Account Guardrails Applied in Every Region You List, Not Just One

The IAM password policy, S3 account-wide Block Public Access and, per region, default EBS encryption, snapshot and AMI sharing blocks, IMDSv2 as the default and the serial console off. Five of these are per region, so the module covers a list. The password policy follows NIST SP 800-63-4, and the module says which settings destroying it turns back off.

This is the operations reference: version drift, dependants and neighbours. For what the module provisions, its inputs and outputs, and how to buy it, see the catalogue entry.

terraformAWSLanding Zones & Foundationsv1.0.0static-validated

Provider drift

This artifact declares no Terraform provider requirements, so there is nothing to drift. Provider freshness applies to Terraform and OpenTofu modules.

What depends on this

No reference architecture names this module, so changing it affects only configurations that reference it directly.

Nearest alternatives

Same cloud, same category. These are what you would weigh against it without changing provider.

A Budget Somebody Actually Hears About A Control Tower Landing Zone with Governed Regions, Logging Kept a Year, and Controls per Unit Cost Anomaly Alerts That Reach Somebody Organizations, OUs and Service Control Policies

The same job on other clouds

This module has no cross-cloud peer set in the catalogue, so there is no portability comparison to draw.

Installing it

module "aws_account_baseline" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-account-baseline/aws"
  version = "1.0.0"
}

A registry token is required for the download itself. Installing through the registry protocol has the two credential steps.