Naming Standards — Module Reference Table
Note: This table is a reference, not an exhaustive audit. The purpose of this document is to illustrate the approach to nomenclature consistently, at a glance, across the module set.
Rubric (recap)
${var.name}-<token>[-<qualifier>]
var.name— caller-supplied identity prefix (environment/workload/stack)<token>— short, fixed abbreviation for the resource type<qualifier>— tier orfor_eachmap key, only when multiple instances exist
Reference Table
| AWS Resource | Token | Naming Convention (var syntax) | Comments / Rubric Elaboration | Example |
|---|---|---|---|---|
| account | acct |
${var.name}-acct |
AWS Organizations account; qualifier usually unnecessary (module is typically singleton per invocation) | hca-shared-services-acct |
| account-contacts | acct-contact |
${var.name}-acct-contact-${each.key} |
Qualifier = contact type key (billing/security/operations) | hca-shared-services-acct-contact-billing |
| acm | cert |
${var.name}-cert-${each.key} |
Qualifier = domain/SAN key when multiple certs are issued per module call | hca-app-cert-primary |
| api-gateway | apigw |
${var.name}-apigw |
Stage as separate qualifier if multiple stages are managed in one call | hca-orders-apigw |
| backup | bkp-plan / bkp-vault |
${var.name}-bkp-vault, ${var.name}-bkp-plan-${each.key} |
Vault likely singleton; plan qualifier = schedule/tier key (daily/weekly) | hca-prod-bkp-vault, hca-prod-bkp-plan-daily |
| cloudfront | cf |
${var.name}-cf-${each.key} |
Qualifier only if multiple distributions per call | hca-static-cf |
| cloudtrail | ct |
${var.name}-ct |
Org-level trail, typically singleton per account | hca-shared-services-ct |
| cloudwatch | cw-log / cw-alarm |
${var.name}-cw-log-${each.key}, ${var.name}-cw-alarm-${each.key} |
Qualifier = log group purpose or alarm metric key | hca-app-cw-log-access, hca-app-cw-alarm-cpu-high |
| config | cfg |
${var.name}-cfg-recorder, ${var.name}-cfg-rule-${each.key} |
Config recorder as fixed-key singleton (mirrors igw pattern); rules use qualifier per rule name |
hca-shared-services-cfg-recorder, hca-shared-services-cfg-rule-s3-encrypted |
| dynamodb | ddb |
${var.name}-ddb-${each.key} |
Qualifier = table logical key when multiple tables per call | hca-orders-ddb-transactions |
| ebs | ebs |
${var.name}-ebs-${each.key} |
Qualifier = volume purpose/mount key | hca-app01-ebs-data |
| ec2-autoscaling | asg |
${var.name}-asg-${each.key} |
Qualifier = workload/tier key when multiple ASGs per call | hca-web-asg-frontend |
| ec2-node | ec2 |
${var.name}-ec2-${each.key} |
Qualifier = instance role/index key | hca-mecm-ec2 |
| efs | efs |
${var.name}-efs |
Singleton per call unless multiple file systems are provisioned together | hca-shared-efs |
| eks-cluster | eks |
${var.name}-eks |
Cluster name itself; node groups handled by companion module | hca-platform-eks |
| eks-nodes | eks-ng |
${var.name}-eks-ng-${each.key} |
Qualifier = node group key (e.g. spot/on-demand, workload class) | hca-platform-eks-ng-general |
| elasticache | cache |
${var.name}-cache-${each.key} |
Qualifier = cluster/replication group key | hca-session-cache-redis |
| eventbridge | evb |
${var.name}-evb-${each.key} |
Qualifier = bus or rule key | hca-orders-evb-bus |
| fsx-windows | fsx |
${var.name}-fsx |
Singleton per call | hca-bbwd-fsx |
| guardduty | gd |
${var.name}-gd |
Detector is typically singleton per account | hca-shared-services-gd |
| guardduty-member | gd-member |
${var.name}-gd-member-${each.key} |
Qualifier = member account key when inviting multiple accounts | hca-org-gd-member-workloads |
| iam-access-analyzer | iam-aa |
${var.name}-iam-aa |
Singleton analyzer per account/org | hca-shared-services-iam-aa |
| iam-identity-provider | iam-idp |
${var.name}-iam-idp-${each.key} |
Qualifier = provider key (OIDC/SAML source) | hca-shared-services-iam-idp-bitbucket |
| iam-policy | iam-pol |
${var.name}-iam-pol-${each.key} |
Qualifier = policy purpose key | hca-platform-iam-pol-readonly |
| iam-role | iam-role |
${var.name}-iam-role-${each.key} |
Qualifier = role purpose key (mirrors flow-log-role pattern in VPC module) |
hca-platform-iam-role-flow-log |
| inspector | insp |
${var.name}-insp |
Singleton scan configuration per account | hca-shared-services-insp |
| kms | kms |
${var.name}-kms-${each.key} |
Qualifier = key purpose (e.g. s3, ebs, secrets) | hca-platform-kms-s3 |
| lambda | fn |
${var.name}-fn-${each.key} |
Qualifier = function purpose key | hca-orders-fn-processor |
| load-balancer | lb |
${var.name}-lb-${each.key} |
Qualifier = tier/type key (internal/external, alb/nlb) | hca-web-lb-external |
| nacl | nacl |
${var.name}-nacl-${each.key} |
Qualifier = subnet tier key, mirrors VPC module's subnet tiering | hca-shared-services-nacl-private |
| organization | org |
${var.name}-org |
Singleton per AWS Organization | hca-org |
| ou | ou |
${var.name}-ou-${each.key} |
Qualifier = OU key | hca-ou-workloads |
| ram-acceptance | ram-accept |
${var.name}-ram-accept-${each.key} |
Qualifier = share/resource key being accepted | hca-shared-services-ram-accept-vpc-subnets |
| ram-share | ram-share |
${var.name}-ram-share-${each.key} |
Qualifier = shared resource key; pairs with ram-acceptance on the participant side |
hca-networking-ram-share-vpc-subnets |
| rds-oracle | rds-ora |
${var.name}-rds-ora-${each.key} |
Qualifier = instance/cluster key | hca-erp-rds-ora-primary |
| rds-postgres | rds-pg |
${var.name}-rds-pg-${each.key} |
Qualifier = instance/cluster key | hca-app-rds-pg-primary |
| redshift | rs |
${var.name}-rs-${each.key} |
Qualifier = cluster key | hca-analytics-rs-main |
| route53 | r53 |
${var.name}-r53-${each.key} |
Qualifier = zone or record-set purpose key | hca-platform-r53-internal |
| s3-bucket | s3 |
${var.name}-s3-${each.key} |
Qualifier = bucket purpose key (must also satisfy S3 global-uniqueness separately) | hca-platform-s3-logs |
| scp | scp |
${var.name}-scp-${each.key} |
Qualifier = policy purpose key | hca-org-scp-deny-root |
| secrets-manager | secret |
${var.name}-secret-${each.key} |
Qualifier = secret purpose key | hca-app-secret-db-creds |
| security-groups | sg |
${var.name}-sg-${each.key} |
Qualifier = tier/role key | hca-web-sg-frontend |
| security-hub | sh |
${var.name}-sh |
Singleton per account | hca-shared-services-sh |
| sns | sns |
${var.name}-sns-${each.key} |
Qualifier = topic purpose key | hca-platform-sns-alerts |
| sqs | sqs |
${var.name}-sqs-${each.key} |
Qualifier = queue purpose key | hca-orders-sqs-processing |
| ssm-automation | ssm-auto |
${var.name}-ssm-auto-${each.key} |
Qualifier = document/automation purpose key | hca-platform-ssm-auto-patch |
| ssm-parameter | ssm-param |
${var.name}-ssm-param-${each.key} |
Qualifier = parameter purpose key | hca-platform-ssm-param-db-host |
| sso-assignment | sso-assign |
${var.name}-sso-assign-${each.key} |
Qualifier = permission set/account key | hca-workloads-sso-assign-admin |
| tgw-attachment | tgw-attach |
${var.name}-tgw-attach-${each.key} |
Qualifier = source VPC/account key; distinct from transit-gateway module itself |
hca-shared-services-tgw-attach |
| transit-gateway | tgw |
${var.name}-tgw |
Singleton per hub deployment | hca-core-tgw |
| vpc | vpc (+ subnet, rt, nat, igw, nat-eip, flow-log) |
${var.name}-vpc, ${var.name}-subnet-<tier>-${each.key}, etc. |
Verified from actual module source — see VPC-specific naming standards doc | hca-shared-services-prod-vpc, hca-shared-services-prod-subnet-public-az1 |
| vpc-endpoints | vpce |
${var.name}-vpce-${each.key} |
Qualifier = service key (s3, dynamodb, ssm, etc.) | hca-shared-services-vpce-s3 |
| vpc-peering | vpc-peer |
${var.name}-vpc-peer-${each.key} |
Qualifier = peer VPC/account key | hca-networking-vpc-peer-legacy |