Account

Vends AWS Organization member accounts with OU placement and security baseline wiring.

Creates member accounts via aws_organizations_account, places each in the specified OU, and exposes a cross-account bootstrap role ARN so that calling stacks can assume into each new account to apply security baselines (default VPC removal, EBS encryption by default, S3 public access block, IAM password policy, GuardDuty/Security Hub/Config enrollment). Account destruction is guarded by prevent_destroy. Depends on the governance/organization and governance/ou modules.

Usage

module "accounts" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/account/aws"
  version = "0.1.0"

  accounts = {
    prod = {
      name  = "my-org-prod"
      email = "[email protected]"
      ou_id = module.ou.all_ou_ids["workloads_prod"]
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_organizations_account.this	resource

Inputs

Name	Description	Type	Default	Required
accounts	Map of accounts to vend. Each entry creates an AWS Organization member account,places it in an OU, and applies baseline security settings.	map(object({ name = string email = string ou_id = string close_on_deletion = optional(bool, false) iam_user_access_to_billing = optional(string, "DENY") # Baseline controls remove_default_vpc = optional(bool, true) enable_ebs_encryption = optional(bool, true) block_s3_public_access = optional(bool, true) # Cross-account bootstrap role bootstrap_role_name = optional(string, "OrganizationAccountAccessRole") }))	n/a	yes
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
account_arns	Map of logical account key to account ARN
account_ids	Map of logical account key to AWS account ID
bootstrap_role_arns	Map of logical account key to the bootstrap cross-account role ARN