{"id":21639705,"url":"https://github.com/dasmeta/terraform-aws-account","last_synced_at":"2026-02-27T12:03:59.616Z","repository":{"id":103060298,"uuid":"574926789","full_name":"dasmeta/terraform-aws-account","owner":"dasmeta","description":"Terraform module to create AWS account setup","archived":false,"fork":false,"pushed_at":"2025-02-21T11:11:18.000Z","size":147,"stargazers_count":0,"open_issues_count":6,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-21T12:23:27.875Z","etag":null,"topics":["account","aws","module","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"www.dasmeta.com","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dasmeta.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security-hub.tf","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-06T11:33:29.000Z","updated_at":"2025-02-21T11:10:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"972610cf-9616-477b-9e7a-872ff2244aa0","html_url":"https://github.com/dasmeta/terraform-aws-account","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dasmeta%2Fterraform-aws-account","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dasmeta%2Fterraform-aws-account/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dasmeta%2Fterraform-aws-account/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dasmeta%2Fterraform-aws-account/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dasmeta","download_url":"https://codeload.github.com/dasmeta/terraform-aws-account/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244339044,"owners_count":20437169,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["account","aws","module","terraform","terraform-module"],"created_at":"2024-11-25T04:14:48.640Z","updated_at":"2026-02-27T12:03:59.594Z","avatar_url":"https://github.com/dasmeta.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-account\n\n## this module allows to configure aws account level resources which are not part to specific environment/application and are global impact on aws\n\n## basic example\n```hcl\nmodule \"account\" {\n  source  = \"dasmeta/account/aws\"\n  version = \"x.y.z\"\n\n  create_cloudwatch_log_role = true\n}\n```\n\n## upgrade guide\n- from \u003c=1.3.7 to \u003e=1.3.8\n  - if you have had `cost_report_export` and `account_events_export` used it is possible that after update to new version it will show some additional delete/create resources and will fail at firs apply. This is ok and there is need to plan apply one more time to get the needed resources related to account cost and events export created.\n- from \u003c=1.3.9 to \u003e=1.4.0 (BREAKING change related to security-hub configuration)\n  we have improvements in security-hub enable and notification channels configuration,\n  there is new variable named `security_hub`, which allows to enable security hub and with `alarm_actions.security_hub_alarms` variable we configure security-hub notification, by default the notifications go through account level configured channels, but it is possible to enable custom notification channels via custom sns topic, more info/example can be fount in test/example from ./tests/security-hub-findings-to-slack folder\n  with the new version we also added support for terraform provider 6.x\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e 1.3 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.0, \u003c 7.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 5.0, \u003c 7.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_account_events_export\"\u003e\u003c/a\u003e [account\\_events\\_export](#module\\_account\\_events\\_export) | ./modules/account-events-export | n/a |\n| \u003ca name=\"module_account_events_export_virginia\"\u003e\u003c/a\u003e [account\\_events\\_export\\_virginia](#module\\_account\\_events\\_export\\_virginia) | ./modules/account-events-export | n/a |\n| \u003ca name=\"module_buckets\"\u003e\u003c/a\u003e [buckets](#module\\_buckets) | dasmeta/s3/aws | 1.3.3 |\n| \u003ca name=\"module_cloudtrail\"\u003e\u003c/a\u003e [cloudtrail](#module\\_cloudtrail) | dasmeta/modules/aws//modules/cloudtrail/ | 2.18.3 |\n| \u003ca name=\"module_cloudwatch_alarm_actions\"\u003e\u003c/a\u003e [cloudwatch\\_alarm\\_actions](#module\\_cloudwatch\\_alarm\\_actions) | dasmeta/monitoring/aws//modules/cloudwatch-alarm-actions | 1.21.0 |\n| \u003ca name=\"module_cloudwatch_alarm_actions_virginia\"\u003e\u003c/a\u003e [cloudwatch\\_alarm\\_actions\\_virginia](#module\\_cloudwatch\\_alarm\\_actions\\_virginia) | dasmeta/monitoring/aws//modules/cloudwatch-alarm-actions | 1.21.0 |\n| \u003ca name=\"module_cost_report_export\"\u003e\u003c/a\u003e [cost\\_report\\_export](#module\\_cost\\_report\\_export) | ./modules/cost-report-export | n/a |\n| \u003ca name=\"module_enforce_mfa\"\u003e\u003c/a\u003e [enforce\\_mfa](#module\\_enforce\\_mfa) | terraform-module/enforce-mfa/aws | ~\u003e 1.0 |\n| \u003ca name=\"module_enforce_mfa_group\"\u003e\u003c/a\u003e [enforce\\_mfa\\_group](#module\\_enforce\\_mfa\\_group) | terraform-aws-modules/iam/aws//modules/iam-group-with-policies | 5.47.1 |\n| \u003ca name=\"module_groups\"\u003e\u003c/a\u003e [groups](#module\\_groups) | terraform-aws-modules/iam/aws//modules/iam-group-with-policies | 5.47.1 |\n| \u003ca name=\"module_monitoring_billing\"\u003e\u003c/a\u003e [monitoring\\_billing](#module\\_monitoring\\_billing) | dasmeta/monitoring/aws//modules/billing | 1.21.0 |\n| \u003ca name=\"module_monitoring_security_hub\"\u003e\u003c/a\u003e [monitoring\\_security\\_hub](#module\\_monitoring\\_security\\_hub) | dasmeta/monitoring/aws//modules/security-hub | 1.21.0 |\n| \u003ca name=\"module_password_policy\"\u003e\u003c/a\u003e [password\\_policy](#module\\_password\\_policy) | dasmeta/modules/aws//modules/iam-account-password-policy | 2.18.0 |\n| \u003ca name=\"module_secrets\"\u003e\u003c/a\u003e [secrets](#module\\_secrets) | dasmeta/modules/aws//modules/secret | 2.18.0 |\n| \u003ca name=\"module_users\"\u003e\u003c/a\u003e [users](#module\\_users) | dasmeta/iam/aws//modules/user | 1.2.1 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_account_events_export\"\u003e\u003c/a\u003e [account\\_events\\_export](#input\\_account\\_events\\_export) | Allows to configure and stream aws account important events to specified `webhook_endpoint`, NOTE: webhook\\_endpoint is required when enabling this | \u003cpre\u003eobject({\u003cbr/\u003e    enabled          = optional(bool, false)\u003cbr/\u003e    webhook_endpoint = optional(string, null)                    # required if enabled, this is endpoint to which the events will be sent via POST request\u003cbr/\u003e    name             = optional(string, \"account-events-export\") # the identifier part used for lambda function and event bridge subscription\u003cbr/\u003e    event_bridge_bus = optional(object({\u003cbr/\u003e      create              = optional(bool, false)                                                                                                                                                                                                                                                                                                                                                                                                                                             # whether to create event bridge bus, there is default bus name 'default' what can be used without creating separate one\u003cbr/\u003e      name                = optional(string, \"default\")                                                                                                                                                                                                                                                                                                                                                                                                                                       # the bus name, default bus pre-exist and we can use it\u003cbr/\u003e      rule_pattern_source = optional(list(string), [\"aws.ec2\", \"aws.s3\", \"aws.rds\", \"aws.eks\", \"aws.sqs\", \"aws.lambda\", \"aws.iam\", \"aws.vpc\", \"custom.test\", \"aws.route53\", \"aws.cloudfront\", \"aws.acm\", \"aws.cloudwatch\", \"aws.amplify\", \"aws.health\", \"aws.securityhub\", \"aws.budgets\", \"aws.secretsmanager\", \"aws.events\", \"aws.autoscaling\", \"aws.elasticache\", \"aws.elb\", \"aws.amazonmq\", \"aws.apigateway\", \"aws.waf\", \"aws.waf-regional\", \"aws.savingsplans\", \"aws.opensearchservice\"]) # The list of aws services to capture and stream/export event, for available event sources check https://docs.aws.amazon.com/eventbridge/latest/ref/events.html\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_alarm_actions\"\u003e\u003c/a\u003e [alarm\\_actions](#input\\_alarm\\_actions) | Whether to enable/create regional(TODO: add also us-east-1 region alarm also for health-check alarms) SNS topic/subscribers | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                  = optional(bool, false)                       # Enable/disable alarm actions module for account-level notifications\u003cbr/\u003e    topic_name               = optional(string, \"account-alarms-handling\") # SNS topic name for account alarms. If empty, defaults to \"account-alarms-handling\"\u003cbr/\u003e    enable_dead_letter_queue = optional(bool, false)                       # Whether to enable dead letter queue (SQS) for failed Lambda invocations\u003cbr/\u003e    email_addresses          = optional(list(string), [])                  # List of email addresses to receive alarm notifications\u003cbr/\u003e    phone_numbers            = optional(list(string), [])                  # List of international formatted phone numbers (e.g., \"+1234567890\") to receive SMS notifications\u003cbr/\u003e    web_endpoints            = optional(list(string), [])                  # List of webhook endpoints (e.g., Opsgenie, PagerDuty) to receive HTTP POST notifications\u003cbr/\u003e    lambda_arns              = optional(list(string), [])                  # List of Lambda function ARNs to invoke when alarms are triggered. Note: Lambda functions must be in the same region as the SNS topic\u003cbr/\u003e    teams_webhooks           = optional(list(string), [])                  # List of Microsoft Teams webhook URLs for sending notifications to Teams channels\u003cbr/\u003e    log_group_retention_days = optional(number, 7)                         # Number of days to retain CloudWatch Logs for Lambda functions (default: 7 days)\u003cbr/\u003e    slack_webhooks = optional(list(object({                                # List of Slack webhook configurations for sending notifications to Slack channels\u003cbr/\u003e      hook_url = string                                                    # Slack webhook URL\u003cbr/\u003e      channel  = string                                                    # Slack channel name (e.g., \"#alerts\")\u003cbr/\u003e      username = string                                                    # Bot username for Slack messages\u003cbr/\u003e    })), [])\u003cbr/\u003e    servicenow_webhooks = optional(list(object({ # List of ServiceNow webhook configurations for creating incidents in ServiceNow\u003cbr/\u003e      domain = string                            # ServiceNow instance domain (e.g., \"yourcompany.service-now.com\")\u003cbr/\u003e      path   = string                            # API endpoint path\u003cbr/\u003e      user   = string                            # ServiceNow username\u003cbr/\u003e      pass   = string                            # ServiceNow password or API token\u003cbr/\u003e    })), [])\u003cbr/\u003e    billing_alarm = optional(object({                                                         # Allows to setup billing (cost exceeded) alarm for aws account, NOTE: you have to at first enable 'alarm_actions' and then enable this\u003cbr/\u003e      enabled                = optional(bool, false)                                          # Enable/disable billing alarm for cost monitoring\u003cbr/\u003e      name                   = optional(string, \"Account-Monthly-Budget\")                     # Name of the AWS Budget for cost monitoring\u003cbr/\u003e      limit_amount           = optional(string, \"200\")                                        # Budget limit amount (as string, e.g., \"200\")\u003cbr/\u003e      limit_unit             = optional(string, \"USD\")                                        # Budget limit unit (e.g., \"USD\")\u003cbr/\u003e      time_unit              = optional(string, \"MONTHLY\")                                    # Budget time unit: MONTHLY, QUARTERLY, or ANNUALLY\u003cbr/\u003e      time_period_start      = optional(string, \"2022-01-01_00:00\")                           # Budget start date in format YYYY-MM-DD_HH:MM\u003cbr/\u003e      time_period_end        = optional(string, \"2087-06-15_00:00\")                           # Budget end date in format YYYY-MM-DD_HH:MM\u003cbr/\u003e      thresholds             = optional(list(string), [\"40\", \"60\", \"80\", \"90\", \"100\", \"110\"]) # List of threshold percentages at which to trigger alerts (e.g., [\"40\", \"60\", \"80\"])\u003cbr/\u003e      threshold_type         = optional(string, \"PERCENTAGE\")                                 # Threshold type: PERCENTAGE or ABSOLUTE_VALUE\u003cbr/\u003e      comparison_operator    = optional(string, \"GREATER_THAN\")                               # Comparison operator: GREATER_THAN, LESS_THAN, EQUAL_TO\u003cbr/\u003e      notification_type      = optional(string, \"ACTUAL\")                                     # Notification type: ACTUAL or FORECASTED\u003cbr/\u003e      notify_email_addresses = optional(list(string), [])                                     # List of email addresses to receive billing alarm notifications\u003cbr/\u003e    }), { enabled : false })\u003cbr/\u003e    security_hub_alarms = optional(object({                           # Allows to enable security hub alarm actions, by default it will use account level sns topic for security hub alarms, if you want to use custom alarm actions, you can set use_account_topic to false and set custom_alarm_actions to a map of alarm actions or a list of alarm actions\u003cbr/\u003e      enabled           = optional(bool, false)                       # whether to enable security hub alarm actions, if false, will not create any alarm actions\u003cbr/\u003e      use_account_topic = optional(bool, true)                        # whether to use account level sns topic(and notification channels) for security hub alarms, if false, will create separate sns topic for it\u003cbr/\u003e      custom_alarm_actions = optional(object({                        # custom alarm actions to be used for security hub alarms, this get enabled when security_hub_alarms.enabled is true and security_hub_alarms.use_account_topic is false\u003cbr/\u003e        topic_name                       = optional(string, \"\")       # Takes affect if use_account_topic is false. SNS topic name. If empty and create_topic=false, will use existing topic from alarm_actions module\u003cbr/\u003e        create_topic                     = optional(bool, true)       # Takes affect if use_account_topic is false. Whether to create a new SNS topic. Set to false to reuse existing topic from alarm_actions module\u003cbr/\u003e        topic_assign_security_hub_policy = optional(bool, true)       # Whether to assign the default security hub policy to the SNS topic\u003cbr/\u003e        email_addresses                  = optional(list(string), []) # List of email addresses to receive Security Hub findings notifications\u003cbr/\u003e        fallback_email_addresses         = optional(list(string), []) # List of fallback email addresses to receive notifications when primary channels fail\u003cbr/\u003e        phone_numbers                    = optional(list(string), []) # List of international formatted phone numbers (e.g., \"+1234567890\") to receive SMS notifications\u003cbr/\u003e        fallback_phone_numbers           = optional(list(string), []) # List of fallback phone numbers for SMS notifications when primary channels fail\u003cbr/\u003e        web_endpoints                    = optional(list(string), []) # List of webhook endpoints (e.g., Opsgenie, PagerDuty) to receive HTTP POST notifications\u003cbr/\u003e        fallback_web_endpoints           = optional(list(string), []) # List of fallback webhook endpoints when primary channels fail\u003cbr/\u003e        lambda_arns                      = optional(list(string), []) # List of Lambda function ARNs to invoke when Security Hub findings are received. Note: Lambda functions must be in the same region as the SNS topic\u003cbr/\u003e        fallback_lambda_arns             = optional(list(string), []) # List of fallback Lambda function ARNs when primary channels fail\u003cbr/\u003e        slack_webhooks = optional(list(object({                       # List of Slack webhook configurations for sending notifications to Slack channels\u003cbr/\u003e          hook_url = string                                           # Slack webhook URL\u003cbr/\u003e          channel  = string                                           # Slack channel name (e.g., \"#security-alerts\")\u003cbr/\u003e          username = string                                           # Bot username for Slack messages\u003cbr/\u003e        })), [])\u003cbr/\u003e        servicenow_webhooks = optional(list(object({ # List of ServiceNow webhook configurations for creating incidents in ServiceNow\u003cbr/\u003e          domain = string                            # ServiceNow instance domain (e.g., \"yourcompany.service-now.com\")\u003cbr/\u003e          path   = string                            # API endpoint path\u003cbr/\u003e          user   = string                            # ServiceNow username\u003cbr/\u003e          pass   = string                            # ServiceNow password or API token\u003cbr/\u003e        })), [])\u003cbr/\u003e        teams_webhooks = optional(list(string), []) # List of Microsoft Teams webhook URLs for sending notifications to Teams channels\u003cbr/\u003e        jira_config = optional(list(object({        # List of Jira configurations for creating tickets for Security Hub findings\u003cbr/\u003e          url            = string                   # Jira instance URL (e.g., \"https://yourcompany.atlassian.net\")\u003cbr/\u003e          key            = string                   # Jira project key\u003cbr/\u003e          user_username  = string                   # Jira username\u003cbr/\u003e          user_api_token = string                   # Jira API token\u003cbr/\u003e        })), [])\u003cbr/\u003e        delivery_policy          = optional(any, null)      # SNS topic delivery policy for retry and throttling configuration. Controls how SNS retries message delivery to endpoints\u003cbr/\u003e        policy                   = optional(any, null)      # SNS topic policy (IAM policy document) for controlling access to the topic. If null, uses default policy allowing EventBridge to publish\u003cbr/\u003e        log_group_retention_days = optional(number, 7)      # Number of days to retain CloudWatch Logs for Lambda functions (default: 7 days)\u003cbr/\u003e        enable_dead_letter_queue = optional(bool, true)     # Whether to enable dead letter queue (SQS) for failed Lambda invocations\u003cbr/\u003e        recreate_missing_package = optional(bool, true)     # Whether to recreate missing Lambda deployment packages if they are missing locally\u003cbr/\u003e        log_level                = optional(string, \"INFO\") # Log level for Lambda functions (\"DEBUG\", \"INFO\", \"WARNING\", \"ERROR\")\u003cbr/\u003e        lambda_failed_alert = optional(any, {               # CloudWatch alarm configuration for monitoring Lambda function failures. Triggers when Lambda functions fail to process notifications\u003cbr/\u003e          period    = 60                                    # Evaluation period in seconds\u003cbr/\u003e          threshold = 1                                     # Number of failures to trigger alarm\u003cbr/\u003e          equation  = \"gte\"                                 # Comparison operator (greater than or equal)\u003cbr/\u003e          statistic = \"sum\"                                 # Statistic type (sum, average, etc.)\u003cbr/\u003e        })\u003cbr/\u003e      }), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"billing_alarm\": {\u003cbr/\u003e    \"enabled\": false\u003cbr/\u003e  },\u003cbr/\u003e  \"enabled\": false,\u003cbr/\u003e  \"security_hub_alarms\": {\u003cbr/\u003e    \"enabled\": false\u003cbr/\u003e  }\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_alarm_actions_virginia\"\u003e\u003c/a\u003e [alarm\\_actions\\_virginia](#input\\_alarm\\_actions\\_virginia) | Whether to enable/create regional(TODO: add also us-east-1 region alarm also for health-check alarms) SNS topic/subscribers | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                  = optional(bool, false)\u003cbr/\u003e    topic_name               = optional(string, \"account-alarms-handling\")\u003cbr/\u003e    enable_dead_letter_queue = optional(bool, false)\u003cbr/\u003e    email_addresses          = optional(list(string), [])\u003cbr/\u003e    phone_numbers            = optional(list(string), [])\u003cbr/\u003e    web_endpoints            = optional(list(string), [])\u003cbr/\u003e    lambda_arns              = optional(list(string), [])\u003cbr/\u003e    teams_webhooks           = optional(list(string), [])\u003cbr/\u003e    log_group_retention_days = optional(number, 7)\u003cbr/\u003e    slack_webhooks = optional(list(object({\u003cbr/\u003e      hook_url = string\u003cbr/\u003e      channel  = string\u003cbr/\u003e      username = string\u003cbr/\u003e    })), [])\u003cbr/\u003e    servicenow_webhooks = optional(list(object({\u003cbr/\u003e      domain = string\u003cbr/\u003e      path   = string\u003cbr/\u003e      user   = string\u003cbr/\u003e      pass   = string\u003cbr/\u003e    })), [])\u003cbr/\u003e    billing_alarm = optional(object({ # Allows to setup billing (cost exceeded) alarm for aws account, NOTE: you have to at first enable 'alarm_actions' and then enable this\u003cbr/\u003e      enabled                = optional(bool, false)\u003cbr/\u003e      name                   = optional(string, \"Account-Monthly-Budget\")\u003cbr/\u003e      limit_amount           = optional(string, \"200\")\u003cbr/\u003e      limit_unit             = optional(string, \"USD\")\u003cbr/\u003e      time_unit              = optional(string, \"MONTHLY\")\u003cbr/\u003e      time_period_start      = optional(string, \"2022-01-01_00:00\")\u003cbr/\u003e      time_period_end        = optional(string, \"2087-06-15_00:00\")\u003cbr/\u003e      threshold              = optional(string, \"200\")\u003cbr/\u003e      threshold_type         = optional(string, \"PERCENTAGE\")\u003cbr/\u003e      comparison_operator    = optional(string, \"GREATER_THAN\")\u003cbr/\u003e      notification_type      = optional(string, \"ACTUAL\")\u003cbr/\u003e      notify_email_addresses = optional(list(string), [])\u003cbr/\u003e    }), { enabled : false })\u003cbr/\u003e    security_hub_alarms = optional(object({ # Allows to enable security hub for aws account, create separate sns topic for it and setup opsgenie subscriber.\u003cbr/\u003e      enabled                                = optional(bool, false)\u003cbr/\u003e      opsgenie_webhook                       = optional(string, null)\u003cbr/\u003e      securityhub_action_target_name         = optional(string, \"Send-to-SNS\")\u003cbr/\u003e      sns_topic_name                         = optional(string, \"Send-to-Opsgenie\")\u003cbr/\u003e      protocol                               = optional(string, \"https\")\u003cbr/\u003e      link_mode                              = optional(string, \"ALL_REGIONS\")\u003cbr/\u003e      enable_security_hub                    = optional(bool, true) # not confuse with enabled option, this one is for setting \"false\" in case when aws security hub service already enabled\u003cbr/\u003e      enable_security_hub_finding_aggregator = optional(bool, true)\u003cbr/\u003e    }), { enabled : false })\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"billing_alarm\": {\u003cbr/\u003e    \"enabled\": false\u003cbr/\u003e  },\u003cbr/\u003e  \"enabled\": false,\u003cbr/\u003e  \"security_hub_alarms\": {\u003cbr/\u003e    \"enabled\": false\u003cbr/\u003e  }\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_buckets\"\u003e\u003c/a\u003e [buckets](#input\\_buckets) | List of buckets | \u003cpre\u003elist(object({\u003cbr/\u003e    name                    = string\u003cbr/\u003e    acl                     = optional(string, \"private\") # the bucket acl which cant be null in new s3 module\u003cbr/\u003e    ignore_public_acls      = optional(bool, true)\u003cbr/\u003e    restrict_public_buckets = optional(bool, true)\u003cbr/\u003e    block_public_acls       = optional(bool, true)\u003cbr/\u003e    block_public_policy     = optional(bool, true)\u003cbr/\u003e    versioning              = optional(map(string), { enabled = true })\u003cbr/\u003e    website                 = optional(map(string), {})\u003cbr/\u003e    create_index_html       = optional(bool, false)\u003cbr/\u003e    create_iam_user         = optional(bool, false)\u003cbr/\u003e    bucket_files            = optional(object({ path = string }), { path = \"\" })\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_cloudtrail\"\u003e\u003c/a\u003e [cloudtrail](#input\\_cloudtrail) | Cloudtrail configuration | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                          = optional(bool, false)\u003cbr/\u003e    enable_cloudwatch_logs           = optional(bool, false)\u003cbr/\u003e    name                             = optional(string, \"audit\") # Name of CloudTrail\u003cbr/\u003e    bucket_name                      = optional(string, \"\")      # Whether to create new fresh bucket or use existing one, if set non empty it will use existing one with provided name\u003cbr/\u003e    create_s3_bucket                 = optional(bool, true)\u003cbr/\u003e    include_global_service_events    = optional(bool, true)   # Specifies whether the trail is publishing events from global services such as IAM to the log files\u003cbr/\u003e    enable_log_file_validation       = optional(bool, true)   # Specifies whether log file integrity validation is enabled. Creates signed digest for validated contents of logs\u003cbr/\u003e    is_organization_trail            = optional(bool, true)   # The trail is an AWS Organizations trail\u003cbr/\u003e    is_multi_region_trail            = optional(bool, true)   # Specifies whether the trail is created in the current region or in all regions\u003cbr/\u003e    cloud_watch_logs_group_arn       = optional(string, \"\")   # Specifies a log group name using an Amazon Resource Name (ARN), that represents the log group to which CloudTrail logs will be delivered\u003cbr/\u003e    cloud_watch_logs_role_arn        = optional(string, \"\")   # Specifies the role for the CloudWatch Logs endpoint to assume to write to a user’s log group\u003cbr/\u003e    cloud_watch_logs_group_retention = optional(number, 90)   # Specifies the number of days you want to retain log events in the specified log group.\u003cbr/\u003e    enable_logging                   = optional(bool, true)   # Enable logging for the trail\u003cbr/\u003e    sns_topic_name                   = optional(string, null) # Specifies the name of the Amazon SNS topic defined for notification of log file delivery\u003cbr/\u003e    event_selector = optional(list(object({                   # Specifies an event selector for enabling data event logging. See: https://www.terraform.io/docs/providers/aws/r/cloudtrail.html for details on this variable\u003cbr/\u003e      include_management_events = bool\u003cbr/\u003e      read_write_type           = string\u003cbr/\u003e\u003cbr/\u003e      data_resource = list(object({\u003cbr/\u003e        type   = string\u003cbr/\u003e        values = list(string)\u003cbr/\u003e      }))\u003cbr/\u003e    })), [])\u003cbr/\u003e    insight_selectors = optional(list(string), [])\u003cbr/\u003e    alerts_events     = optional(list(string), [\"iam-user-creation-or-deletion\"]) # Some possible values are: iam-user-creation-or-deletion, iam-role-creation-or-deletion, iam-policy-changes, s3-creation-or-deletion, root-account-usage, elastic-ip-association-and-disassociation and etc.\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"enabled\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_cost_report_export\"\u003e\u003c/a\u003e [cost\\_report\\_export](#input\\_cost\\_report\\_export) | Allows to configure and get cost report of previous day to specified `webhook_endpoint`, NOTE: webhook\\_endpoint is required when enabling this | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                = optional(bool, false)\u003cbr/\u003e    webhook_endpoint       = optional(string, null)                  # required if enabled, this is endpoint to which the report will be sent via POST request\u003cbr/\u003e    name                   = optional(string, \"account-cost-report\") # the identifier part used for lambda function and event bridge cronjob schedule namings\u003cbr/\u003e    logs_retention_in_days = optional(number, 7)                     # the retention days of logs in cloudwatch for lambda function which sent cost data to webhook endpoint\u003cbr/\u003e    event_bridge_bus = optional(object({\u003cbr/\u003e      create   = optional(bool, false)                 # whether to create event bridge bus, there is default bus name 'default' what can be used without creating separate one\u003cbr/\u003e      name     = optional(string, \"default\")           # the bus name, default bus pre-exist and we can use it\u003cbr/\u003e      schedule = optional(string, \"cron(0 5 * * ? *)\") # schedule to collect cost data, by default we use once a day at 05:00 AM UTC schedule to collect previous day data 'cron(0 5 * * ? *)'\u003cbr/\u003e      timezone = optional(string, \"Europe/London\")\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_create_cloudwatch_log_role\"\u003e\u003c/a\u003e [create\\_cloudwatch\\_log\\_role](#input\\_create\\_cloudwatch\\_log\\_role) | This is an account level configuration which creates IAM role with policy allowing cloudwatch sync/push logs into cloudwatch | `bool` | `false` | no |\n| \u003ca name=\"input_enforce_mfa\"\u003e\u003c/a\u003e [enforce\\_mfa](#input\\_enforce\\_mfa) | MFA related configs, set the name for enforce MFA IAM user group value to null if you want this group to not be created | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                           = optional(bool, true) # whether to create enforce mfa iam group\u003cbr/\u003e    group_name                        = optional(string, \"enforce-mfa\")\u003cbr/\u003e    policy_name                       = optional(string, \"mfa-enforce-policy\")\u003cbr/\u003e    manage_own_signing_certificates   = optional(bool, true)\u003cbr/\u003e    manage_own_ssh_public_keys        = optional(bool, true)\u003cbr/\u003e    manage_own_git_credentials        = optional(bool, true)\u003cbr/\u003e    attach_iam_self_management_policy = optional(bool, false)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_groups\"\u003e\u003c/a\u003e [groups](#input\\_groups) | n/a | \u003cpre\u003elist(object({\u003cbr/\u003e    name                              = string\u003cbr/\u003e    custom_group_policies             = optional(list(map(string)), [])\u003cbr/\u003e    custom_group_policy_arns          = optional(list(string), [])\u003cbr/\u003e    attach_iam_self_management_policy = optional(bool, false)\u003cbr/\u003e    users                             = optional(list(string), [])\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_password_policy\"\u003e\u003c/a\u003e [password\\_policy](#input\\_password\\_policy) | Allows to create/set aws iam users password policy for better security | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                        = optional(bool, true)\u003cbr/\u003e    allow_users_to_change_password = optional(bool, true)\u003cbr/\u003e    minimum_password_length        = optional(number, 16)\u003cbr/\u003e    require_lowercase_characters   = optional(bool, true)\u003cbr/\u003e    require_numbers                = optional(bool, true)\u003cbr/\u003e    require_symbols                = optional(bool, true)\u003cbr/\u003e    require_uppercase_characters   = optional(bool, true)\u003cbr/\u003e    max_password_age               = optional(number, 90)\u003cbr/\u003e    hard_expiry                    = optional(bool, false)\u003cbr/\u003e    password_reuse_prevention      = optional(number, 5)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_secrets\"\u003e\u003c/a\u003e [secrets](#input\\_secrets) | Allows to create account level aws secret manager secret for storing global/shared secrets, which supposed can be used by all services/apps/environments | \u003cpre\u003eobject({\u003cbr/\u003e    enabled                 = optional(bool, false)\u003cbr/\u003e    name                    = optional(string, \"account\")\u003cbr/\u003e    value                   = optional(any, null)\u003cbr/\u003e    recovery_window_in_days = optional(number, 30)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_security_hub\"\u003e\u003c/a\u003e [security\\_hub](#input\\_security\\_hub) | AWS Security Hub configuration with submodules (Config, Inspector, GuardDuty, Macie) and alarm actions for findings notifications | \u003cpre\u003eobject({\u003cbr/\u003e    enabled = optional(bool, false) # Enable/disable Security Hub and its submodules\u003cbr/\u003e    name    = optional(string, \"account-security-hub\")\u003cbr/\u003e    # Security Hub configuration\u003cbr/\u003e    enable_security_hub                    = optional(bool, true)            # Whether to enable Security Hub service. Set to false if Security Hub is already enabled\u003cbr/\u003e    enable_security_hub_finding_aggregator = optional(bool, true)            # Whether to enable Security Hub finding aggregator for multi-region/account aggregation\u003cbr/\u003e    link_mode                              = optional(string, \"ALL_REGIONS\") # Linking mode for finding aggregator: ALL_REGIONS, SPECIFIED_REGIONS, or ALL\u003cbr/\u003e    specified_regions                      = optional(list(string), [])      # List of regions for SPECIFIED_REGIONS link mode\u003cbr/\u003e    enabled_standards = optional(set(string), [                              # Security Hub standards to enable. Available standards:\u003cbr/\u003e      \"aws-foundational-security-best-practices/v/1.0.0\",                    # AWS Foundational Security Best Practices v1.0.0 (default)\u003cbr/\u003e      \"cis-aws-foundations-benchmark/v/1.2.0\"                                # CIS AWS Foundations Benchmark v1.2.0 (default)\u003cbr/\u003e      # \"cis-aws-foundations-benchmark/v/1.4.0\"                             # CIS AWS Foundations Benchmark v1.4.0\u003cbr/\u003e      # \"cis-aws-foundations-benchmark/v/3.0.0\"                             # CIS AWS Foundations Benchmark v3.0.0\u003cbr/\u003e      # \"cis-aws-foundations-benchmark/v/5.0.0\"                             # CIS AWS Foundations Benchmark v5.0.0\u003cbr/\u003e      # \"aws-resource-tagging-standard/v/1.0.0\"                             # AWS Resource Tagging Standard v1.0.0\u003cbr/\u003e      # \"nist-800-171-rev2/v/1.0.0\"                                         # NIST Special Publication 800-171 Revision 2\u003cbr/\u003e      # \"nist-800-53-rev5/v/1.0.0\"                                          # NIST Special Publication 800-53 Revision 5\u003cbr/\u003e      # \"pci-dss/v/3.2.1\"                                                   # PCI DSS v3.2.1\u003cbr/\u003e      # \"pci-dss/v/4.0.1\"                                                   # PCI DSS v4.0.1\u003cbr/\u003e    ])\u003cbr/\u003e    action_target_name  = optional(string, \"SendNotification\") # Name of the Security Hub action target for manual triggers\u003cbr/\u003e    securityhub_members = optional(map(string), {})            # Map of email -\u003e account_id for Security Hub member accounts\u003cbr/\u003e    # AWS Config submodule configuration\u003cbr/\u003e    config = optional(object({\u003cbr/\u003e      enabled                    = optional(bool, true)                 # Enable/disable AWS Config. REQUIRED for Security Hub standards to work properly\u003cbr/\u003e      create_service_linked_role = optional(bool, true)                 # Whether to create the AWS Config service-linked role. Set to false if the role already exists\u003cbr/\u003e      record_all_resources       = optional(bool, true)                 # Record all supported resource types in AWS Config\u003cbr/\u003e      include_global_resources   = optional(bool, true)                 # Include global resources (IAM, etc.) in AWS Config recording\u003cbr/\u003e      s3_bucket_name             = optional(string, \"\")                 # S3 bucket name for AWS Config. If empty, a bucket will be created automatically\u003cbr/\u003e      s3_bucket_force_destroy    = optional(bool, false)                # Force destroy S3 bucket for Config when deleting the module\u003cbr/\u003e      delivery_frequency         = optional(string, \"TwentyFour_Hours\") # Frequency for Config snapshot delivery\u003cbr/\u003e      included_resource_types    = optional(list(string), [])           # List of resource types to include when record_all_resources is false\u003cbr/\u003e      excluded_resource_types    = optional(list(string), [])           # List of resource types to exclude when record_all_resources is true\u003cbr/\u003e      rules = optional(map(object({                                     # Map of Config rules to create\u003cbr/\u003e        description = optional(string)\u003cbr/\u003e        source = optional(object({\u003cbr/\u003e          owner             = string\u003cbr/\u003e          source_identifier = string\u003cbr/\u003e          source_detail = optional(list(object({\u003cbr/\u003e            event_source                = optional(string)\u003cbr/\u003e            maximum_execution_frequency = optional(string)\u003cbr/\u003e            message_type                = optional(string)\u003cbr/\u003e          })))\u003cbr/\u003e        }))\u003cbr/\u003e        scope = optional(object({\u003cbr/\u003e          compliance_resource_types = optional(list(string))\u003cbr/\u003e          compliance_resource_id    = optional(string)\u003cbr/\u003e          tag_key                   = optional(string)\u003cbr/\u003e          tag_value                 = optional(string)\u003cbr/\u003e        }))\u003cbr/\u003e        input_parameters = optional(string)\u003cbr/\u003e        tags             = optional(map(string))\u003cbr/\u003e      })), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e    # AWS Inspector submodule configuration\u003cbr/\u003e    inspector = optional(object({\u003cbr/\u003e      enabled        = optional(bool, true)                                            # Enable/disable AWS Inspector v2. RECOMMENDED for EC2/EKS vulnerability scanning\u003cbr/\u003e      resource_types = optional(list(string), [\"EC2\", \"ECR\", \"LAMBDA\", \"LAMBDA_CODE\"]) # Resource types to enable Inspector for. Valid values: EC2, ECR, LAMBDA, LAMBDA_CODE, CODE_REPOSITORY. LAMBDA scans Lambda function configuration (runtime, permissions). LAMBDA_CODE scans Lambda function code (dependencies, vulnerabilities). Both are recommended for comprehensive Lambda scanning\u003cbr/\u003e      filters = optional(map(object({                                                  # Map of findings filters to create. Key is the filter name. If empty, no filters will be created\u003cbr/\u003e        description   = optional(string)                                               # Filter description\u003cbr/\u003e        filter_action = string                                                         # Filter action. Valid values: ARCHIVE (suppress findings), NOOP (no action)\u003cbr/\u003e        filter_criteria = optional(object({                                            # Filter criteria for matching findings\u003cbr/\u003e          aws_account_id = optional(object({                                           # Filter by AWS account ID\u003cbr/\u003e            comparison = string                                                        # Comparison operator (EQUALS, PREFIX, NOT_EQUALS)\u003cbr/\u003e            value      = string                                                        # Account ID value\u003cbr/\u003e          }))\u003cbr/\u003e          component_id = optional(object({ # Filter by component ID\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          component_type = optional(object({ # Filter by component type\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          ec2_instance_image_id = optional(object({ # Filter by EC2 instance AMI ID\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          ec2_instance_subnet_id = optional(object({ # Filter by EC2 instance subnet ID\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          ec2_instance_vpc_id = optional(object({ # Filter by EC2 instance VPC ID\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          ecr_image_pushed_at = optional(object({ # Filter by ECR image push date/time\u003cbr/\u003e            end_inclusive   = optional(string)    # End date (ISO 8601 format)\u003cbr/\u003e            start_inclusive = optional(string)    # Start date (ISO 8601 format)\u003cbr/\u003e          }))\u003cbr/\u003e          ecr_image_tags = optional(object({ # Filter by ECR image tags\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          ecr_image_hash = optional(object({ # Filter by ECR image hash\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          finding_arn = optional(object({ # Filter by finding ARN\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          finding_status = optional(object({ # Filter by finding status (ACTIVE, SUPPRESSED, CLOSED)\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          finding_type = optional(object({ # Filter by finding type\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          first_observed_at = optional(object({ # Filter by first observation date/time\u003cbr/\u003e            end_inclusive   = optional(string)  # End date (ISO 8601 format)\u003cbr/\u003e            start_inclusive = optional(string)  # Start date (ISO 8601 format)\u003cbr/\u003e          }))\u003cbr/\u003e          inspector_score = optional(object({  # Filter by Inspector score range\u003cbr/\u003e            lower_inclusive = optional(number) # Minimum score (0-10)\u003cbr/\u003e            upper_inclusive = optional(number) # Maximum score (0-10)\u003cbr/\u003e          }))\u003cbr/\u003e          last_observed_at = optional(object({ # Filter by last observation date/time\u003cbr/\u003e            end_inclusive   = optional(string) # End date (ISO 8601 format)\u003cbr/\u003e            start_inclusive = optional(string) # Start date (ISO 8601 format)\u003cbr/\u003e          }))\u003cbr/\u003e          network_protocol = optional(object({ # Filter by network protocol\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          port_range = optional(object({       # Filter by port range\u003cbr/\u003e            begin_inclusive = optional(number) # Start port number\u003cbr/\u003e            end_inclusive   = optional(number) # End port number\u003cbr/\u003e          }))\u003cbr/\u003e          related_vulnerabilities = optional(object({ # Filter by related vulnerability IDs\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          resource_id = optional(object({ # Filter by resource ID\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          resource_tags = optional(object({ # Filter by resource tags\u003cbr/\u003e            comparison = string             # Comparison operator\u003cbr/\u003e            key        = string             # Tag key\u003cbr/\u003e            value      = optional(string)   # Tag value (optional)\u003cbr/\u003e          }))\u003cbr/\u003e          resource_type = optional(object({ # Filter by resource type (EC2, ECR, LAMBDA)\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          severity = optional(object({ # Filter by severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED)\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          title = optional(object({ # Filter by finding title\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          updated_at = optional(object({       # Filter by last update date/time\u003cbr/\u003e            end_inclusive   = optional(string) # End date (ISO 8601 format)\u003cbr/\u003e            start_inclusive = optional(string) # Start date (ISO 8601 format)\u003cbr/\u003e          }))\u003cbr/\u003e          vendor_severity = optional(object({ # Filter by vendor severity\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          vulnerability_id = optional(object({ # Filter by vulnerability ID (CVE ID, etc.)\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e          vulnerability_source = optional(object({ # Filter by vulnerability source\u003cbr/\u003e            comparison = string\u003cbr/\u003e            value      = string\u003cbr/\u003e          }))\u003cbr/\u003e        }))\u003cbr/\u003e      })), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e    # AWS GuardDuty submodule configuration\u003cbr/\u003e    guardduty = optional(object({\u003cbr/\u003e      enabled                      = optional(bool, false)               # Enable/disable AWS GuardDuty for threat detection\u003cbr/\u003e      finding_publishing_frequency = optional(string, \"FIFTEEN_MINUTES\") # Frequency for publishing findings: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS\u003cbr/\u003e      enable_s3_protection         = optional(bool, false)               # Enable S3 protection\u003cbr/\u003e      enable_kubernetes_protection = optional(bool, false)               # Enable Kubernetes protection\u003cbr/\u003e      enable_malware_protection    = optional(bool, false)               # Enable malware protection\u003cbr/\u003e      filters = optional(map(object({                                    # Map of GuardDuty filters to create (key is filter name)\u003cbr/\u003e        name        = string                                             # Filter name\u003cbr/\u003e        description = optional(string)\u003cbr/\u003e        action      = string              # Filter action: ARCHIVE or NOOP\u003cbr/\u003e        rank        = optional(number, 1) # Filter rank (1 is highest priority)\u003cbr/\u003e        finding_criteria = object({\u003cbr/\u003e          criterion = map(object({\u003cbr/\u003e            eq                    = optional(list(string), [])\u003cbr/\u003e            neq                   = optional(list(string), [])\u003cbr/\u003e            gt                    = optional(number)\u003cbr/\u003e            gte                   = optional(number)\u003cbr/\u003e            lt                    = optional(number)\u003cbr/\u003e            lte                   = optional(number)\u003cbr/\u003e            equals                = optional(list(string), [])\u003cbr/\u003e            not_equals            = optional(list(string), [])\u003cbr/\u003e            greater_than          = optional(number)\u003cbr/\u003e            greater_than_or_equal = optional(number)\u003cbr/\u003e            less_than             = optional(number)\u003cbr/\u003e            less_than_or_equal    = optional(number)\u003cbr/\u003e          }))\u003cbr/\u003e        })\u003cbr/\u003e      })), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e    # Amazon Macie submodule configuration\u003cbr/\u003e    macie = optional(object({\u003cbr/\u003e      enabled                      = optional(bool, false)               # Enable/disable Amazon Macie for data security\u003cbr/\u003e      finding_publishing_frequency = optional(string, \"FIFTEEN_MINUTES\") # Frequency for publishing findings: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS\u003cbr/\u003e      status                       = optional(string, \"ENABLED\")         # Macie status: ENABLED or PAUSED\u003cbr/\u003e      findings_filters = optional(map(object({                           # Map of Macie findings filters to create (key is filter name)\u003cbr/\u003e        name        = string                                             # Filter name\u003cbr/\u003e        description = optional(string)\u003cbr/\u003e        action      = string              # Filter action: ARCHIVE or NOOP\u003cbr/\u003e        position    = optional(number, 1) # Filter position (1 is highest priority)\u003cbr/\u003e        finding_criteria = object({\u003cbr/\u003e          criterion = map(object({\u003cbr/\u003e            eq                    = optional(list(string), [])\u003cbr/\u003e            neq                   = optional(list(string), [])\u003cbr/\u003e            gt                    = optional(number)\u003cbr/\u003e            gte                   = optional(number)\u003cbr/\u003e            lt                    = optional(number)\u003cbr/\u003e            lte                   = optional(number)\u003cbr/\u003e            equals                = optional(list(string), [])\u003cbr/\u003e            not_equals            = optional(list(string), [])\u003cbr/\u003e            greater_than          = optional(number)\u003cbr/\u003e            greater_than_or_equal = optional(number)\u003cbr/\u003e            less_than             = optional(number)\u003cbr/\u003e            less_than_or_equal    = optional(number)\u003cbr/\u003e          }))\u003cbr/\u003e        })\u003cbr/\u003e      })), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_users\"\u003e\u003c/a\u003e [users](#input\\_users) | List of users | \u003cpre\u003elist(object({\u003cbr/\u003e    username          = string\u003cbr/\u003e    policy_attachment = optional(list(string), [])\u003cbr/\u003e    enforce_mfa       = optional(bool, true) # whether user should be placed into enforce mfa group, note that the enforce_mfa.enabled should be set to true to have this applied\u003cbr/\u003e    create            = optional(bool, true) # whether the user should be created or not, so that existing iam user can be linked/placed into a group\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_users\"\u003e\u003c/a\u003e [users](#output\\_users) | created users data |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdasmeta%2Fterraform-aws-account","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdasmeta%2Fterraform-aws-account","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdasmeta%2Fterraform-aws-account/lists"}