* 1.4.0 -- 2026-01-16

  - change AWS provider to >= 6
  - change region from name to region in locals
  - require TF 1.12+
  - policies
    - create new central policies to be used for permissionsets so they can be consistent across orgs
  - created policies
    - policies/sc-servicecatalog-t1

CHANGELOG.md

@@ -53,3 +53,12 @@
 * 1.3.2 -- 2025-02-14
   - group-assignment
     - make ldap_group happen after idc group
+
+* 1.4.0 -- 2026-01-16
+  - change AWS provider to >= 6
+  - change region from name to region in locals
+  - require TF 1.12+
+  - policies
+    - create new central policies to be used for permissionsets so they can be consistent across orgs
+  - created policies
+    - policies/sc-servicecatalog-t1

common/version.tf

@@ -1,3 +1,3 @@
 locals {
-  _module_version = "1.3.2"
+  _module_version = "1.4.0"
 }

common/versions.tf

@@ -1,9 +1,9 @@
 terraform {
+  required_version = ">= 1.12"
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.66.0"
+      version = ">= 6.0"
     }
   }
-  #  required_version = ">= 0.13"
 }

group-assignment/accounts.tf

@@ -9,14 +9,14 @@ locals {
   active_accounts_map = { for account in data.aws_organizations_organizational_unit_descendant_accounts.accounts.accounts : account.name => account if account.status == "ACTIVE" }
   active_accounts     = { for k, v in local.active_accounts_map : k => v.id }
 
-  _id_1 = ! local.org_all && length(local.org_account_names) > 0 ? [for k in local.org_account_names : lookup(local.active_accounts, k, null)] : []
-  _id_2 = ! local.org_all && length(local.org_account_ids) > 0 ? [for k in local.org_account_ids : k if contains(values(local.active_accounts), k)] : []
+  _id_1 = !local.org_all && length(local.org_account_names) > 0 ? [for k in local.org_account_names : lookup(local.active_accounts, k, null)] : []
+  _id_2 = !local.org_all && length(local.org_account_ids) > 0 ? [for k in local.org_account_ids : k if contains(values(local.active_accounts), k)] : []
 
   organizational_unit_hierarchy = length(var.organizational_unit_hierarchy) > 0 ? { for k, v in var.organizational_unit_hierarchy : k => v.self_id } : {}
 
   #  _ou_1 = ! local.org_all && length(local.organizational_unit_names) > 0 && length(var.organizational_unit_hierarchy) > 0 ? [for k, v in local.organizational_unit_names : lookup(local.organizational_unit_hierarchy, k, null)] : []
-  _ou_1 = ! local.org_all && length(local.organizational_unit_names) > 0 && length(var.organizational_unit_hierarchy) > 0 ? { for k, v in local.organizational_unit_hierarchy : k => v if contains(local.organizational_unit_names, k) } : {}
-  _ou_2 = ! local.org_all && length(var.organizational_unit_ids) > 0 && length(var.organizational_unit_hierarchy) > 0 ? { for k in var.organizational_unit_ids : k => k } : {}
+  _ou_1 = !local.org_all && length(local.organizational_unit_names) > 0 && length(var.organizational_unit_hierarchy) > 0 ? { for k, v in local.organizational_unit_hierarchy : k => v if contains(local.organizational_unit_names, k) } : {}
+  _ou_2 = !local.org_all && length(var.organizational_unit_ids) > 0 && length(var.organizational_unit_hierarchy) > 0 ? { for k in var.organizational_unit_ids : k => k } : {}
 
   #  organizational_units = distinct(compact(concat(local._ou_1, local._ou_2)))
   organizational_units = merge(local._ou_1, local._ou_2)

group-assignment/locals.tf

@@ -1,7 +1,7 @@
 locals {
   account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
   account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
-  region              = data.aws_region.current.name
+  region              = data.aws_region.current.region
   region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
 
   base_tags = {

group-assignment/outputs.tf

@@ -20,6 +20,6 @@ output "users" {
   value = {
     users              = local.users
     valid_ldap_users   = { for k, v in local.ldap_user_attributes : k => v.mail if can(v.mail) }
-    invalid_ldap_users = [for k, v in local.ldap_user_attributes : k if ! can(v.mail)]
+    invalid_ldap_users = [for k, v in local.ldap_user_attributes : k if !can(v.mail)]
   }
 }

group-assignment/users.tf

@@ -32,7 +32,7 @@ data "aws_identitystore_user" "users" {
 
 locals {
   ldap_groups_base_dn = "o=U.S. Census Bureau,c=US"
-  ldap_groups_members = distinct(flatten([for k, v in data.ldap_object.ldap_groups : [for m in jsondecode(lookup(v.attributes_json, "memberUid", "")) : m if ! startswith(m, "p-") && (m != "[DynamicDN]")]]))
+  ldap_groups_members = distinct(flatten([for k, v in data.ldap_object.ldap_groups : [for m in jsondecode(lookup(v.attributes_json, "memberUid", "")) : m if !startswith(m, "p-") && (m != "[DynamicDN]")]]))
 }
 
 data "ldap_object" "ldap_groups" {

permissionset/README.md

@@ -2,13 +2,14 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.66.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.12 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.66.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
 
 ## Modules
 

permissionset/locals.tf

@@ -1,7 +1,7 @@
 locals {
   account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
   account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
-  region              = data.aws_region.current.name
+  region              = data.aws_region.current.region
   region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
 
   base_tags = {