account_audit.tf

resource "aws_iam_account_password_policy" "audit" {
  count    = var.aws_account_password_policy != null ? 1 : 0
  provider = aws.audit

  allow_users_to_change_password = var.aws_account_password_policy.allow_users_to_change
  max_password_age               = var.aws_account_password_policy.max_age
  minimum_password_length        = var.aws_account_password_policy.minimum_length
  password_reuse_prevention      = var.aws_account_password_policy.reuse_prevention_history
  require_lowercase_characters   = var.aws_account_password_policy.require_lowercase_characters
  require_numbers                = var.aws_account_password_policy.require_numbers
  require_symbols                = var.aws_account_password_policy.require_symbols
  require_uppercase_characters   = var.aws_account_password_policy.require_uppercase_characters
}

resource "aws_ebs_encryption_by_default" "audit" {
  provider = aws.audit

  enabled = var.aws_ebs_encryption_by_default
}

resource "aws_s3_account_public_access_block" "audit" {
  provider = aws.audit

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}