feat: Terraform Foundation - AWS Landing Zone

Enterprise-grade multi-tenant AWS cloud foundation.

Modules:
- GitHub OIDC for keyless CI/CD authentication
- IAM account settings and security baseline
- AWS Config Rules for compliance
- ABAC (Attribute-Based Access Control)
- SCPs (Service Control Policies)

Features:
- Multi-account architecture
- Cost optimization patterns
- Security best practices
- Comprehensive documentation

Tech: Terraform, AWS Organizations, IAM Identity Center

.checkov.yml

@@ -0,0 +1,36 @@
+# Checkov Configuration
+# Security and compliance scanning for Terraform
+# https://www.checkov.io/
+
+# Framework to scan
+framework:
+  - terraform
+
+# Directories to scan
+directory:
+  - terraform/modules
+  - live
+
+# Skip specific checks with justification
+skip-check:
+  # These are intentionally broad for template/example modules
+  - CKV_AWS_111  # IAM policy allows * in resource - needed for flexible templates
+  - CKV_AWS_355  # IAM policy document allows * - same reason
+  - CKV2_AWS_62  # S3 event notifications - not always needed
+
+# Soft fail for CI (don't block, just warn)
+soft-fail: false
+
+# Output format
+output:
+  - cli
+  - junitxml
+
+# Compact output
+compact: true
+
+# Download external modules
+download-external-modules: false
+
+# Evaluate variables
+evaluate-variables: true