Account Guardrails Applied in Every Region You List, Not Just One
The IAM password policy, S3 account-wide Block Public Access and, per region, default EBS encryption, snapshot and AMI sharing blocks, IMDSv2 as the default and the serial console off. Five of these are per region, so the module covers a list. The password policy follows NIST SP 800-63-4, and the module says which settings destroying it turns back off.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-16 · how we verify
Use it from the registry
terraform · opentofumodule "account_baseline" {
source = "www.iac-bazaar.com/iac-bazaar/aws-account-baseline/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-account-baseline
Account-wide guardrails on AWS. Works with Terraform and OpenTofu
(>= 1.6), aws provider >= 6.0, < 7.0.
Five of these are per region, and a region not listed stays open. AWS documents the instance metadata defaults as configured in each Region; EBS encryption, snapshot and AMI blocking and the serial console work the same way. regions is required.
Defaults are not enforcement. AWS says the IMDS default "does not reset existing instances" and can be overridden at launch; instances still on IMDSv1 need changing one by one.
The hop limit is 2 because containers need it, as AWS recommends for container hosts.
Destroying the module undoes most of it, not all. Default EBS encryption and snapshot blocking are turned off, metadata defaults reset to no-preference, and the S3 account block and password policy are deleted; AMI blocking is left as it was. destroy_reverts lists each.
One password policy per account: applying this replaces the account's current one, including a console-set policy.
The password policy follows NIST SP 800-63-4: at least 15 characters, and NIST's "SHALL NOT" on composition rules and periodic changes, so no required character classes and no expiry by default. Both remain explicit options.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-budgets
A budget with no notification tracks correctly and tells nobody, so the invoice is the first notice; ACTUAL-only alerts arrive after the money is gone. And include_credit defaults true, so a budget on a credited account reports runway rather than spend - until the credits end and nothing crosses a threshold.
aws-control-tower
A Control Tower landing zone from a manifest the module writes: the governed regions (the only usable ones), the Security and Sandbox units, centralized logging in the log archive account you name kept a year (access logs ten) under your KMS key (the AWS-managed key by name), the audit account, Identity Center access, and the controls you map to organizational units.
aws-cost-anomaly-detection
AWS Cost Anomaly Detection with monitors and the alerts that make them useful. A monitor alone leaves anomalies in the console; AWS sends immediate alerts only over SNS and summaries only by email, so this module builds both, with a topic encrypted by a key the service may use. It needs a cost threshold, and says an account holds one AWS services monitor.
aws-organizations
The organization, its organizational units, member accounts and the service control policies attached to them. Root attachment is off by default, because an SCP sets the ceiling on what anybody may do - including the account root user who would have to undo it.