An Organization That Says It Is a Billing Hierarchy, Not a Policy One
Tencent organization nodes and members. policy_type takes one value and it is Financial: what a membership grants is numbered billing permissions, not a governance boundary, and is_a_policy_boundary says false. The permissions are taken as words and written as the integers Tencent wants, and the one that moves money is asked about.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "landing_zone" {
source = "www.iac-bazaar.com/iac-bazaar/tencent-landing-zone/tencentcloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
tencent-landing-zone
An organization hierarchy with nodes and members on Tencent Cloud Organization. Works with Terraform and OpenTofu
(>= 1.6), tencentcloud provider >= 1.81, < 2.0.
This organization is a financial construct, not a policy hierarchy. policy_type takes one value and it is Financial. Arriving from AWS or Huawei expecting a governance boundary gets you a billing relationship, and the difference is invisible until somebody asks why the Deny is not working. is_a_policy_boundary says false.
The permissions are numbers and one of them moves money. Tencent documents 1 view bill, 2 check balance, 3 fund transfer, 4 combine bill, 5 issue invoice, 6 inherit discount, 7 pay on behalf. This module takes the words and writes the numbers, refuses pay_on_behalf without a payer, and asks before granting fund_transfer.
The organization itself is not created here because the provider cannot. tencentcloud_organization_instance is entirely computed - it reads the organization you are in. Create it once in the console and pass the root node id.
force_delete_account only works on members you created. Removing an invited member ends the membership and leaves the account, which is usually right and is never what destroy sounds like.
The tree is one level deep per call, because a node naming another node in the same resource block is a dependency cycle in Terraform.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
tencent-budget
A billing budget with thresholds and a scope. fee_type picks which figure is counted: COST is list price you were never going to pay, CASH ignores everything settled with vouchers and credits and reports you under budget until they run out, REAL_COST is what you pay. A budget stops nothing and stops_spending says so.
aws-control-tower
A Control Tower landing zone from a manifest the module writes: the governed regions (the only usable ones), the Security and Sandbox units, centralized logging in the log archive account you name kept a year (access logs ten) under your KMS key (the AWS-managed key by name), the audit account, Identity Center access, and the controls you map to organizational units.
alicloud-landing-zone
A Resource Directory with its folders and member accounts. Two switches decide whether it works: control policies are off until the directory enables them, so a policy written elsewhere attaches to nothing; and member deletion is off by default, which makes every account this creates permanent and terraform destroy fail on it. Both are on here.
huawei-landing-zone
An organization, its units and its accounts. enabled_policy_types is what makes a service control policy attachable at all: without it a policy is created and fails to attach, at apply, behind a clean plan, and neither console connects the two. The account email and phone are the recovery path, so an account with none is listed as an output.
azure-landing-zone-core
Management-group hierarchy, policy baseline (ALZ-aligned), centralized logging and RBAC scaffolding - the flagship enterprise starter.
gcp-project-factory
Opinionated project creation: API enablement, billing budget, default-SA lockdown, audit log sinks and baseline IAM.