mirror of
https://github.com/ghndrx/terraform-foundation.git
synced 2026-02-10 06:45:06 +00:00
Greg Hendrickson
6136cde9bb
Enterprise-grade multi-tenant AWS cloud foundation. Modules: - GitHub OIDC for keyless CI/CD authentication - IAM account settings and security baseline - AWS Config Rules for compliance - ABAC (Attribute-Based Access Control) - SCPs (Service Control Policies) Features: - Multi-account architecture - Cost optimization patterns - Security best practices - Comprehensive documentation Tech: Terraform, AWS Organizations, IAM Identity Center
44 lines
919 B
Markdown
44 lines
919 B
Markdown
# account-baseline
|
|
|
|
Terraform module for AWS landing zone pattern.
|
|
|
|
Apply baseline security configuration to AWS accounts in a landing zone.
|
|
|
|
## Planned Features
|
|
|
|
- [ ] CloudTrail configuration (or org trail delegation)
|
|
- [ ] AWS Config (or org aggregator delegation)
|
|
- [ ] GuardDuty member enrollment
|
|
- [ ] Security Hub member enrollment
|
|
- [ ] IAM password policy
|
|
- [ ] Standard IAM roles (admin, readonly, billing)
|
|
- [ ] EBS default encryption
|
|
- [ ] S3 public access block
|
|
|
|
## Planned Usage
|
|
|
|
```hcl
|
|
module "baseline" {
|
|
source = "../modules/account-baseline"
|
|
|
|
account_name = "workload-prod"
|
|
|
|
# Delegate to org-level services
|
|
enable_cloudtrail = false
|
|
enable_config = false
|
|
|
|
# Enroll in delegated admin services
|
|
enable_guardduty = true
|
|
enable_securityhub = true
|
|
|
|
tags = local.tags
|
|
}
|
|
```
|
|
|
|
## Requirements
|
|
|
|
| Name | Version |
|
|
|------|---------|
|
|
| terraform | >= 1.5.0 |
|
|
| aws | >= 5.0 |
|