1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

variable "feature_set" {
  description = "Feature set for the organization — ALL or CONSOLIDATED_BILLING"
  type        = string
  default     = "ALL"
  validation {
    condition     = contains(["ALL", "CONSOLIDATED_BILLING"], var.feature_set)
    error_message = "feature_set must be ALL or CONSOLIDATED_BILLING."
  }
}

variable "aws_service_access_principals" {
  description = "AWS service principals to enable as trusted access in the organization"
  type        = list(string)
  default = [
    "cloudtrail.amazonaws.com",
    "config.amazonaws.com",
    "config-multiaccountsetup.amazonaws.com",
    "guardduty.amazonaws.com",
    "securityhub.amazonaws.com",
    "ram.amazonaws.com",
    "sso.amazonaws.com",
    "account.amazonaws.com",
    "inspector2.amazonaws.com",
    "malware-protection.guardduty.amazonaws.com",
  ]
}

variable "enabled_policy_types" {
  description = "Policy types to enable in the organization"
  type        = list(string)
  default     = ["SERVICE_CONTROL_POLICY", "TAG_POLICY"]
}

variable "delegated_administrators" {
  description = "Map of service principal to account ID for delegated administrator registration"
  type        = map(string)
  default     = {}
}

variable "tags" {
  description = "Standard tag map kept for interface consistency. Current organization and account setting resources do not support tags directly."
  type        = map(string)
  default     = {}
}

variable "manage_iam_password_policy" {
  description = "Whether to manage the IAM account password policy in the management account"
  type        = bool
  default     = true
}

variable "password_min_length" {
  description = "Minimum IAM user password length"
  type        = number
  default     = 14
}

variable "password_require_lowercase_characters" {
  description = "Require lowercase characters in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_uppercase_characters" {
  description = "Require uppercase characters in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_numbers" {
  description = "Require numbers in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_require_symbols" {
  description = "Require symbols in IAM user passwords"
  type        = bool
  default     = true
}

variable "password_allow_users_to_change_password" {
  description = "Allow IAM users to change their own password"
  type        = bool
  default     = true
}

variable "password_max_age_days" {
  description = "Maximum IAM user password age in days. Use 0 for no expiration."
  type        = number
  default     = 90
}

variable "password_reuse_prevention" {
  description = "Number of previous IAM user passwords that cannot be reused. Valid range is 1 to 24."
  type        = number
  default     = 24
}

variable "password_hard_expiry" {
  description = "Whether IAM users are prevented from setting a new password after their password expires"
  type        = bool
  default     = false
}

variable "manage_s3_account_public_access_block" {
  description = "Whether to manage account-level S3 public access block in the management account"
  type        = bool
  default     = true
}

variable "s3_block_public_acls" {
  description = "Block public ACLs for S3 buckets and objects at account level"
  type        = bool
  default     = true
}

variable "s3_block_public_policy" {
  description = "Block public bucket policies at account level"
  type        = bool
  default     = true
}

variable "s3_ignore_public_acls" {
  description = "Ignore public ACLs for S3 buckets and objects at account level"
  type        = bool
  default     = true
}

variable "s3_restrict_public_buckets" {
  description = "Restrict public bucket policies at account level"
  type        = bool
  default     = true
}

variable "enable_ebs_encryption_by_default" {
  description = "Whether to enable EBS encryption by default in the current provider region"
  type        = bool
  default     = true
}

variable "account_alias" {
  description = "Optional friendly IAM account alias for the management account sign-in URL"
  type        = string
  default     = null
}