Terraform module to manage baseline configuration for AWS accounts.

module "account_baseline" {
  source = "github.com/schubergphilis/terraform-aws-mcaf-account-baseline?ref=VERSION"
}

By default, this module enables all non-default EU regions (eu-central-2, eu-south-1, eu-south-2). To actually use these regions, they must also be included in the allowed regions SCP of the mcaf-landing-zone module.

This module ensures that you can use all EU regions out of the box. If you intend to allow a region across your entire organization, the recommended approach is to also configure it as a governed region via AWS Control Tower. This ensures consistent enforcement of security, compliance, and operational guardrails.

If you would like to authorise other accounts to aggregate AWS Config data, account IDs and regions can be passed to var.aws_config using the attributes aggregator_account_ids and aggregator_regions respectively.

Note Control Tower already authorizes the audit account to aggregate Config data from all other accounts in the organization, so there is no need to specify the audit account ID in the aggregator_account_ids list.

Example:

aws_config = {
  aggregator_account_ids = ["123456789012"]
  aggregator_regions     = ["eu-west-1"]
}

This module can deploy the IAM role required by the MCAF Service Quotas Manager module. The assuming_principal_identifier should be the ServiceQuotasManagerExecutionRole. This is by default arn:aws:iam::<account_id>:role/ServiceQuotasManagerExecutionRole-<region_name>.

object({
    allow_users_to_change        = bool
    max_age                      = number
    minimum_length               = number
    require_lowercase_characters = bool
    require_numbers              = bool
    require_symbols              = bool
    require_uppercase_characters = bool
    reuse_prevention_history     = number
  })

{
  "allow_users_to_change": true,
  "max_age": 90,
  "minimum_length": 14,
  "require_lowercase_characters": true,
  "require_numbers": true,
  "require_symbols": true,
  "require_uppercase_characters": true,
  "reuse_prevention_history": 24
}

object({
    aggregator_account_ids = list(string)
    aggregator_regions     = list(string)
  })

object({
    enabled                 = optional(bool, true)
    block_public_acls       = optional(bool, true)
    block_public_policy     = optional(bool, true)
    ignore_public_acls      = optional(bool, true)
    restrict_public_buckets = optional(bool, true)
  })

[
  "us-east-1"
]

object({
    assuming_principal_identifier = string
    path                          = optional(string, "/")
    permissions_boundary          = optional(string, null)
  })

No outputs.