Module Documentation

Auto-generated Terraform module reference — inputs, outputs, resources, and sub-modules.

Requirements

Name Version
terraform >= 1.0, < 2.0
aws >= 6.27.0

Providers

Name Version
aws >= 6.27.0
aws.security-account >= 6.27.0

Modules

Name Source Version
accounts ./modules/account n/a
billing_alerts ./modules/billing_alerts n/a
datatrail ./modules/datatrail n/a
declarative_policies ./modules/org_policies n/a
rcp ./modules/org_policies n/a
scp ./modules/org_policies n/a
security-services ./modules/security_services n/a
security_account ./modules/account n/a

Resources

Name Type
aws_account_alternate_contact.billing resource
aws_account_alternate_contact.operations resource
aws_account_alternate_contact.security resource
aws_account_primary_contact.primary resource
aws_budgets_budget.organization resource
aws_cloudformation_stack.account_factory resource
aws_cloudformation_stack.audit_role_payer resource
aws_cloudformation_stack.payer resource
aws_cloudformation_stack.security resource
aws_cloudformation_stack_set.audit_role resource
aws_cloudformation_stack_set_instance.audit_role resource
aws_cloudtrail.org_cloudtrail resource
aws_cloudwatch_log_group.cloudtrail resource
aws_cur_report_definition.cur_report_definition resource
aws_iam_organizations_features.org resource
aws_iam_role.cloudtrail_to_cloudwatch resource
aws_iam_role_policy.cloudtrail_to_cloudwatch resource
aws_identitystore_group.admin_group resource
aws_kms_alias.macie_key resource
aws_kms_key.macie_key resource
aws_kms_key_policy.macie_key resource
aws_organizations_account.payer resource
aws_organizations_delegated_administrator.cloudformation resource
aws_organizations_delegated_administrator.health resource
aws_organizations_delegated_administrator.securityhub resource
aws_organizations_organization.org resource
aws_organizations_organizational_unit.custom_ous resource
aws_organizations_organizational_unit.governance_ou resource
aws_organizations_organizational_unit.sandbox_ou resource
aws_organizations_organizational_unit.suspended_ou resource
aws_organizations_organizational_unit.workloads_ou resource
aws_organizations_policy.ai_policy resource
aws_organizations_policy_attachment.ai_policy_root resource
aws_ram_sharing_with_organization.enable resource
aws_s3_bucket.billing_logs resource
aws_s3_bucket.cloudtrail_bucket resource
aws_s3_bucket.declarative_policy_bucket resource
aws_s3_bucket.macie_bucket resource
aws_s3_bucket.state_bucket resource
aws_s3_bucket.vpc_flowlogs_bucket resource
aws_s3_bucket_lifecycle_configuration.billing_logs resource
aws_s3_bucket_notification.bucket_notification resource
aws_s3_bucket_ownership_controls.cloudtrail_bucket resource
aws_s3_bucket_ownership_controls.declarative_policy_bucket resource
aws_s3_bucket_ownership_controls.macie_bucket resource
aws_s3_bucket_ownership_controls.vpc_flowlogs_bucket resource
aws_s3_bucket_policy.allow_billing_logging resource
aws_s3_bucket_policy.cloudtrail_bucket_policy resource
aws_s3_bucket_policy.declarative_policy_bucket_policy resource
aws_s3_bucket_policy.macie_bucket_policy resource
aws_s3_bucket_policy.vpc_flowlogs_bucket_policy resource
aws_s3_bucket_public_access_block.billing_logs resource
aws_s3_bucket_public_access_block.cloudtrail_bucket_bpa resource
aws_s3_bucket_public_access_block.declarative_policy_bucket_bpa resource
aws_s3_bucket_public_access_block.macie_bucket_bpa resource
aws_s3_bucket_public_access_block.state_bucket resource
aws_s3_bucket_public_access_block.vpc_flowlogs_bucket_bpa resource
aws_s3_bucket_server_side_encryption_configuration.macie_bucket resource
aws_s3_bucket_server_side_encryption_configuration.state_bucket resource
aws_s3_bucket_versioning.cloudtrail_bucket resource
aws_s3_bucket_versioning.declarative_policy_bucket resource
aws_s3_bucket_versioning.macie_bucket resource
aws_s3_bucket_versioning.state_bucket resource
aws_s3_bucket_versioning.vpc_flowlogs_bucket resource
aws_s3_object.account_factory_config resource
aws_securityhub_account.payer_account resource
aws_securityhub_account.security_account resource
aws_securityhub_configuration_policy.no_enabled_standards resource
aws_securityhub_configuration_policy_association.root_ou resource
aws_securityhub_finding_aggregator.regional_aggregator resource
aws_securityhub_organization_admin_account.delegated_admin resource
aws_securityhub_organization_configuration.security_account resource
aws_sns_topic.cloudtrail_s3_notification_topic resource
aws_ssoadmin_account_assignment.payer_account_group_assignment resource
aws_ssoadmin_managed_policy_attachment.admin_policy_attachments resource
aws_ssoadmin_permission_set.admin_permission_set resource
aws_billing_service_account.main data source
aws_iam_policy_document.allow_billing_logging data source
aws_iam_policy_document.cloudtrail_bucket_policy data source
aws_iam_policy_document.cloudtrail_s3_notification_topic data source
aws_iam_policy_document.declarative_policy_bucket_policy data source
aws_iam_policy_document.macie_bucket_policy data source
aws_iam_policy_document.vpc_flowlogs_bucket_policy data source
aws_organizations_organization.org data source
aws_organizations_organizational_units.all_ous data source
aws_organizations_policies.dp_ec2 data source
aws_organizations_policies.rcps data source
aws_organizations_policies.scps data source
aws_organizations_policy.dp_ec2 data source
aws_organizations_policy.rcps data source
aws_organizations_policy.scps data source
aws_partition.current data source
aws_region.current data source
aws_regions.available data source
aws_ssoadmin_instances.identity_store data source

Inputs

Name Description Type Default Required
account_configurator Serverless Application to configure new accounts. See https://github.com/primeharbor/pht-account-configurator 
object({
    account_factory_config_file = string
    template                    = string
  })
 null no
accounts AWS accounts to provision in the organization. 
map(
    object({
      account_name    = string
      account_email   = string
      delegated_admin = optional(list(string), [])
      operations_contact = optional(object({
        name          = string
        title         = string
        email_address = string
        phone_number  = string
      }))
      primary_contact = optional(object({
        full_name          = string
        company_name       = optional(string)
        address_line_1     = string
        address_line_2     = optional(string)
        address_line_3     = optional(string)
        city               = string
        district_or_county = optional(string)
        state_or_region    = optional(string)
        postal_code        = string
        country_code       = string
        phone_number       = string
        website_url        = optional(string)
      }))
      # parent_ou_id can explicitly override the OU assignment and lookup by name.
      # parent_ou_id takes precedence over parent_ou_name
      parent_ou_name            = optional(string, “Workloads”)
      parent_ou_id              = optional(string, null)
      monthly_budget_amount     = optional(number, 0)
      budget_alert_recipients   = optional(list(string), [])
      service_control_policies  = optional(list(string), [])
      resource_control_policies = optional(list(string), [])
      declarative_policies_ec2  = optional(list(string), [])
    })
  )
 n/a yes
admin_group_name Name of the Identity Store Group with all the admin users string "AllAdmins" no
admin_permission_set_name Name of the Default Admin Permission Set to Create string "AdministratorAccess" no
audit_role_name Name of the AuditRole to deploy string "security-audit" no
audit_role_stack_set_template_url URL that points to the Audit Role Policy Template string null no
aws_service_access_principals_to_enable List of AWS service access principals to enable if they’re not part of the default set. list(string) [] no
aws_service_access_principals_to_exclude List of AWS service access principals to exclude from the default set. list(string) [] no
backend_bucket Name of the S3 bucket used for the CloudFormation stacks and Terraform state backend string n/a yes
billing_alerts Triggers for billing alerts and who should receive them. 
object({
    levels        = map(number)
    subscriptions = list(string)
  })
 null no
billing_data_bucket_name Name of the S3 Bucket for CUR reports. Set to null to disable CUR report generation. string null no
budget_defaults Default values for AWS Budgets. Some settings can be overridden in the account definition. 
object({
    alert_recipients      = optional(list(string), [])
    currency              = optional(string, “USD”)
    warning_percentage    = optional(number, 85)
    organizational_budget = optional(number, 0)
  })
 {} no
cloudtrail_bucket_name Name of the S3 Bucket to create to store CloudTrail events. Set to null to disable CloudTrail management string null no
cloudtrail_loggroup_name Name of the CloudWatch Log Group in the payer account where CloudTrail will send its events. Set to null to disable CloudTrail to CloudWatch Logs. string null no
cur_report_frequency Frequency CUR reports should be delivered (DAILY, HOURLY, MONTHLY). Set to NONE to disable string "NONE" no
datatrail Details on the DataTrails 
object({
    bucket_name      = string
    trail_name       = string
    enabled          = optional(bool, true)
    excluded_buckets = list(string)
  })
 null no
declarative_policies Map of Declarative Policies to create and attach. 
map(object({
    policy_name        = string
    policy_type        = string
    policy_description = string
    policy_json_file   = string
    policy_targets     = optional(list(string), [“Root”])
    policy_vars        = optional(map(string), {})
    do_not_attach      = optional(bool, false)
  }))
 {} no
declarative_policy_bucket_name Name of S3 Bucket for Declarative Policy Reports. Set to null to disable Declarative Policy Reports. string null no
default_close_on_deletion If set, the AWS Account will be closed when it’s removed from org-kickstart. Set this with caution. bool false no
deploy_audit_role Boolean to determine if org-kickstart should manage a Security Audit Role. Set to false to disable the creation of an Audit Role stackset. bool true no
disable_sso_management Set to true to disable creating a default Admin Permission Set in Identity Center. bool false no
global_billing_contact Billing alternate contact to be applied to all accounts. 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
global_operations_contact Default operations alternate contact to be applied to all accounts. Can be overridden in account definition. 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
global_primary_contact Default primary account owner to be applied to all accounts. Can be overridden in account definition. 
object({
    full_name          = string
    company_name       = optional(string)
    address_line_1     = string
    address_line_2     = optional(string)
    address_line_3     = optional(string)
    city               = string
    district_or_county = optional(string)
    state_or_region    = optional(string)
    postal_code        = string
    country_code       = string
    phone_number       = string
    website_url        = optional(string)
  })
 null no
global_security_contact Security alternate contact to be applied to all accounts 
object({
    name          = string
    title         = string
    email_address = string
    phone_number  = string
  })
 null no
macie_bucket_name Name of the S3 Bucket to create to store Macie Findings. Set to null to skip creation string null no
manage_state_bucket Manage the S3 bucket named by backend_bucket (the bucket that holds this Terraform state) with
Terraform. The bucket must already exist (it has to, in order to run Terraform at all), so it is
adopted via an import block in the calling module rather than created. When true, Terraform
enforces versioning, public-access-block, and encryption on it. Set to false to leave the bucket
entirely outside Terraform’s management.		 bool true no
organization_name Name of the Organization. This is used for resource prefixes and general reference string n/a yes
organization_policy_types_to_exclude List of organization policy types to exclude from the default set. list(string) [] no
organization_units Map of OUs to create. 
map(
    object({
      name             = string
      is_child_of_root = optional(bool) # This is ignored, it is retained for backwards compatibility
      parent_id        = optional(string)
    })
  )
 {} no
payer_cloudformation_stacks Map of CloudFormation stacks to deploy into the payer account. Exactly one of template_file (local path relative to path.root) or template_url (S3/HTTPS URL) must be set per stack. If regions is omitted, the stack is deployed only in the base org-kickstart region. 
map(
    object({
      stack_name         = string
      template_file      = optional(string)
      template_url       = optional(string)
      regions            = optional(list(string))
      parameters         = optional(map(string), {})
      timeout_in_minutes = optional(number, 15)
      on_failure         = optional(string, “DO_NOTHING”)
    })
  )
 {} no
payer_email Root Email address for the Organization Management account string n/a yes
payer_name Name of the Organization Management account string "AWS Payer" no
resource_control_policies Map of RCPs to create and attach. 
map(
    object({
      policy_name        = string
      policy_description = string
      policy_json_file   = string
      policy_targets     = optional(list(string), [“Root”])
      policy_vars        = optional(map(string), {})
      do_not_attach      = optional(bool, false)
    })
  )
 {} no
security_account Settings for the Security Account. 
object({
    # These will move from the main module to here at some point.
    # account_name    = string
    # account_email   = string
    delegated_admin = optional(list(string), [])
    operations_contact = optional(object({
      name          = string
      title         = string
      email_address = string
      phone_number  = string
    }))
    primary_contact = optional(object({
      full_name          = string
      company_name       = optional(string)
      address_line_1     = string
      address_line_2     = optional(string)
      address_line_3     = optional(string)
      city               = string
      district_or_county = optional(string)
      state_or_region    = optional(string)
      postal_code        = string
      country_code       = string
      phone_number       = string
      website_url        = optional(string)
    }))
    monthly_budget_amount   = optional(number, 0)
    budget_alert_recipients = optional(list(string), [])
  })
 n/a yes
security_account_name Name of the Security Account string "Security Account" no
security_account_root_email Root Email address for the security account string n/a yes
security_account_stacks Map of CloudFormation stacks to deploy into the security account. Exactly one of template_file (local path relative to path.root) or template_url (S3/HTTPS URL) must be set per stack. If regions is omitted, the stack is deployed only in the base org-kickstart region. 
map(
    object({
      stack_name         = string
      template_file      = optional(string)
      template_url       = optional(string)
      regions            = optional(list(string))
      parameters         = optional(map(string), {})
      timeout_in_minutes = optional(number, 15)
      on_failure         = optional(string, “DO_NOTHING”)
    })
  )
 {} no
security_services Explicitly disable or not manage a security service 
object({
    disable_guardduty   = optional(bool, false)
    disable_macie       = optional(bool, false)
    disable_inspector   = optional(bool, false)
    disable_securityhub = optional(bool, false)
    disable_stacksets   = optional(bool, false)
  })
 n/a yes
service_control_policies Map of SCPs to create and attach. 
map(
    object({
      policy_name        = string
      policy_description = string
      policy_json_file   = string
      policy_targets     = optional(list(string), [“Root”])
      policy_vars        = optional(map(string), {})
      do_not_attach      = optional(bool, false)
    })
  )
 {} no
session_duration Admin Permission Set Session Duration string "PT8H" no
sso_instance_region Region where the AWS SSO instance is configured string "us-east-1" no
sso_start_url AWS SSO start URL (e.g., https://yourorg.awsapps.com/start) string "https://NOT-PROVIDED.awsapps.com/start" no
tag_set Default map of tags to be applied to all resources via all providers map(string) {} no
vpc_flowlogs_bucket_name Name of the S3 Bucket to create to store VPC Flow Logs. Set to null to skip creation string null no

Outputs

Name Description
account_map Map of account names (actual names, not terraform keys) to account IDs
accounts Map of account names to account IDs
cloudtrail_cloudwatch_log_group ARN of the CloudWatch Log Group that has the CloudTrail Management Events
cloudtrail_s3_notification_topic ARN of the SNS Topic that receives S3 notifications of new CloudTrail event objects.
declarative_policy_bucket S3 Bucket used to store declarative policies
macie_key_arn ARN of the KMS Key used by Macie
org_id ID of the AWS Organization
org_name Name of the AWS Organization
ou_name_to_id Map of OU Names to OU IDs
security_account_id ID of the Security Account
sso_instance_arn AWS Identity Center Instance ARN managed by org-kickstart
sso_region AWS Region where SSO Identity Center is configured
sso_role_name Name of the SSO Permission Set (role name) for admin access
sso_start_url AWS SSO start URL (e.g., https://yourorg.awsapps.com/start)

Last modified June 20, 2026: site: v0.3.1 release — version menu, release notes, bump pins (b9d499c)