucket_server_side_encryption_configuration with sse_algorithm=aws:kms and kms_master_key_id set to a CMK ARN.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-14"
      ]
    },
    "ICP-TF-AWS-EKM-006": {
      "title": "Enable EBS Default Encryption per Region",
      "description": "Requires aws_ebs_encryption_by_default.enabled=true and aws_ebs_default_kms_key.key_arn set to a customer-managed CMK.",
      "remediation": "Declare aws_ebs_encryption_by_default with enabled=true and aws_ebs_default_kms_key with key_arn pointing to a customer-managed CMK.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-7"
      ]
    },
    "ICP-TF-AWS-EKM-007": {
      "title": "Configure Rotation for Secrets Manager Secrets",
      "description": "Requires every aws_secretsmanager_secret to have a corresponding aws_secretsmanager_secret_rotation with rotation_rules.automatically_after_days <= 90.",
      "remediation": "Declare an aws_secretsmanager_secret_rotation resource with rotation_lambda_arn set and automatically_after_days set to 60 or less.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html#secretsmanager-1"
      ]
    },
    "ICP-TF-AWS-EKM-008": {
      "title": "Enforce Minimum Key Length for ACM RSA Certificates",
      "description": "Rejects aws_acm_certificate whose key_algorithm indicates an RSA key length below 2048 bits.",
      "remediation": "Set key_algorithm on aws_acm_certificate to RSA_2048, RSA_4096, EC_prime256v1, EC_secp384r1, or EC_secp521r1.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/acm-controls.html#acm-2"
      ]
    },
    "ICP-TF-AWS-LOM-001": {
      "title": "CloudTrail trail must be multi-region and capture all management events",
      "description": "AWS Security Hub control CloudTrail.1 requires at least one multi-region trail capturing read and write management events across all regions.",
      "remediation": "In aws_cloudtrail, set is_multi_region_trail = true, include_global_service_events = true, and configure an event_selector with read_write_type = \"All\" and include_management_events = true.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-1"
      ]
    },
    "ICP-TF-AWS-LOM-002": {
      "title": "CloudTrail log file integrity validation must be enabled",
      "description": "AWS Security Hub control CloudTrail.4 requires log file validation so CloudTrail delivers digest files usable to verify log integrity.",
      "remediation": "Set enable_log_file_validation = true on the aws_cloudtrail resource.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-4"
      ]
    },
    "ICP-TF-AWS-LOM-003": {
      "title": "CloudTrail logs must be encrypted at rest with a customer managed KMS key",
      "description": "AWS Security Hub control CloudTrail.2 requires CloudTrail log encryption with a KMS CMK.",
      "remediation": "Reference an aws_kms_key ARN via kms_key_id on aws_cloudtrail, and ensure the key policy grants the CloudTrail service principal usage.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html#cloudtrail-2"
      ]
    },
    "ICP-TF-AWS-LOM-004": {
      "title": "CloudWatch Log Groups must be encrypted with a customer managed KMS key",
      "description": "AWS Security Hub control CloudWatch.5 requires CloudWatch log groups to be KMS-encrypted.",
      "remediation": "Set kms_key_id on every aws_cloudwatch_log_group and grant the CloudWatch Logs service principal decrypt permission on the KMS key policy.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/config/latest/developerguide/cloudwatch-log-group-encrypted.html"
      ]
    },
    "ICP-TF-AWS-LOM-005": {
      "title": "CloudWatch Log Groups must define an explicit retention period",
      "description": "AWS Security Hub control CloudWatch.16 requires log groups to have a retention policy. HCA minimum retention is 365 days.",
      "remediation": "Set retention_in_days on aws_cloudwatch_log_group to at least 365.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/config/latest/developerguide/cw-loggroup-retention-period-check.html"
      ]
    },
    "ICP-TF-AWS-LOM-006": {
      "title": "VPC Flow Logs must be enabled for every VPC",
      "description": "AWS Security Hub control EC2.6 requires flow logs on all VPCs.",
      "remediation": "Add an aws_flow_log per aws_vpc with traffic_type = \"ALL\" and log_destination set to a CloudWatch Log Group ARN or S3 bucket ARN.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-6"
      ]
    },
    "ICP-TF-AWS-LOM-007": {
      "title": "Application/Network Load Balancers must have access logging enabled",
      "description": "AWS Security Hub control ELB.5/ELB.6 requires ALB and NLB access logging to be enabled to a dedicated S3 bucket.",
      "remediation": "Add an access_logs block on aws_lb with enabled = true and bucket pointing to a dedicated S3 bucket.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-5"
      ]
    },
    "ICP-TF-AWS-LOM-008": {
      "title": "RDS DB instances must export engine logs to CloudWatch Logs",
      "description": "AWS Security Hub control RDS.9 requires engine-specific log exports to CloudWatch.",
      "remediation": "Populate enabled_cloudwatch_logs_exports on aws_db_instance with the log types appropriate for the engine.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-9"
      ]
    },
    "ICP-TF-AWS-LOM-009": {
      "title": "AWS Config recorder and delivery channel must be defined",
      "description": "AWS Security Hub control Config.1 requires AWS Config to be enabled to record resource configuration changes.",
      "remediation": "Define aws_config_configuration_recorder with all_supported = true and aws_config_delivery_channel with a valid s3_bucket_name.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/config-controls.html#config-1"
      ]
    },
    "ICP-TF-AWS-GAC-001": {
      "title": "S3 buckets must enforce Block Public Access (all four settings)",
      "description": "AWS Security Hub controls S3.1/S3.8 require Block Public Access to be fully enabled.",
      "remediation": "Create aws_s3_bucket_public_access_block for each bucket with all four flags set to true.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-8"
      ]
    },
    "ICP-TF-AWS-GAC-002": {
      "title": "S3 buckets must have server-side encryption configured",
      "description": "AWS Security Hub control S3.4 requires default SSE on S3 buckets.",
      "remediation": "Add aws_s3_bucket_server_side_encryption_configuration per bucket with sse_algorithm = \"aws:kms\" and a kms_master_key_id.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-4"
      ]
    },
    "ICP-TF-AWS-GAC-003": {
      "title": "S3 buckets must have versioning enabled",
      "description": "AWS Security Hub control S3.14 requires versioning on S3 buckets.",
      "remediation": "Add aws_s3_bucket_versioning per bucket with versioning_configuration.status = \"Enabled\".",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-14"
      ]
    },
    "ICP-TF-AWS-GAC-004": {
      "title": "S3 bucket policies must deny non-TLS traffic (aws:SecureTransport)",
      "description": "AWS Security Hub control S3.5 requires bucket policies to deny requests where aws:SecureTransport is false.",
      "remediation": "Add or extend aws_s3_bucket_policy with a Deny statement for s3:* whose Condition Bool aws:SecureTransport is \"false\".",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5"
      ]
    },
    "ICP-TF-AWS-GAC-005": {
      "title": "EBS volumes must be encrypted",
      "description": "AWS Security Hub control EC2.3 requires EBS volumes to be encrypted at rest.",
      "remediation": "Set encrypted = true and kms_key_id (CMK ARN) on aws_ebs_volume.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-3"
      ]
    },
    "ICP-TF-AWS-GAC-006": {
      "title": "Account-level EBS default encryption must be enabled",
      "description": "AWS Security Hub control EC2.7 requires default EBS encryption per region.",
      "remediation": "Add aws_ebs_encryption_by_default (enabled = true) plus optional aws_ebs_default_kms_key referencing a CMK, per region.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-7"
      ]
    },
    "ICP-TF-AWS-GAC-007": {
      "title": "EC2 instances and launch templates must require IMDSv2",
      "description": "AWS Security Hub control EC2.8 requires IMDSv2 (token-based) on EC2 instances and launch templates.",
      "remediation": "Add metadata_options { http_tokens = \"required\", http_endpoint = \"enabled\" } to aws_instance and aws_launch_template.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8"
      ]
    },
    "ICP-TF-AWS-GAC-008": {
      "title": "EBS snapshots must not be shared publicly",
      "description": "AWS Security Hub control EC2.1 requires EBS snapshots to be private.",
      "remediation": "Remove aws_snapshot_create_volume_permission entries that set group = \"all\"; share only with specific account_id values.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-1"
      ]
    },
    "ICP-TF-AWS-GAC-009": {
      "title": "RDS DB instances must have storage encryption enabled",
      "description": "AWS Security Hub control RDS.3 requires encryption at rest on RDS instances.",
      "remediation": "Set storage_encrypted = true and provide kms_key_id on aws_db_instance.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-3"
      ]
    },
    "ICP-TF-AWS-GAC-010": {
      "title": "RDS DB instances must not be publicly accessible",
      "description": "AWS Security Hub control RDS.2 requires publicly_accessible = false on RDS instances.",
      "remediation": "Set publicly_accessible = false on aws_db_instance and place the DB in private subnets.",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-2"
      ]
    },
    "ICP-TF-AWS-GAC-011": {
      "title": "RDS DB instances must have deletion protection enabled",
      "description": "AWS Security Hub control RDS.8 requires deletion protection on RDS instances.",
      "remediation": "Set deletion_protection = true on aws_db_instance.",
      "severity": "LOW",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-8"
      ]
    },
    "ICP-TF-AWS-GAC-012": {
      "title": "RDS DB instances must have adequate backup retention",
      "description": "AWS Security Hub control RDS.11 requires automated backups with adequate retention. RDS automated backups are capped at 35 days — set backup_retention_period to 35. Full HCA 365-day retention requires AWS Backup configured separately.",
      "remediation": "Set backup_retention_period = 35 on aws_db_instance. Configure AWS Backup with a backup plan to meet the HCA 365-day retention requirement.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-11",
        "https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html"
      ]
    },
    "ICP-TF-AWS-GAC-013": {
      "title": "RDS snapshots must not be shared publicly",
      "description": "AWS Security Hub control RDS.1 requires DB snapshots not to be public.",
      "remediation": "Ensure shared_accounts lists only specific AWS account IDs, never \"all\".",
      "severity": "CRITICAL",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-1"
      ]
    },
    "ICP-TF-AWS-GAC-014": {
      "title": "IAM policies must not grant full administrative privileges",
      "description": "AWS Security Hub control IAM.1 requires that no customer-managed policy grants Action=\"*\" over Resource=\"*\".",
      "remediation": "Refactor IAM policy JSON to scope Action and Resource; avoid Action=\"*\" combined with Resource=\"*\".",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-1"
      ]
    },
    "ICP-TF-AWS-GAC-015": {
      "title": "IAM roles must not use wildcard trust principals or wildcard actions in assume-role policy",
      "description": "AWS IAM best practices require role trust policies to specify concrete principals and specific sts:AssumeRole* actions.",
      "remediation": "Rewrite assume_role_policy to specify explicit trusted Principals and Action = \"sts:AssumeRole\".",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
      ]
    },
    "ICP-TF-AWS-GAC-016": {
      "title": "IAM account password policy must enforce strong requirements",
      "description": "AWS Security Hub controls IAM.7-17 require a strong password policy: min length 14, upper/lower/number/symbol, reuse prevention >= 24, max age <= 90.",
      "remediation": "Define aws_iam_account_password_policy meeting all the requirements above.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-7"
      ]
    },
    "ICP-TF-AWS-GAC-017": {
      "title": "Security groups must not allow ingress from 0.0.0.0/0 or ::/0 to port 22",
      "description": "AWS Security Hub control EC2.13 requires SSH not to be open to the world.",
      "remediation": "Restrict SSH ingress to specific corporate CIDRs, or use SSM Session Manager instead.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-13"
      ]
    },
    "ICP-TF-AWS-GAC-018": {
      "title": "Security groups must not allow ingress from 0.0.0.0/0 or ::/0 to port 3389",
      "description": "AWS Security Hub control EC2.14 requires RDP not to be open to the world.",
      "remediation": "Restrict RDP ingress to specific corporate CIDRs, or use SSM Fleet Manager instead.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-14"
      ]
    },
    "ICP-TF-AWS-GAC-019": {
      "title": "Default security groups must not allow any inbound or outbound traffic",
      "description": "AWS Security Hub control EC2.2 requires default SGs to have no rules.",
      "remediation": "Manage default VPC SGs via aws_default_security_group and leave ingress and egress as empty lists.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2"
      ]
    },
    "ICP-TF-AWS-GAC-020": {
      "title": "Application Load Balancer listeners must use HTTPS (or HTTP redirect to HTTPS)",
      "description": "AWS Security Hub control ELB.1 requires ALB HTTP listeners to redirect to HTTPS.",
      "remediation": "Configure aws_lb_listener with protocol = \"HTTPS\" or redirect HTTP to HTTPS via default_action.type = \"redirect\".",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-1"
      ]
    },
    "ICP-TF-AWS-GAC-021": {
      "title": "CloudFront distributions must enforce HTTPS to viewers",
      "description": "AWS Security Hub control CloudFront.3 requires viewer_protocol_policy to enforce HTTPS.",
      "remediation": "Set viewer_protocol_policy to \"redirect-to-https\" or \"https-only\" on all cache behaviors.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-3"
      ]
    },
    "ICP-TF-AWS-GAC-022": {
      "title": "CloudFront distributions must use a modern TLS minimum protocol version",
      "description": "AWS Security Hub control CloudFront.10 requires minimum_protocol_version to be TLSv1.2 or higher.",
      "remediation": "Set viewer_certificate.minimum_protocol_version = \"TLSv1.2_2021\" or newer on aws_cloudfront_distribution.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-10"
      ]
    },
    "ICP-TF-AWS-GAC-023": {
      "title": "EKS cluster API endpoint public access must be disabled or restricted",
      "description": "AWS Security Hub control EKS.2 requires endpoint_public_access to be false or public_access_cidrs to exclude 0.0.0.0/0.",
      "remediation": "Set vpc_config.endpoint_public_access = false with endpoint_private_access = true, or restrict public_access_cidrs to specific corporate CIDRs.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html#eks-2"
      ]
    },
    "ICP-TF-AWS-GAC-024": {
      "title": "DynamoDB tables must have point-in-time recovery enabled",
      "description": "AWS Security Hub control DynamoDB.2 requires PITR on DynamoDB tables.",
      "remediation": "Add point_in_time_recovery { enabled = true } on aws_dynamodb_table.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-2"
      ]
    },
    "ICP-TF-AWS-GAC-025": {
      "title": "Provider blocks shall be configured with the mandatory default_tags",
      "description": "AWS Well-Architected guidance recommends enforcing mandatory tags at the provider level.",
      "remediation": "Ensure addition of mandatory tags (managed-by) to the aws provider block.",
      "severity": "LOW",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html"
      ]
    },
    "ICP-TF-AWS-GAC-026": {
      "title": "Resources must carry all mandatory baseline tags",
      "description": "Every taggable AWS resource must carry the full set of governed baseline tags.",
      "remediation": "Ensure resource tags are sourced from the context module's tags output.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html"
      ]
    },
    "ICP-TF-AWS-ORG-001": {
      "title": "AWS Organizations must be created with all features enabled",
      "description": "AWS Organizations guidance requires ALL features to enable policy-based governance capabilities.",
      "remediation": "Set feature_set = \"ALL\" on aws_organizations_organization.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html"
      ]
    },
    "ICP-TF-AWS-ORG-002": {
      "title": "Organizations policy types must be enabled on the root",
      "description": "AWS Organizations best practice recommends enabling required policy types on the root.",
      "remediation": "Populate enabled_policy_types with TAG_POLICY, BACKUP_POLICY, and AISERVICES_OPT_OUT_POLICY on aws_organizations_organization.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_enable-disable.html"
      ]
    },
    "ICP-TF-AWS-ORG-003": {
      "title": "Trusted service access must be enabled for foundational security services",
      "description": "AWS Organizations guidance recommends enabling trusted service access for CloudTrail, Config, Security Hub, GuardDuty, IAM Access Analyzer, and RAM.",
      "remediation": "Add the required service principals to aws_service_access_principals on aws_organizations_organization.",
      "severity": "HIGH",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html"
      ]
    },
    "ICP-TF-AWS-ORG-004": {
      "title": "Delegated administrator must be configured for security services",
      "description": "AWS Organizations guidance recommends a dedicated delegated administrator for Security Hub, GuardDuty, Config, and Access Analyzer.",
      "remediation": "Add aws_organizations_delegated_administrator resources for each required service_principal.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html"
      ]
    },
    "ICP-TF-AWS-ORG-005": {
      "title": "Account alternate contacts must be set for SECURITY, BILLING, and OPERATIONS",
      "description": "AWS account management guidance requires alternate contacts for Security, Billing, and Operations.",
      "remediation": "Add one aws_account_alternate_contact per contact type using the responsible team's shared email, phone, name, and title.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html"
      ]
    },
    "ICP-TF-AWS-ORG-006": {
      "title": "Organization Tag Policy must be defined and attached",
      "description": "AWS Organizations Tag Policies standardize tag keys and values across accounts.",
      "remediation": "Declare an aws_organizations_policy of type TAG_POLICY and attach it via aws_organizations_policy_attachment.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html"
      ]
    },
    "ICP-TF-AWS-ORG-007": {
      "title": "Organization Backup Policy must be defined and attached",
      "description": "AWS Backup / Organizations Backup policies centrally enforce backup plans across accounts.",
      "remediation": "Declare an aws_organizations_policy of type BACKUP_POLICY and attach it via aws_organizations_policy_attachment.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html"
      ]
    },
    "ICP-TF-AWS-ORG-008": {
      "title": "Organization Units (OUs) must be defined (no flat account structure)",
      "description": "AWS Control Tower and Organizations best practices require an OU-based structure rather than accounts under Root only.",
      "remediation": "Add aws_organizations_organizational_unit resources modeling the OU hierarchy.",
      "severity": "MEDIUM",
      "status": "active",
      "references": [
        "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html"
      ]
    }
  }
}