This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Reference

Variable reference, policy library, and module documentation.

This section contains low-level reference documentation for Org Kickstart.

In This Section

Source

The complete module documentation is generated from the Terraform source and available in the ModuleDocs.md file in the repository.

Policy Library

Sample policies are included in the policies/ directory of the repository:

File Type Description
DenyRootSCP.json SCP Deny use of root user in all accounts
SecurityControlsSCP.json.tftpl SCP Base security controls (requires audit_role_name)
DisableRegionsPolicy.json.tftpl SCP Restrict to approved AWS regions
DenyUnapprovedInstanceTypes.json SCP Deny non-approved EC2 instance types
DenyUnapprovedServices.json SCP Deny unapproved AWS services
SuspendedAccountsPolicy.json.tftpl SCP Deny all activity in suspended accounts
RCP_S3DataPerimeter.json.tftpl RCP Restrict S3 access to org principals
EC2ImageBPA_DCP.json Declarative Block public sharing of AMIs
EC2SnapshotBPA_DCP.json Declarative Block public sharing of EBS snapshots
EC2IMDSv2Enforce_DCP.json Declarative Enforce IMDSv2 with hop limit of 2

Policies with the .tftpl extension support Terraform template variables via policy_vars.

1 - Module Documentation

Auto-generated Terraform module reference — inputs, outputs, resources, and sub-modules.

Requirements

Name Version
terraform >= 1.0, < 2.0
aws >= 6.27.0

Providers

Name Version
aws >= 6.27.0
aws.security-account >= 6.27.0

Modules

Name Source Version
accounts ./modules/account n/a
billing_alerts ./modules/billing_alerts n/a
datatrail ./modules/datatrail n/a
declarative_policies ./modules/org_policies n/a
rcp ./modules/org_policies n/a
scp ./modules/org_policies n/a
security-services ./modules/security_services n/a
security_account ./modules/account n/a

Resources

Name Type
aws_account_alternate_contact.billing resource
aws_account_alternate_contact.operations resource
aws_account_alternate_contact.security resource
aws_account_primary_contact.primary resource
aws_budgets_budget.organization resource
aws_cloudformation_stack.account_factory resource
aws_cloudformation_stack.audit_role_payer resource
aws_cloudformation_stack.payer resource
aws_cloudformation_stack.security resource
aws_cloudformation_stack_set.audit_role resource
aws_cloudformation_stack_set_instance.audit_role resource
aws_cloudtrail.org_cloudtrail resource
aws_cloudwatch_log_group.cloudtrail resource
aws_cur_report_definition.cur_report_definition resource
aws_iam_organizations_features.org resource
aws_iam_role.cloudtrail_to_cloudwatch resource
aws_iam_role_policy.cloudtrail_to_cloudwatch resource
aws_identitystore_group.admin_group resource
aws_kms_alias.macie_key resource
aws_kms_key.macie_key resource
aws_kms_key_policy.macie_key resource
aws_organizations_account.payer resource
aws_organizations_delegated_administrator.cloudformation resource
aws_organizations_delegated_administrator.health resource
aws_organizations_delegated_administrator.securityhub resource
aws_organizations_organization.org resource
aws_organizations_organizational_unit.custom_ous resource
aws_organizations_organizational_unit.governance_ou resource
aws_organizations_organizational_unit.sandbox_ou resource
aws_organizations_organizational_unit.suspended_ou resource
aws_organizations_organizational_unit.workloads_ou resource
aws_organizations_policy.ai_policy resource
aws_organizations_policy_attachment.ai_policy_root resource
aws_ram_sharing_with_organization.enable resource
aws_s3_bucket.billing_logs resource
aws_s3_bucket.cloudtrail_bucket resource
aws_s3_bucket.declarative_policy_bucket resource
aws_s3_bucket.macie_bucket resource
aws_s3_bucket.state_bucket resource
aws_s3_bucket.vpc_flowlogs_bucket resource
aws_s3_bucket_lifecycle_configuration.billing_logs resource
aws_s3_bucket_notification.bucket_notification resource
aws_s3_bucket_ownership_controls.cloudtrail_bucket resource
aws_s3_bucket_ownership_controls.declarative_policy_bucket resource
aws_s3_bucket_ownership_controls.macie_bucket resource
aws_s3_bucket_ownership_controls.vpc_flowlogs_bucket resource
aws_s3_bucket_policy.allow_billing_logging resource
aws_s3_bucket_policy.cloudtrail_bucket_policy resource
aws_s3_bucket_policy.declarative_policy_bucket_policy resource
aws_s3_bucket_policy.macie_bucket_policy resource
aws_s3_bucket_policy.vpc_flowlogs_bucket_policy resource
aws_s3_bucket_public_access_block.billing_logs resource
aws_s3_bucket_public_access_block.cloudtrail_bucket_bpa resource
aws_s3_bucket_public_access_block.declarative_policy_bucket_bpa resource
aws_s3_bucket_public_access_block.macie_bucket_bpa resource
aws_s3_bucket_public_access_block.state_bucket resource
aws_s3_bucket_public_access_block.vpc_flowlogs_bucket_bpa resource
aws_s3_bucket_server_side_encryption_configuration.macie_bucket resource
aws_s3_bucket_server_side_encryption_configuration.state_bucket resource
aws_s3_bucket_versioning.cloudtrail_bucket resource
aws_s3_bucket_versioning.declarative_policy_bucket resource
aws_s3_bucket_versioning.macie_bucket resource
aws_s3_bucket_versioning.state_bucket resource
aws_s3_bucket_versioning.vpc_flowlogs_bucket resource
aws_s3_object.account_factory_config resource
aws_securityhub_account.payer_account resource
aws_securityhub_account.security_account resource
aws_securityhub_configuration_policy.no_enabled_standards resource
aws_securityhub_configuration_policy_association.root_ou resource
aws_securityhub_finding_aggregator.regional_aggregator resource
aws_securityhub_organization_admin_account.delegated_admin resource
aws_securityhub_organization_configuration.security_account resource
aws_sns_topic.cloudtrail_s3_notification_topic resource
aws_ssoadmin_account_assignment.payer_account_group_assignment resource
aws_ssoadmin_managed_policy_attachment.admin_policy_attachments resource
aws_ssoadmin_permission_set.admin_permission_set resource
aws_billing_service_account.main data source
aws_iam_policy_document.allow_billing_logging data source
aws_iam_policy_document.cloudtrail_bucket_policy data source
aws_iam_policy_document.cloudtrail_s3_notification_topic data source
aws_iam_policy_document.declarative_policy_bucket_policy data source
aws_iam_policy_document.macie_bucket_policy data source
aws_iam_policy_document.vpc_flowlogs_bucket_policy data source
aws_organizations_organization.org data source
aws_organizations_organizational_units.all_ous data source
aws_organizations_policies.dp_ec2 data source
aws_organizations_policies.rcps data source
aws_organizations_policies.scps data source
aws_organizations_policy.dp_ec2 data source
aws_organizations_policy.rcps data source
aws_organizations_policy.scps data source
aws_partition.current data source
aws_region.current data source
aws_regions.available data source
aws_ssoadmin_instances.identity_store data source

Inputs

Name Description Type Default Required
account_configurator Serverless Application to configure new accounts. See https://github.com/primeharbor/pht-account-configurator 
object({
    account_factory_config_file = string
    template                    = string
  })
 null no
accounts AWS accounts to provision in the organization. 
map(
    object({
      account_name    = string
      account_email   = string
      delegated_admin = optional(list(string), [])
      operations_contact = optional(object({
        name          = string
        title         = string
        email_address = string
        phone_number  = string
      }))
      primary_contact = optional(object({
        full_name          = string
        company_name       = optional(string)
        address_line_1     = string
        address_line_2     = optional(string)
        address_line_3     = optional(string)
        city               = string
        district_or_county = optional(string)
        state_or_region    = optional(string)
        postal_code        = string
        country_code       = string
        phone_number       = string
        website_url        = optional(string)
      }))
      # parent_ou_id can explicitly override the OU assignment and lookup by name.
      # parent_ou_id takes precedence over parent_ou_name
      parent_ou_name            = optional(string, “Workloads”)
      parent_ou_id              = optional(string, null)
      monthly_budget_amount     = optional(number, 0)
      budget_alert_recipients   = optional(list(string), [])
      service_control_policies  = optional(list(string), [])
      resource_control_policies = optional(list(string), [])
      declarative_policies_ec2  = optional(list(string), [])
    })
  )
 n/a yes
admin_group_name Name of the Identity Store Group with all the admin users string "AllAdmins" no
admin_permission_set_name Name of the Default Admin Permission Set to Create string "AdministratorAccess" no
audit_role_name Name of the AuditRole to deploy string "security-audit" no
audit_role_stack_set_template_url URL that points to the Audit Role Policy Template string null no
aws_service_access_principals_to_enable List of AWS service access principals to enable if they’re not part of the default set. list(string) [] no
aws_service_access_principals_to_exclude List of AWS service access principals to exclude from the default set. list(string) [] no
backend_bucket Name of the S3 bucket used for the CloudFormation stacks and Terraform state backend string n/a yes
billing_alerts Triggers for billing alerts and who should receive them. 
object({
    levels        = map(number)
    subscriptions = list(string)
  })
 null no
billing_data_bucket_name Name of the S3 Bucket for CUR reports. Set to null to disable CUR report generation. string null no
budget_defaults Default values for AWS Budgets. Some settings can be overridden in the account definition. 
object({
    alert_recipients      = optional(list(string), [])
    currency              = optional(string, “USD”)
    warning_percentage    = optional(number, 85)
    organizational_budget = optional(number, 0)
  })
 {} no
cloudtrail_bucket_name Name of the S3 Bucket to create to store CloudTrail events. Set to null to disable CloudTrail management string null no
cloudtrail_loggroup_name Name of the CloudWatch Log Group in the payer account where CloudTrail will send its events. Set to null to disable CloudTrail to CloudWatch Logs. string null no
cur_report_frequency Frequency CUR reports should be delivered (DAILY, HOURLY, MONTHLY). Set to NONE to disable string "NONE" no
datatrail Details on the DataTrails 
object({
    bucket_name      = string
    trail_name       = string
    enabled          = optional(bool, true)
    excluded_buckets = list(string)
  })
 null no
declarative_policies Map of Declarative Policies to create and attach. 
map(object({
    policy_name        = string
    policy_type        = string
    policy_description = string
    policy_json_file   = string
    policy_targets     = optional(list(string), [“Root”])
    policy_vars        = optional(map(string), {})
    do_not_attach      = optional(bool, false)
  }))
 {} no
declarative_policy_bucket_name Name of S3 Bucket for Declarative Policy Reports. Set to null to disable Declarative Policy Reports. string null no
default_close_on_deletion If set, the AWS Account will be closed when it’s removed from org-kickstart. Set this with caution. bool false no
deploy_audit_role Boolean to determine if org-kickstart should manage a Security Audit Role. Set to false to disable the creation of an Audit Role stackset. bool true no
disable_sso_management Set to true to disable creating a default Admin Permission Set in Identity Center. bool false no
global_billing_contact Billing alternate contact to be applied to all accounts. 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
global_operations_contact Default operations alternate contact to be applied to all accounts. Can be overridden in account definition. 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
global_primary_contact Default primary account owner to be applied to all accounts. Can be overridden in account definition. 
object({
    full_name          = string
    company_name       = optional(string)
    address_line_1     = string
    address_line_2     = optional(string)
    address_line_3     = optional(string)
    city               = string
    district_or_county = optional(string)
    state_or_region    = optional(string)
    postal_code        = string
    country_code       = string
    phone_number       = string
    website_url        = optional(string)
  })
 null no
global_security_contact Security alternate contact to be applied to all accounts 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
macie_bucket_name Name of the S3 Bucket to create to store Macie Findings. Set to null to skip creation string null no
manage_state_bucket Manage the S3 bucket named by backend_bucket (the bucket that holds this Terraform state) with
Terraform. The bucket must already exist (it has to, in order to run Terraform at all), so it is
adopted via an import block in the calling module rather than created. When true, Terraform
enforces versioning, public-access-block, and encryption on it. Set to false to leave the bucket
entirely outside Terraform’s management.		 bool true no
organization_name Name of the Organization. This is used for resource prefixes and general reference string n/a yes
organization_policy_types_to_exclude List of organization policy types to exclude from the default set. list(string) [] no
organization_units Map of OUs to create. 
map(
    object({
      name             = string
      is_child_of_root = optional(bool) # This is ignored, it is retained for backwards compatibility
      parent_id        = optional(string)
    })
  )
 {} no
payer_cloudformation_stacks Map of CloudFormation stacks to deploy into the payer account. Exactly one of template_file (local path relative to path.root) or template_url (S3/HTTPS URL) must be set per stack. If regions is omitted, the stack is deployed only in the base org-kickstart region. 
map(
    object({
      stack_name         = string
      template_file      = optional(string)
      template_url       = optional(string)
      regions            = optional(list(string))
      parameters         = optional(map(string), {})
      timeout_in_minutes = optional(number, 15)
      on_failure         = optional(string, “DO_NOTHING”)
    })
  )
 {} no
payer_email Root Email address for the Organization Management account string n/a yes
payer_name Name of the Organization Management account string "AWS Payer" no
resource_control_policies Map of RCPs to create and attach. 
map(
    object({
      policy_name        = string
      policy_description = string
      policy_json_file   = string
      policy_targets     = optional(list(string), [“Root”])
      policy_vars        = optional(map(string), {})
      do_not_attach      = optional(bool, false)
    })
  )
 {} no
security_account Settings for the Security Account. 
object({
    # These will move from the main module to here at some point.
    # account_name    = string
    # account_email   = string
    delegated_admin = optional(list(string), [])
    operations_contact = optional(object({
      name          = string
      title         = string
      email_address = string
      phone_number  = string
    }))
    primary_contact = optional(object({
      full_name          = string
      company_name       = optional(string)
      address_line_1     = string
      address_line_2     = optional(string)
      address_line_3     = optional(string)
      city               = string
      district_or_county = optional(string)
      state_or_region    = optional(string)
      postal_code        = string
      country_code       = string
      phone_number       = string
      website_url        = optional(string)
    }))
    monthly_budget_amount   = optional(number, 0)
    budget_alert_recipients = optional(list(string), [])
  })
 n/a yes
security_account_name Name of the Security Account string "Security Account" no
security_account_root_email Root Email address for the security account string n/a yes
security_account_stacks Map of CloudFormation stacks to deploy into the security account. Exactly one of template_file (local path relative to path.root) or template_url (S3/HTTPS URL) must be set per stack. If regions is omitted, the stack is deployed only in the base org-kickstart region. 
map(
    object({
      stack_name         = string
      template_file      = optional(string)
      template_url       = optional(string)
      regions            = optional(list(string))
      parameters         = optional(map(string), {})
      timeout_in_minutes = optional(number, 15)
      on_failure         = optional(string, “DO_NOTHING”)
    })
  )
 {} no
security_services Explicitly disable or not manage a security service 
object({
    disable_guardduty   = optional(bool, false)
    disable_macie       = optional(bool, false)
    disable_inspector   = optional(bool, false)
    disable_securityhub = optional(bool, false)
    disable_stacksets   = optional(bool, false)
  })
 n/a yes
service_control_policies Map of SCPs to create and attach. 
map(
    object({
      policy_name        = string
      policy_description = string
      policy_json_file   = string
      policy_targets     = optional(list(string), [“Root”])
      policy_vars        = optional(map(string), {})
      do_not_attach      = optional(bool, false)
    })
  )
 {} no
session_duration Admin Permission Set Session Duration string "PT8H" no
sso_instance_region Region where the AWS SSO instance is configured string "us-east-1" no
sso_start_url AWS SSO start URL (e.g., https://yourorg.awsapps.com/start) string "https://NOT-PROVIDED.awsapps.com/start" no
tag_set Default map of tags to be applied to all resources via all providers map(string) {} no
vpc_flowlogs_bucket_name Name of the S3 Bucket to create to store VPC Flow Logs. Set to null to skip creation string null no

Outputs

Name Description
account_map Map of account names (actual names, not terraform keys) to account IDs
accounts Map of account names to account IDs
cloudtrail_cloudwatch_log_group ARN of the CloudWatch Log Group that has the CloudTrail Management Events
cloudtrail_s3_notification_topic ARN of the SNS Topic that receives S3 notifications of new CloudTrail event objects.
declarative_policy_bucket S3 Bucket used to store declarative policies
macie_key_arn ARN of the KMS Key used by Macie
org_id ID of the AWS Organization
org_name Name of the AWS Organization
ou_name_to_id Map of OU Names to OU IDs
security_account_id ID of the Security Account
sso_instance_arn AWS Identity Center Instance ARN managed by org-kickstart
sso_region AWS Region where SSO Identity Center is configured
sso_role_name Name of the SSO Permission Set (role name) for admin access
sso_start_url AWS SSO start URL (e.g., https://yourorg.awsapps.com/start)

2 - Parameter Reference

All Terraform variables for the Org Kickstart module.

All configuration is passed via the organization variable (an object type) and a few top-level variables. Below are the key configuration parameters.

Top-Level Variables

Variable Type Required Description
organization object Yes Main configuration object (see below)
backend_bucket string Yes S3 bucket name for Terraform state

Organization Object

Core Identity

Parameter Type Required Description
organization_name string Yes Short name for the organization
payer_name string Yes Display name for the management account
payer_email string Yes Root email of the management account
security_account_name string Yes Display name for the security account
security_account_root_email string Yes Root email for the new security account

State Bucket

Parameter Type Default Description
manage_state_bucket bool true Manage the backend_bucket (the S3 bucket holding Terraform state) with Terraform. The bucket must already exist; it is adopted via an import block in the calling module (see examples/local-deploy/main.tf), and Terraform then enforces versioning, public-access-block, and AES256 encryption on it. It is protected with prevent_destroy. Set to false to leave the bucket unmanaged.

CloudTrail

Parameter Type Default Description
cloudtrail_bucket_name string required S3 bucket for CloudTrail logs. Set null to disable
cloudtrail_loggroup_name string "CloudTrail/DefaultLogGroup" CloudWatch Log Group name

SSO / Identity Center

Parameter Type Default Description
session_duration string "PT8H" ISO 8601 duration for SSO sessions
admin_permission_set_name string "AdministratorAccess" Name of the admin Permission Set
admin_group_name string "AllAdmins" Name of the admin Identity Center group
disable_sso_management bool false Set true to stop Terraform from managing SSO
sso_instance_region string "us-east-1" Region where the IAM Identity Center instance is configured
sso_start_url string required when SSO is managed AWS access portal URL, e.g. https://yourorg.awsapps.com/start

Audit Role

Parameter Type Default Description
deploy_audit_role bool true Deploy the cross-account audit role StackSet
audit_role_name string "security-audit" Name of the audit role in each account
audit_role_stack_set_template_url string required if deploy S3 URL to the CloudFormation template

Billing

Parameter Type Required Description
billing_data_bucket_name string Yes S3 bucket for CUR reports
cur_report_frequency string "DAILY" DAILY, HOURLY, MONTHLY, or "NONE" to disable
declarative_policy_bucket_name string Yes S3 bucket for declarative policy documents

Security Services

Configure which security services to enable/disable (each defaults to false):

security_services = {
  disable_guardduty   = false
  disable_macie       = false
  disable_inspector   = false
  disable_securityhub = false
  disable_stacksets   = false
}

Log & Findings Buckets

Parameter Type Default Description
vpc_flowlogs_bucket_name string null S3 bucket to create for VPC Flow Logs. null to skip
macie_bucket_name string null S3 bucket to create for Macie findings. null to skip

Organization Services & Policy Types

org-kickstart enables an opinionated set of AWS service-access principals and organization policy types. Adjust the defaults with:

Parameter Type Default Description
aws_service_access_principals_to_enable list(string) [] Extra service principals to enable beyond the default set
aws_service_access_principals_to_exclude list(string) [] Service principals to remove from the default set
organization_policy_types_to_exclude list(string) [] Org policy types to exclude from the default set (e.g. when a partition doesn’t support one)

Account Configurator

Optional integration with pht-account-configurator to harden new accounts on creation — see the Account Configurator guide. Set the account_configurator object, or omit it to disable:

Field Type Description
template string S3 URL of the packaged configurator CloudFormation template
account_factory_config_file string Path (relative to repo root) to the YAML config file; Terraform uploads it to the state bucket

DataTrail

Optional DataTrail (CloudTrail S3 data-event) configuration in the security account. Set the datatrail object, or omit it to disable:

Field Type Default Description
bucket_name string required S3 bucket holding the DataTrail logs
trail_name string required Name of the CloudTrail data-event trail
enabled bool true Whether the trail is enabled
excluded_buckets list(string) required S3 buckets to exclude from data-event logging

Organizational Units

Four OUs are always created: Governance, Workloads, Sandbox, Suspended. Additional OUs can be defined:

organization_units = {
  "MyOU" = {
    name             = "MyOU"
    is_child_of_root = true
  }
  "NestedOU" = {
    name         = "NestedOU"
    parent_id    = "MyOU"   # use parent OU name for direct children of custom OUs
  }
}

Accounts

Each account in the accounts map:

accounts = {
  my_account = {
    account_name          = "my-org-prod"        # AWS account display name
    account_email         = "aws+prod@example.com" # root email (must be unique)
    parent_ou_name        = "Workloads"           # OU name (or use parent_ou_id)
    monthly_budget_amount = 1000                  # optional, in USD
    delegated_admin       = ["service.amazonaws.com"]  # optional

    # Optional: override primary contact for this account
    primary_contact = {
      full_name       = "Account Owner"
      company_name    = "My Org"
      address_line_1  = "123 Main St"
      city            = "Atlanta"
      state_or_region = "GA"
      postal_code     = "30332"
      country_code    = "US"
      email_address   = "owner@example.com"
      phone_number    = "+14041234567"
    }
  }
}

The org-wide default_close_on_deletion (bool, default false) controls whether an account is closed — not just removed from the org — when it leaves org-kickstart. Use with caution.

Security Account

The security account is created and managed like a workload account, but its settings live in a dedicated required security_account block. Its name and root email come from security_account_name / security_account_root_email; everything else is optional:

security_account = {
  delegated_admin         = ["guardduty.amazonaws.com"]  # services it is delegated admin for
  monthly_budget_amount   = 100                          # optional, USD
  budget_alert_recipients = ["security@example.com"]     # optional
  # operations_contact and primary_contact may also be set (same shape as an account entry)
}

Alternate Contacts

Applied org-wide (overridable per account):

global_billing_contact = {
  name          = "Name"
  title         = "CFO"
  email_address = "billing@example.com"
  phone_number  = "+1xxxxxxxxxx"
}

global_security_contact = {
  name          = "Name"
  title         = "CISO"
  email_address = "security@example.com"
  phone_number  = "+1xxxxxxxxxx"
}

global_operations_contact = {
  name          = "Name"
  title         = "VP Engineering"
  email_address = "ops@example.com"
  phone_number  = "+1xxxxxxxxxx"
}

global_primary_contact = {
  full_name       = "Name"
  company_name    = "My Org"
  address_line_1  = "123 Main St"
  city            = "Atlanta"
  state_or_region = "GA"
  postal_code     = "30332"
  country_code    = "US"
  email_address   = "aws@example.com"
  phone_number    = "+1xxxxxxxxxx"
}

Policies

All three policy types follow the same structure:

service_control_policies = {
  my_policy = {
    policy_name        = "MyPolicy"
    policy_description = "Description"
    policy_json_file   = "policies/MyPolicy.json"
    policy_targets     = ["Workloads", "ou-xxxx-xxxxxxxx"]  # OU names or IDs
    policy_vars = {                                         # for .tftpl files
      variable_name = "value"
    }
  }
}

The same structure applies to resource_control_policies and declarative_policies (which also require policy_type = "DECLARATIVE_POLICY_EC2").

Billing Alerts

billing_alerts = {
  levels = {
    level1  = 100   # USD threshold
    level2  = 500
    oh_shit = 1000
  }
  subscriptions = ["email@example.com"]
}

budget_defaults = {
  alert_recipients      = ["email@example.com"]
  currency              = "USD"
  warning_percentage    = 80
  organizational_budget = 1000
}

Payer CloudFormation Stacks

payer_cloudformation_stacks deploys arbitrary CloudFormation stacks into the payer (management) account. It’s the right hook for things like billing notifications, payer-scoped cost-explorer alarms, or other automation that has to live in the payer because of where billing data and Organizations APIs are exposed.

Each map entry creates one stack per region listed. The Terraform resource addresses use a <key>-<region> composite, so adding a region later does not rename existing stacks.

Field Type Default Description
stack_name string required CloudFormation stack name
template_file string conditional Local path to template, relative to the caller’s path.root. Exactly one of template_file or template_url is required
template_url string conditional HTTPS/S3 URL to the template. Exactly one of template_file or template_url is required
regions list(string) base org-kickstart region Regions to deploy the stack into
parameters map(string) {} CloudFormation parameter values
timeout_in_minutes number 15 Stack create/update timeout
on_failure string "DO_NOTHING" One of DO_NOTHING, ROLLBACK, DELETE

All stacks are created with the full set of CloudFormation capabilities (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND).

payer_cloudformation_stacks = {
  billing_alerts = {
    stack_name    = "slack_billing_alerts"
    template_file = "cloudformation/slack-Template.yaml"
    regions       = ["us-east-1"]
    parameters = {
      pExecutionRate = "cron(0 09 * * ? *)"
      # JSON-valued parameters can be written as heredocs. The module
      # canonicalizes any value that parses as JSON, so multi-line
      # formatting does not cause drift on subsequent plans.
      pEventInput = <<-EOT
        {
          "threshold": "10",
          "alert_percent": "20"
        }
      EOT
      pSlackWebhookSecret = "SlackWebHook"
      pRuleState          = "ENABLED"
      pAccountDescription = "My-Payer"
    }
  }
}

Security Account Stacks

security_account_stacks is the same idea as payer_cloudformation_stacks, but the stacks are deployed into the Security Account via the OrganizationAccountAccessRole. Use it for security-scoped automation that needs to live in the delegated-admin account: Security Hub finding processors, GuardDuty event handlers, KMS keys for security data, ChatBot integrations, and similar.

Schema, defaults, composite-key behavior, capabilities, and JSON parameter canonicalization are identical to payer_cloudformation_stacks.

security_account_stacks = {
  findings_processor = {
    stack_name    = "security-findings-processor"
    template_file = "cloudformation/findings-processor-Template.yaml"
    regions       = ["us-east-1"]
    parameters = {
      pSlackWebhookSecret = "SlackWebHook"
      pSeverityThreshold  = "MEDIUM"
    }
  }
}