Start every account from one baseline

How to do it

Keep the baseline as one module that runs when an account is created. AWS Control Tower, a landing zone or your own account factory can run it. Send the audit log to a separate log account that the other accounts cannot delete from. Add the budget and the guardrails from the same module.

Example

resource "aws_s3_account_public_access_block" "baseline" {
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_ebs_encryption_by_default" "baseline" {
  enabled = true
}

resource "aws_cloudtrail" "baseline" {
  name                       = "account-audit"
  s3_bucket_name             = "example-shop-audit-logs"
  is_multi_region_trail      = true
  enable_log_file_validation = true
}

How to check

For every account in the organization, a script confirms the audit trail is on, a budget exists and account-level public access is blocked. It also confirms default disk encryption is on and a call in a region outside the list ends in AccessDenied.