Generate a production-grade Terraform module for under modules//.

Module description: Namespace: Provider: aws

This module is for enterprise AWS infrastructure. It must be production-grade, complete, and correct. Do not cut corners or stub out resources.

Design principles

• Enterprise-grade but not over-engineered — expose enough inputs to be flexible across environments (dev/staging/prod) without exposing every possible AWS API knob as a variable
• A consumer should be able to use this module with only the required inputs and get a secure, working, production-ready resource
• Optional inputs should have sensible, secure defaults — encryption on by default, logging on by default, least-privilege by default
• Related resources always included — e.g. s3-bucket also covers versioning, encryption, lifecycle, logging; vpc also covers subnets, route tables, igw, nat, flow logs
• No hardcoded values anywhere — variables and locals only
• Use data blocks for resource lookups instead of accepting IDs as inputs where it makes sense
• Use for_each exclusively, never count
• No backend block anywhere

Input variable standards

• Every variable must have a description
• Every variable must have a type constraint
• String variables that accept a fixed set of values must have a validation block with a clear error message
• Numeric variables with known bounds must have a validation block
• Required variables have no default
• Optional variables have a sensible, secure default
• tags input always present: type map(string), default {}, description "Resource tags to apply to all resources"
• Do not expose variables that wrap low-level AWS API details consumers shouldn't need to think about

Required files — all six must be present

• main.tf
• variables.tf
• outputs.tf
• locals.tf
• versions.tf
• README.md

File conventions

versions.tf: terraform { required_version = ">= 1.15.6" required_providers { aws = { source = "hashicorp/aws" version = "~> 6.50" } } }

locals.tf:

• All derived values go here
• Tag merging goes here — merge var.tags with any module-level defaults
• No inline expressions in main.tf resources — reference locals only

main.tf:

• Clean resource definitions only
• References locals and var only, never hardcoded values
• Use for_each exclusively, never count
• No backend block anywhere

outputs.tf:

• Expose at minimum: primary resource ID and ARN
• Only expose what consuming modules would realistically need
• Every output must have a description

README.md:

Usage

```hcl module "<module_name>" { source = "hcassc.jfrog.io/iac-terraform-modules-virtual///aws" version = "0.1.0"

required inputs only

} ```

Commenting style

• Section banners capped at 80 chars: # heading ===...= for top-level, # heading ---... for sub-sections
• Minimal inline comments only where genuinely needed
• No noise, no obvious comments

Resource naming

• Use this as the primary resource name when there is a single logical resource of that type
• All resource names lowercase with hyphens