1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# Variables ==================================================================

# Organization Root ID -------------------------------------------------------
#
# Notes:
#  - Found in AWS Organizations console under the Root entry
#  - Format is "r-" followed by lowercase alphanumeric characters
#  - Example: r-wxyz
#
variable "root_id" {
  description = "Organization root ID under which top-level OUs are created (e.g. r-xxxx)"
  type        = string

  validation {
    condition     = can(regex("^r-[a-z0-9]+$", var.root_id))
    error_message = "root_id must start with an 'r-' followed by lowercase alphanumeric characters."
  }
}

# OU Structure ---------------------------------------------------------------
#
# Notes:
#  - Supports nesting up to 3 levels deep (e.g. Workloads > ACME > Prod)
#  - parent_key must be 'root' or reference another key in this map
#  - The key 'root' is reserved and cannot be used as an OU key
#  - Per-OU tags are merged with module-level tags; per-OU tags win on conflicts
#
# Example:
#   organizational_units = {
#     workloads = {
#       name       = "Workloads"
#       parent_key = "root"
#     }
#     workloads_prod = {
#       name       = "Prod"
#       parent_key = "workloads"
#       tags       = { env = "prod" }
#     }
#   }
#
variable "organizational_units" {
  description = <<-EOT
    Map of OU definitions. Each key is a logical name used internally.
    parent_key references another key in this map (or 'root' for top-level OUs).
  EOT
  type = map(object({
    name       = string
    parent_key = string
    tags       = optional(map(string), {})
  }))

  validation {
    condition     = !contains(keys(var.organizational_units), "root")
    error_message = "The key 'root' is reserved and cannot be used as an OU key."
  }

  validation {
    condition = alltrue([
      for k, v in var.organizational_units :
      v.parent_key == "root" || contains(keys(var.organizational_units), v.parent_key)
    ])
    error_message = "All parent_key values must be 'root' or reference an existing key in organizational_units."
  }
}