1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

# main.tf — ORG violations fixture
# Triggers all 8 ORG policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# ORG-001 + ORG-002 + ORG-003 — Wrong feature set, missing policy types and trusted services
resource "aws_organizations_organization" "bad_org" {
  feature_set = "CONSOLIDATED_BILLING"

  aws_service_access_principals = [
    "cloudtrail.amazonaws.com"
  ]

  enabled_policy_types = [
    "TAG_POLICY"
  ]
}

# ORG-004 — Only one delegated admin, missing others
resource "aws_organizations_delegated_administrator" "bad_delegated" {
  account_id        = "123456789012"
  service_principal = "securityhub.amazonaws.com"
}

# ORG-005 — Only SECURITY contact, missing BILLING and OPERATIONS
resource "aws_account_alternate_contact" "bad_security" {
  alternate_contact_type = "SECURITY"
  name                   = "Security Team"
  title                  = "Security"
  email_address          = "[email protected]"
  phone_number           = "+1-555-0100"
}

# ORG-006 — TAG_POLICY exists but not attached
resource "aws_organizations_policy" "bad_tag_policy" {
  name = "bad-tag-policy"
  type = "TAG_POLICY"
  content = jsonencode({
    tags = {
      Environment = { tag_value = { "@@assign" = ["prod", "dev", "staging"] } }
    }
  })
}

# No aws_organizations_policy_attachment for bad_tag_policy = ORG-006 violation

# ORG-007 — No BACKUP_POLICY at all = ORG-007 violation

# ORG-008 — No OUs = ORG-008 violation