diff --git a/README.md b/README.md
index f1399334..5e080429 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,7 @@ This module is composed of several submodules and each of which can be used inde
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -377,7 +377,7 @@ This module is composed of several submodules and each of which can be used inde
 | <a name="output_cloudtrail_sns_topic"></a> [cloudtrail\_sns\_topic](#output\_cloudtrail\_sns\_topic) | The sns topic linked to the cloudtrail. |
 | <a name="output_config_configuration_recorder"></a> [config\_configuration\_recorder](#output\_config\_configuration\_recorder) | The configuration recorder in each region. |
 | <a name="output_config_iam_role"></a> [config\_iam\_role](#output\_config\_iam\_role) | The IAM role used for delivering AWS Config records to CloudWatch Logs. |
-| <a name="output_config_sns_topic"></a> [config\_sns\_topic](#output\_config\_sns\_topic) | The SNS topic that AWS Config delivers notifications to. |
+| <a name="output_config_sns_topic"></a> [config\_sns\_topic](#output\_config\_sns\_topic) | The SNS topic) that AWS Config delivers notifications to. |
 | <a name="output_default_network_acl"></a> [default\_network\_acl](#output\_default\_network\_acl) | The default network ACL. |
 | <a name="output_default_route_table"></a> [default\_route\_table](#output\_default\_route\_table) | The default route table. |
 | <a name="output_default_security_group"></a> [default\_security\_group](#output\_default\_security\_group) | The ID of the default security group. |
diff --git a/analyzer_baselines.tf b/analyzer_baselines.tf
index 69a74954..69caab85 100644
--- a/analyzer_baselines.tf
+++ b/analyzer_baselines.tf
@@ -6,220 +6,221 @@ locals {
 # Analyzer Baseline
 # --------------------------------------------------------------------------------------------------
 module "analyzer_baseline_ap-northeast-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-1")
+
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ap-northeast-2" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-2") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-2")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ap-south-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-south-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-south-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ap-northeast-3" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-3") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-northeast-3")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ap-southeast-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-southeast-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-southeast-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ap-southeast-2" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ap-southeast-2") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ap-southeast-2
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ap-southeast-2")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_ca-central-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "ca-central-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "ca-central-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_eu-central-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "eu-central-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "eu-central-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_eu-north-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "eu-north-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "eu-north-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_eu-west-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_eu-west-2" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-2") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-2")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_eu-west-3" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-3") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "eu-west-3")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_sa-east-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "sa-east-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "sa-east-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_us-east-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "us-east-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "us-east-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_us-east-2" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "us-east-2") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "us-east-2")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_us-west-1" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "us-west-1") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "us-west-1")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
 }
 
 module "analyzer_baseline_us-west-2" {
+  count  = local.is_analyzer_enabled && contains(var.target_regions, "us-west-2") ? 1 : 0
   source = "./modules/analyzer-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
 
-  enabled         = local.is_analyzer_enabled && contains(var.target_regions, "us-west-2")
   analyzer_name   = var.analyzer_name
   is_organization = local.is_master_account
   tags            = var.tags
diff --git a/config_baselines.tf b/config_baselines.tf
index 68d0de2f..de3cb477 100644
--- a/config_baselines.tf
+++ b/config_baselines.tf
@@ -1,22 +1,22 @@
 locals {
   config_topics = [
-    module.config_baseline_ap-northeast-1.config_sns_topic,
-    module.config_baseline_ap-northeast-2.config_sns_topic,
-    module.config_baseline_ap-northeast-3.config_sns_topic,
-    module.config_baseline_ap-south-1.config_sns_topic,
-    module.config_baseline_ap-southeast-1.config_sns_topic,
-    module.config_baseline_ap-southeast-2.config_sns_topic,
-    module.config_baseline_ca-central-1.config_sns_topic,
-    module.config_baseline_eu-central-1.config_sns_topic,
-    module.config_baseline_eu-north-1.config_sns_topic,
-    module.config_baseline_eu-west-1.config_sns_topic,
-    module.config_baseline_eu-west-2.config_sns_topic,
-    module.config_baseline_eu-west-3.config_sns_topic,
-    module.config_baseline_sa-east-1.config_sns_topic,
-    module.config_baseline_us-east-1.config_sns_topic,
-    module.config_baseline_us-east-2.config_sns_topic,
-    module.config_baseline_us-west-1.config_sns_topic,
-    module.config_baseline_us-west-2.config_sns_topic,
+    one(module.config_baseline_ap-northeast-1[*].config_sns_topic),
+    one(module.config_baseline_ap-northeast-2[*].config_sns_topic),
+    one(module.config_baseline_ap-northeast-3[*].config_sns_topic),
+    one(module.config_baseline_ap-south-1[*].config_sns_topic),
+    one(module.config_baseline_ap-southeast-1[*].config_sns_topic),
+    one(module.config_baseline_ap-southeast-2[*].config_sns_topic),
+    one(module.config_baseline_ca-central-1[*].config_sns_topic),
+    one(module.config_baseline_eu-central-1[*].config_sns_topic),
+    one(module.config_baseline_eu-north-1[*].config_sns_topic),
+    one(module.config_baseline_eu-west-1[*].config_sns_topic),
+    one(module.config_baseline_eu-west-2[*].config_sns_topic),
+    one(module.config_baseline_eu-west-3[*].config_sns_topic),
+    one(module.config_baseline_sa-east-1[*].config_sns_topic),
+    one(module.config_baseline_us-east-1[*].config_sns_topic),
+    one(module.config_baseline_us-east-2[*].config_sns_topic),
+    one(module.config_baseline_us-west-1[*].config_sns_topic),
+    one(module.config_baseline_us-west-2[*].config_sns_topic),
   ]
 }
 
@@ -92,13 +92,13 @@ resource "aws_iam_role_policy_attachment" "recorder_read_policy" {
 # Global resource types are only recorded in the region specified by var.region.
 # --------------------------------------------------------------------------------------------------
 module "config_baseline_ap-northeast-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -112,13 +112,13 @@ module "config_baseline_ap-northeast-1" {
 }
 
 module "config_baseline_ap-northeast-2" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-2") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-2")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -132,13 +132,13 @@ module "config_baseline_ap-northeast-2" {
 }
 
 module "config_baseline_ap-northeast-3" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-3") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-northeast-3")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -152,13 +152,13 @@ module "config_baseline_ap-northeast-3" {
 }
 
 module "config_baseline_ap-south-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-south-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-south-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -172,13 +172,13 @@ module "config_baseline_ap-south-1" {
 }
 
 module "config_baseline_ap-southeast-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-southeast-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-southeast-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -192,13 +192,13 @@ module "config_baseline_ap-southeast-1" {
 }
 
 module "config_baseline_ap-southeast-2" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ap-southeast-2") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ap-southeast-2
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ap-southeast-2")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -212,13 +212,13 @@ module "config_baseline_ap-southeast-2" {
 }
 
 module "config_baseline_ca-central-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "ca-central-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "ca-central-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -232,13 +232,13 @@ module "config_baseline_ca-central-1" {
 }
 
 module "config_baseline_eu-central-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "eu-central-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "eu-central-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -252,13 +252,13 @@ module "config_baseline_eu-central-1" {
 }
 
 module "config_baseline_eu-north-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "eu-north-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "eu-north-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -272,13 +272,13 @@ module "config_baseline_eu-north-1" {
 }
 
 module "config_baseline_eu-west-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "eu-west-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "eu-west-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -292,13 +292,13 @@ module "config_baseline_eu-west-1" {
 }
 
 module "config_baseline_eu-west-2" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "eu-west-2") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "eu-west-2")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -312,13 +312,13 @@ module "config_baseline_eu-west-2" {
 }
 
 module "config_baseline_eu-west-3" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "eu-west-3") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "eu-west-3")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -332,13 +332,13 @@ module "config_baseline_eu-west-3" {
 }
 
 module "config_baseline_sa-east-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "sa-east-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "sa-east-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -352,13 +352,13 @@ module "config_baseline_sa-east-1" {
 }
 
 module "config_baseline_us-east-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "us-east-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "us-east-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -372,13 +372,13 @@ module "config_baseline_us-east-1" {
 }
 
 module "config_baseline_us-east-2" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "us-east-2") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "us-east-2")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -392,13 +392,13 @@ module "config_baseline_us-east-2" {
 }
 
 module "config_baseline_us-west-1" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "us-west-1") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "us-west-1")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
@@ -412,13 +412,13 @@ module "config_baseline_us-west-1" {
 }
 
 module "config_baseline_us-west-2" {
+  count  = var.config_baseline_enabled && contains(var.target_regions, "us-west-2") ? 1 : 0
   source = "./modules/config-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
 
-  enabled                       = var.config_baseline_enabled && contains(var.target_regions, "us-west-2")
   iam_role_arn                  = one(aws_iam_role.recorder[*].arn)
   s3_bucket_name                = local.audit_log_bucket_id
   s3_key_prefix                 = var.config_s3_bucket_key_prefix
diff --git a/ebs_baselines.tf b/ebs_baselines.tf
index 2a3ec0c3..51091ab5 100644
--- a/ebs_baselines.tf
+++ b/ebs_baselines.tf
@@ -2,170 +2,154 @@
 # SecurityHub Baseline
 # --------------------------------------------------------------------------------------------------
 module "ebs_baseline_ap-northeast-1" {
+  count  = contains(var.target_regions, "ap-northeast-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
-  enabled = contains(var.target_regions, "ap-northeast-1")
 }
 
 module "ebs_baseline_ap-northeast-2" {
+  count  = contains(var.target_regions, "ap-northeast-2") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
-
-  enabled = contains(var.target_regions, "ap-northeast-2")
 }
 
 module "ebs_baseline_ap-northeast-3" {
+  count  = contains(var.target_regions, "ap-northeast-3") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
-
-  enabled = contains(var.target_regions, "ap-northeast-3")
 }
 
 module "ebs_baseline_ap-south-1" {
+  count  = contains(var.target_regions, "ap-south-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
-
-  enabled = contains(var.target_regions, "ap-south-1")
 }
 
 module "ebs_baseline_ap-southeast-1" {
+  count  = contains(var.target_regions, "ap-southeast-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
-
-  enabled = contains(var.target_regions, "ap-southeast-1")
 }
 
 module "ebs_baseline_ap-southeast-2" {
+  count  = contains(var.target_regions, "ap-southeast-2") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ap-southeast-2
   }
-
-  enabled = contains(var.target_regions, "ap-southeast-2")
 }
 
 module "ebs_baseline_ca-central-1" {
+  count  = contains(var.target_regions, "ca-central-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
-
-  enabled = contains(var.target_regions, "ca-central-1")
 }
 
 module "ebs_baseline_eu-central-1" {
+  count  = contains(var.target_regions, "eu-central-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
-
-  enabled = contains(var.target_regions, "eu-central-1")
 }
 
 module "ebs_baseline_eu-north-1" {
+  count  = contains(var.target_regions, "eu-north-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
-
-  enabled = contains(var.target_regions, "eu-north-1")
 }
 
 module "ebs_baseline_eu-west-1" {
+  count  = contains(var.target_regions, "eu-west-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
-
-  enabled = contains(var.target_regions, "eu-west-1")
 }
 
 module "ebs_baseline_eu-west-2" {
+  count  = contains(var.target_regions, "eu-west-2") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
-
-  enabled = contains(var.target_regions, "eu-west-2")
 }
 
 module "ebs_baseline_eu-west-3" {
+  count  = contains(var.target_regions, "eu-west-3") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
-
-  enabled = contains(var.target_regions, "eu-west-3")
 }
 
 module "ebs_baseline_sa-east-1" {
+  count  = contains(var.target_regions, "sa-east-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
-
-  enabled = contains(var.target_regions, "sa-east-1")
 }
 
 module "ebs_baseline_us-east-1" {
+  count  = contains(var.target_regions, "us-east-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
-
-  enabled = contains(var.target_regions, "us-east-1")
 }
 
 module "ebs_baseline_us-east-2" {
+  count  = contains(var.target_regions, "us-east-2") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
-
-  enabled = contains(var.target_regions, "us-east-2")
 }
 
 module "ebs_baseline_us-west-1" {
+  count  = contains(var.target_regions, "us-west-1") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
-
-  enabled = contains(var.target_regions, "us-west-1")
 }
 
 module "ebs_baseline_us-west-2" {
+  count  = contains(var.target_regions, "us-west-2") ? 1 : 0
   source = "./modules/ebs-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
-
-  enabled = contains(var.target_regions, "us-west-2")
 }
diff --git a/guardduty_baselines.tf b/guardduty_baselines.tf
index 24e62d91..48d2bd89 100644
--- a/guardduty_baselines.tf
+++ b/guardduty_baselines.tf
@@ -9,13 +9,13 @@ locals {
 }
 
 module "guardduty_baseline_ap-northeast-1" {
+  count  = contains(var.target_regions, "ap-northeast-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
 
-  enabled                      = contains(var.target_regions, "ap-northeast-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -26,13 +26,13 @@ module "guardduty_baseline_ap-northeast-1" {
 }
 
 module "guardduty_baseline_ap-northeast-2" {
+  count  = contains(var.target_regions, "ap-northeast-2") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
 
-  enabled                      = contains(var.target_regions, "ap-northeast-2") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -43,13 +43,13 @@ module "guardduty_baseline_ap-northeast-2" {
 }
 
 module "guardduty_baseline_ap-northeast-3" {
+  count  = contains(var.target_regions, "ap-northeast-3") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
 
-  enabled                      = contains(var.target_regions, "ap-northeast-3") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -60,13 +60,13 @@ module "guardduty_baseline_ap-northeast-3" {
 }
 
 module "guardduty_baseline_ap-south-1" {
+  count  = contains(var.target_regions, "ap-south-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
 
-  enabled                      = contains(var.target_regions, "ap-south-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -77,13 +77,13 @@ module "guardduty_baseline_ap-south-1" {
 }
 
 module "guardduty_baseline_ap-southeast-1" {
+  count  = contains(var.target_regions, "ap-southeast-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
 
-  enabled                      = contains(var.target_regions, "ap-southeast-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -100,7 +100,7 @@ module "guardduty_baseline_ap-southeast-2" {
     aws = aws.ap-southeast-2
   }
 
-  enabled                      = contains(var.target_regions, "ap-southeast-2") && var.guardduty_enabled
+  count                        = contains(var.target_regions, "ap-southeast-2") && var.guardduty_enabled ? 1 : 0
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -111,13 +111,13 @@ module "guardduty_baseline_ap-southeast-2" {
 }
 
 module "guardduty_baseline_ca-central-1" {
+  count  = contains(var.target_regions, "ca-central-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
 
-  enabled                      = contains(var.target_regions, "ca-central-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -128,13 +128,13 @@ module "guardduty_baseline_ca-central-1" {
 }
 
 module "guardduty_baseline_eu-central-1" {
+  count  = contains(var.target_regions, "eu-central-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
 
-  enabled                      = contains(var.target_regions, "eu-central-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -145,13 +145,13 @@ module "guardduty_baseline_eu-central-1" {
 }
 
 module "guardduty_baseline_eu-north-1" {
+  count  = contains(var.target_regions, "eu-north-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
 
-  enabled                      = contains(var.target_regions, "eu-north-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -162,13 +162,13 @@ module "guardduty_baseline_eu-north-1" {
 }
 
 module "guardduty_baseline_eu-west-1" {
+  count  = contains(var.target_regions, "eu-west-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
 
-  enabled                      = contains(var.target_regions, "eu-west-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -179,13 +179,13 @@ module "guardduty_baseline_eu-west-1" {
 }
 
 module "guardduty_baseline_eu-west-2" {
+  count  = contains(var.target_regions, "eu-west-2") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
 
-  enabled                      = contains(var.target_regions, "eu-west-2") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -196,13 +196,13 @@ module "guardduty_baseline_eu-west-2" {
 }
 
 module "guardduty_baseline_eu-west-3" {
+  count  = contains(var.target_regions, "eu-west-3") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
 
-  enabled                      = contains(var.target_regions, "eu-west-3") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -213,13 +213,13 @@ module "guardduty_baseline_eu-west-3" {
 }
 
 module "guardduty_baseline_sa-east-1" {
+  count  = contains(var.target_regions, "sa-east-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
 
-  enabled                      = contains(var.target_regions, "sa-east-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -230,13 +230,13 @@ module "guardduty_baseline_sa-east-1" {
 }
 
 module "guardduty_baseline_us-east-1" {
+  count  = contains(var.target_regions, "us-east-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
 
-  enabled                      = contains(var.target_regions, "us-east-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -247,13 +247,13 @@ module "guardduty_baseline_us-east-1" {
 }
 
 module "guardduty_baseline_us-east-2" {
+  count  = contains(var.target_regions, "us-east-2") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
 
-  enabled                      = contains(var.target_regions, "us-east-2") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -264,13 +264,13 @@ module "guardduty_baseline_us-east-2" {
 }
 
 module "guardduty_baseline_us-west-1" {
+  count  = contains(var.target_regions, "us-west-1") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
 
-  enabled                      = contains(var.target_regions, "us-west-1") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
@@ -281,13 +281,13 @@ module "guardduty_baseline_us-west-1" {
 }
 
 module "guardduty_baseline_us-west-2" {
+  count  = contains(var.target_regions, "us-west-2") && var.guardduty_enabled ? 1 : 0
   source = "./modules/guardduty-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
 
-  enabled                      = contains(var.target_regions, "us-west-2") && var.guardduty_enabled
   disable_email_notification   = var.guardduty_disable_email_notification
   finding_publishing_frequency = var.guardduty_finding_publishing_frequency
   invitation_message           = var.guardduty_invitation_message
diff --git a/main.tf b/main.tf
index ae2cc5c4..bf9953e0 100644
--- a/main.tf
+++ b/main.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.15"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
@@ -64,9 +64,9 @@ module "iam_baseline" {
 # --------------------------------------------------------------------------------------------------
 
 module "cloudtrail_baseline" {
+  count  = local.is_cloudtrail_enabled ? 1 : 0
   source = "./modules/cloudtrail-baseline"
 
-  enabled                           = local.is_cloudtrail_enabled
   aws_account_id                    = var.aws_account_id
   cloudtrail_depends_on             = [aws_s3_bucket_policy.audit_log]
   cloudtrail_name                   = var.cloudtrail_name
@@ -93,9 +93,9 @@ module "cloudtrail_baseline" {
 # --------------------------------------------------------------------------------------------------
 
 module "alarm_baseline" {
+  count  = local.is_cloudtrail_enabled && var.cloudtrail_cloudwatch_logs_enabled ? 1 : 0
   source = "./modules/alarm-baseline"
 
-  enabled                          = local.is_cloudtrail_enabled && var.cloudtrail_cloudwatch_logs_enabled
   unauthorized_api_calls_enabled   = var.unauthorized_api_calls_enabled
   no_mfa_console_signin_enabled    = var.no_mfa_console_signin_enabled
   mfa_console_signin_allow_sso     = var.mfa_console_signin_allow_sso
@@ -113,7 +113,7 @@ module "alarm_baseline" {
   vpc_changes_enabled              = var.vpc_changes_enabled
   organizations_changes_enabled    = var.organizations_changes_enabled
   alarm_namespace                  = var.alarm_namespace
-  cloudtrail_log_group_name        = local.is_cloudtrail_enabled ? module.cloudtrail_baseline.log_group : ""
+  cloudtrail_log_group_name        = local.is_cloudtrail_enabled ? module.cloudtrail_baseline[0].log_group : ""
   sns_topic_name                   = var.alarm_sns_topic_name
   sns_topic_kms_master_key_id      = var.alarm_sns_topic_kms_master_key_id
 
diff --git a/migrations.tf b/migrations.tf
new file mode 100644
index 00000000..53342e0b
--- /dev/null
+++ b/migrations.tf
@@ -0,0 +1,529 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Replacing `enabled` argument in each sub-module with `count` meta-argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = module.cloudtrail_baseline
+  to   = module.cloudtrail_baseline[0]
+}
+
+moved {
+  from = module.alarm_baseline
+  to   = module.alarm_baseline[0]
+}
+
+# Config baseline
+moved {
+  from = module.config_baseline_ap-northeast-1
+  to   = module.config_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.config_baseline_ap-northeast-2
+  to   = module.config_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.config_baseline_ap-northeast-3
+  to   = module.config_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.config_baseline_ap-south-1
+  to   = module.config_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.config_baseline_ap-southeast-1
+  to   = module.config_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.config_baseline_ap-southeast-2
+  to   = module.config_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.config_baseline_ca-central-1
+  to   = module.config_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.config_baseline_eu-central-1
+  to   = module.config_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.config_baseline_eu-north-1
+  to   = module.config_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.config_baseline_eu-west-1
+  to   = module.config_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.config_baseline_eu-west-2
+  to   = module.config_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.config_baseline_eu-west-3
+  to   = module.config_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.config_baseline_sa-east-1
+  to   = module.config_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.config_baseline_us-east-1
+  to   = module.config_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.config_baseline_us-east-2
+  to   = module.config_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.config_baseline_us-west-1
+  to   = module.config_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.config_baseline_us-west-2
+  to   = module.config_baseline_us-west-2[0]
+}
+
+# EBS baseline
+moved {
+  from = module.ebs_baseline_ap-northeast-1
+  to   = module.ebs_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_ap-northeast-2
+  to   = module.ebs_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.ebs_baseline_ap-northeast-3
+  to   = module.ebs_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.ebs_baseline_ap-south-1
+  to   = module.ebs_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_ap-southeast-1
+  to   = module.ebs_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_ap-southeast-2
+  to   = module.ebs_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.ebs_baseline_ca-central-1
+  to   = module.ebs_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_eu-central-1
+  to   = module.ebs_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_eu-north-1
+  to   = module.ebs_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_eu-west-1
+  to   = module.ebs_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_eu-west-2
+  to   = module.ebs_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.ebs_baseline_eu-west-3
+  to   = module.ebs_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.ebs_baseline_sa-east-1
+  to   = module.ebs_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_us-east-1
+  to   = module.ebs_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_us-east-2
+  to   = module.ebs_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.ebs_baseline_us-west-1
+  to   = module.ebs_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.ebs_baseline_us-west-2
+  to   = module.ebs_baseline_us-west-2[0]
+}
+
+# Guardduty baseline
+moved {
+  from = module.guardduty_baseline_ap-northeast-1
+  to   = module.guardduty_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ap-northeast-2
+  to   = module.guardduty_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ap-northeast-3
+  to   = module.guardduty_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ap-south-1
+  to   = module.guardduty_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ap-southeast-1
+  to   = module.guardduty_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ap-southeast-2
+  to   = module.guardduty_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.guardduty_baseline_ca-central-1
+  to   = module.guardduty_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_eu-central-1
+  to   = module.guardduty_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_eu-north-1
+  to   = module.guardduty_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_eu-west-1
+  to   = module.guardduty_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_eu-west-2
+  to   = module.guardduty_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.guardduty_baseline_eu-west-3
+  to   = module.guardduty_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.guardduty_baseline_sa-east-1
+  to   = module.guardduty_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_us-east-1
+  to   = module.guardduty_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_us-east-2
+  to   = module.guardduty_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.guardduty_baseline_us-west-1
+  to   = module.guardduty_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.guardduty_baseline_us-west-2
+  to   = module.guardduty_baseline_us-west-2[0]
+}
+
+# SecurityHub baseline
+moved {
+  from = module.securityhub_baseline_ap-northeast-1
+  to   = module.securityhub_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ap-northeast-2
+  to   = module.securityhub_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ap-northeast-3
+  to   = module.securityhub_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ap-south-1
+  to   = module.securityhub_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ap-southeast-1
+  to   = module.securityhub_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ap-southeast-2
+  to   = module.securityhub_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.securityhub_baseline_ca-central-1
+  to   = module.securityhub_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_eu-central-1
+  to   = module.securityhub_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_eu-north-1
+  to   = module.securityhub_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_eu-west-1
+  to   = module.securityhub_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_eu-west-2
+  to   = module.securityhub_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.securityhub_baseline_eu-west-3
+  to   = module.securityhub_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.securityhub_baseline_sa-east-1
+  to   = module.securityhub_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_us-east-1
+  to   = module.securityhub_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_us-east-2
+  to   = module.securityhub_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.securityhub_baseline_us-west-1
+  to   = module.securityhub_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.securityhub_baseline_us-west-2
+  to   = module.securityhub_baseline_us-west-2[0]
+}
+
+# vpc baseline
+moved {
+  from = module.vpc_baseline_ap-northeast-1
+  to   = module.vpc_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_ap-northeast-2
+  to   = module.vpc_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.vpc_baseline_ap-northeast-3
+  to   = module.vpc_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.vpc_baseline_ap-south-1
+  to   = module.vpc_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_ap-southeast-1
+  to   = module.vpc_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_ap-southeast-2
+  to   = module.vpc_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.vpc_baseline_ca-central-1
+  to   = module.vpc_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_eu-central-1
+  to   = module.vpc_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_eu-north-1
+  to   = module.vpc_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_eu-west-1
+  to   = module.vpc_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_eu-west-2
+  to   = module.vpc_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.vpc_baseline_eu-west-3
+  to   = module.vpc_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.vpc_baseline_sa-east-1
+  to   = module.vpc_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_us-east-1
+  to   = module.vpc_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_us-east-2
+  to   = module.vpc_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.vpc_baseline_us-west-1
+  to   = module.vpc_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.vpc_baseline_us-west-2
+  to   = module.vpc_baseline_us-west-2[0]
+}
+
+# analyzer baseline
+moved {
+  from = module.analyzer_baseline_ap-northeast-1
+  to   = module.analyzer_baseline_ap-northeast-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ap-northeast-2
+  to   = module.analyzer_baseline_ap-northeast-2[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ap-northeast-3
+  to   = module.analyzer_baseline_ap-northeast-3[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ap-south-1
+  to   = module.analyzer_baseline_ap-south-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ap-southeast-1
+  to   = module.analyzer_baseline_ap-southeast-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ap-southeast-2
+  to   = module.analyzer_baseline_ap-southeast-2[0]
+}
+
+moved {
+  from = module.analyzer_baseline_ca-central-1
+  to   = module.analyzer_baseline_ca-central-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_eu-central-1
+  to   = module.analyzer_baseline_eu-central-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_eu-north-1
+  to   = module.analyzer_baseline_eu-north-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_eu-west-1
+  to   = module.analyzer_baseline_eu-west-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_eu-west-2
+  to   = module.analyzer_baseline_eu-west-2[0]
+}
+
+moved {
+  from = module.analyzer_baseline_eu-west-3
+  to   = module.analyzer_baseline_eu-west-3[0]
+}
+
+moved {
+  from = module.analyzer_baseline_sa-east-1
+  to   = module.analyzer_baseline_sa-east-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_us-east-1
+  to   = module.analyzer_baseline_us-east-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_us-east-2
+  to   = module.analyzer_baseline_us-east-2[0]
+}
+
+moved {
+  from = module.analyzer_baseline_us-west-1
+  to   = module.analyzer_baseline_us-west-1[0]
+}
+
+moved {
+  from = module.analyzer_baseline_us-west-2
+  to   = module.analyzer_baseline_us-west-2[0]
+}
diff --git a/modules/alarm-baseline/README.md b/modules/alarm-baseline/README.md
index d50b460a..81f2ac24 100644
--- a/modules/alarm-baseline/README.md
+++ b/modules/alarm-baseline/README.md
@@ -7,7 +7,7 @@ Set up CloudWatch alarms to notify you when critical changes happen in your AWS
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -70,7 +70,6 @@ No modules.
 | <a name="input_cloudtrail_log_group_name"></a> [cloudtrail\_log\_group\_name](#input\_cloudtrail\_log\_group\_name) | The name of the CloudWatch Logs group to which CloudTrail events are delivered. | `any` | n/a | yes |
 | <a name="input_console_signin_failures_enabled"></a> [console\_signin\_failures\_enabled](#input\_console\_signin\_failures\_enabled) | The boolean flag whether the console\_signin\_failures alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_disable_or_delete_cmk_enabled"></a> [disable\_or\_delete\_cmk\_enabled](#input\_disable\_or\_delete\_cmk\_enabled) | The boolean flag whether the disable\_or\_delete\_cmk alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_iam_changes_enabled"></a> [iam\_changes\_enabled](#input\_iam\_changes\_enabled) | The boolean flag whether the iam\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_mfa_console_signin_allow_sso"></a> [mfa\_console\_signin\_allow\_sso](#input\_mfa\_console\_signin\_allow\_sso) | The boolean flag whether the no\_mfa\_console\_signin alarm allows SSO auth to be ignored. | `bool` | `false` | no |
 | <a name="input_nacl_changes_enabled"></a> [nacl\_changes\_enabled](#input\_nacl\_changes\_enabled) | The boolean flag whether the nacl\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
diff --git a/modules/alarm-baseline/main.tf b/modules/alarm-baseline/main.tf
index 2f54ae40..bef948e4 100644
--- a/modules/alarm-baseline/main.tf
+++ b/modules/alarm-baseline/main.tf
@@ -6,8 +6,6 @@ data "aws_region" "current" {}
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_sns_topic" "alarms" {
-  count = var.enabled ? 1 : 0
-
   name = var.sns_topic_name
 
   kms_master_key_id = var.sns_topic_kms_master_key_id
@@ -16,18 +14,15 @@ resource "aws_sns_topic" "alarms" {
 }
 
 resource "aws_sns_topic_policy" "alarms" {
-  count = var.enabled ? 1 : 0
-  arn   = aws_sns_topic.alarms[0].arn
+  arn = aws_sns_topic.alarms.arn
 
-  policy = data.aws_iam_policy_document.alarms-sns-policy[0].json
+  policy = data.aws_iam_policy_document.alarms-sns-policy.json
 }
 
 data "aws_iam_policy_document" "alarms-sns-policy" {
-  count = var.enabled ? 1 : 0
-
   statement {
     actions   = ["sns:Publish"]
-    resources = [aws_sns_topic.alarms[0].arn]
+    resources = [aws_sns_topic.alarms.arn]
 
     principals {
       type        = "Service"
@@ -47,7 +42,7 @@ data "aws_iam_policy_document" "alarms-sns-policy" {
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_calls" {
-  count = var.enabled && var.unauthorized_api_calls_enabled ? 1 : 0
+  count = var.unauthorized_api_calls_enabled ? 1 : 0
 
   name           = "UnauthorizedAPICalls"
   pattern        = "{(($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\")) && (($.sourceIPAddress!=\"delivery.logs.amazonaws.com\") && ($.eventName!=\"HeadBucket\"))}"
@@ -61,7 +56,7 @@ resource "aws_cloudwatch_log_metric_filter" "unauthorized_api_calls" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
-  count = var.enabled && var.unauthorized_api_calls_enabled ? 1 : 0
+  count = var.unauthorized_api_calls_enabled ? 1 : 0
 
   alarm_name                = "UnauthorizedAPICalls"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -72,7 +67,7 @@ resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -80,7 +75,7 @@ resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "no_mfa_console_signin" {
-  count = var.enabled && var.no_mfa_console_signin_enabled ? 1 : 0
+  count = var.no_mfa_console_signin_enabled ? 1 : 0
 
   name = "NoMFAConsoleSignin"
   pattern = join(" ", [
@@ -97,7 +92,7 @@ resource "aws_cloudwatch_log_metric_filter" "no_mfa_console_signin" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "no_mfa_console_signin" {
-  count = var.enabled && var.no_mfa_console_signin_enabled ? 1 : 0
+  count = var.no_mfa_console_signin_enabled ? 1 : 0
 
   alarm_name                = "NoMFAConsoleSignin"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -108,7 +103,7 @@ resource "aws_cloudwatch_metric_alarm" "no_mfa_console_signin" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -116,7 +111,7 @@ resource "aws_cloudwatch_metric_alarm" "no_mfa_console_signin" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "root_usage" {
-  count = var.enabled && var.root_usage_enabled ? 1 : 0
+  count = var.root_usage_enabled ? 1 : 0
 
   name           = "RootUsage"
   pattern        = "{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }"
@@ -130,7 +125,7 @@ resource "aws_cloudwatch_log_metric_filter" "root_usage" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "root_usage" {
-  count = var.enabled && var.root_usage_enabled ? 1 : 0
+  count = var.root_usage_enabled ? 1 : 0
 
   alarm_name                = "RootUsage"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -141,7 +136,7 @@ resource "aws_cloudwatch_metric_alarm" "root_usage" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring for root account logins will provide visibility into the use of a fully privileged account and an opportunity to reduce the use of it."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -149,7 +144,7 @@ resource "aws_cloudwatch_metric_alarm" "root_usage" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "iam_changes" {
-  count = var.enabled && var.iam_changes_enabled ? 1 : 0
+  count = var.iam_changes_enabled ? 1 : 0
 
   name           = "IAMChanges"
   pattern        = "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}"
@@ -163,7 +158,7 @@ resource "aws_cloudwatch_log_metric_filter" "iam_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "iam_changes" {
-  count = var.enabled && var.iam_changes_enabled ? 1 : 0
+  count = var.iam_changes_enabled ? 1 : 0
 
   alarm_name                = "IAMChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -174,7 +169,7 @@ resource "aws_cloudwatch_metric_alarm" "iam_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -182,7 +177,7 @@ resource "aws_cloudwatch_metric_alarm" "iam_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "cloudtrail_cfg_changes" {
-  count = var.enabled && var.cloudtrail_cfg_changes_enabled ? 1 : 0
+  count = var.cloudtrail_cfg_changes_enabled ? 1 : 0
 
   name           = "CloudTrailCfgChanges"
   pattern        = "{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }"
@@ -196,7 +191,7 @@ resource "aws_cloudwatch_log_metric_filter" "cloudtrail_cfg_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "cloudtrail_cfg_changes" {
-  count = var.enabled && var.cloudtrail_cfg_changes_enabled ? 1 : 0
+  count = var.cloudtrail_cfg_changes_enabled ? 1 : 0
 
   alarm_name                = "CloudTrailCfgChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -207,7 +202,7 @@ resource "aws_cloudwatch_metric_alarm" "cloudtrail_cfg_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to CloudTrail's configuration will help ensure sustained visibility to activities performed in the AWS account."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -215,7 +210,7 @@ resource "aws_cloudwatch_metric_alarm" "cloudtrail_cfg_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "console_signin_failures" {
-  count = var.enabled && var.console_signin_failures_enabled ? 1 : 0
+  count = var.console_signin_failures_enabled ? 1 : 0
 
   name           = "ConsoleSigninFailures"
   pattern        = "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }"
@@ -229,7 +224,7 @@ resource "aws_cloudwatch_log_metric_filter" "console_signin_failures" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "console_signin_failures" {
-  count = var.enabled && var.console_signin_failures_enabled ? 1 : 0
+  count = var.console_signin_failures_enabled ? 1 : 0
 
   alarm_name                = "ConsoleSigninFailures"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -240,7 +235,7 @@ resource "aws_cloudwatch_metric_alarm" "console_signin_failures" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring failed console logins may decrease lead time to detect an attempt to brute force a credential, which may provide an indicator, such as source IP, that can be used in other event correlation."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -248,7 +243,7 @@ resource "aws_cloudwatch_metric_alarm" "console_signin_failures" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "disable_or_delete_cmk" {
-  count = var.enabled && var.disable_or_delete_cmk_enabled ? 1 : 0
+  count = var.disable_or_delete_cmk_enabled ? 1 : 0
 
   name           = "DisableOrDeleteCMK"
   pattern        = "{ ($.eventSource = kms.amazonaws.com) && (($.eventName = DisableKey) || ($.eventName = ScheduleKeyDeletion)) }"
@@ -262,7 +257,7 @@ resource "aws_cloudwatch_log_metric_filter" "disable_or_delete_cmk" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "disable_or_delete_cmk" {
-  count = var.enabled && var.disable_or_delete_cmk_enabled ? 1 : 0
+  count = var.disable_or_delete_cmk_enabled ? 1 : 0
 
   alarm_name                = "DisableOrDeleteCMK"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -273,7 +268,7 @@ resource "aws_cloudwatch_metric_alarm" "disable_or_delete_cmk" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring failed console logins may decrease lead time to detect an attempt to brute force a credential, which may provide an indicator, such as source IP, that can be used in other event correlation."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -281,7 +276,7 @@ resource "aws_cloudwatch_metric_alarm" "disable_or_delete_cmk" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "s3_bucket_policy_changes" {
-  count = var.enabled && var.s3_bucket_policy_changes_enabled ? 1 : 0
+  count = var.s3_bucket_policy_changes_enabled ? 1 : 0
 
   name           = "S3BucketPolicyChanges"
   pattern        = "{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }"
@@ -295,7 +290,7 @@ resource "aws_cloudwatch_log_metric_filter" "s3_bucket_policy_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy_changes" {
-  count = var.enabled && var.s3_bucket_policy_changes_enabled ? 1 : 0
+  count = var.s3_bucket_policy_changes_enabled ? 1 : 0
 
   alarm_name                = "S3BucketPolicyChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -306,7 +301,7 @@ resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -314,7 +309,7 @@ resource "aws_cloudwatch_metric_alarm" "s3_bucket_policy_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "aws_config_changes" {
-  count = var.enabled && var.aws_config_changes_enabled ? 1 : 0
+  count = var.aws_config_changes_enabled ? 1 : 0
 
   name           = "AWSConfigChanges"
   pattern        = "{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }"
@@ -328,7 +323,7 @@ resource "aws_cloudwatch_log_metric_filter" "aws_config_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "aws_config_changes" {
-  count = var.enabled && var.aws_config_changes_enabled ? 1 : 0
+  count = var.aws_config_changes_enabled ? 1 : 0
 
   alarm_name                = "AWSConfigChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -339,7 +334,7 @@ resource "aws_cloudwatch_metric_alarm" "aws_config_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to AWS Config configuration will help ensure sustained visibility of configuration items within the AWS account."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -347,7 +342,7 @@ resource "aws_cloudwatch_metric_alarm" "aws_config_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "security_group_changes" {
-  count = var.enabled && var.security_group_changes_enabled ? 1 : 0
+  count = var.security_group_changes_enabled ? 1 : 0
 
   name           = "SecurityGroupChanges"
   pattern        = "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}"
@@ -361,7 +356,7 @@ resource "aws_cloudwatch_log_metric_filter" "security_group_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
-  count = var.enabled && var.security_group_changes_enabled ? 1 : 0
+  count = var.security_group_changes_enabled ? 1 : 0
 
   alarm_name                = "SecurityGroupChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -372,7 +367,7 @@ resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to security group will help ensure that resources and services are not unintentionally exposed."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -380,7 +375,7 @@ resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "nacl_changes" {
-  count = var.enabled && var.nacl_changes_enabled ? 1 : 0
+  count = var.nacl_changes_enabled ? 1 : 0
 
   name           = "NACLChanges"
   pattern        = "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }"
@@ -394,7 +389,7 @@ resource "aws_cloudwatch_log_metric_filter" "nacl_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "nacl_changes" {
-  count = var.enabled && var.nacl_changes_enabled ? 1 : 0
+  count = var.nacl_changes_enabled ? 1 : 0
 
   alarm_name                = "NACLChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -405,7 +400,7 @@ resource "aws_cloudwatch_metric_alarm" "nacl_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to NACLs will help ensure that AWS resources and services are not unintentionally exposed."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -413,7 +408,7 @@ resource "aws_cloudwatch_metric_alarm" "nacl_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "network_gw_changes" {
-  count = var.enabled && var.network_gw_changes_enabled ? 1 : 0
+  count = var.network_gw_changes_enabled ? 1 : 0
 
   name           = "NetworkGWChanges"
   pattern        = "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }"
@@ -427,7 +422,7 @@ resource "aws_cloudwatch_log_metric_filter" "network_gw_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "network_gw_changes" {
-  count = var.enabled && var.network_gw_changes_enabled ? 1 : 0
+  count = var.network_gw_changes_enabled ? 1 : 0
 
   alarm_name                = "NetworkGWChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -438,7 +433,7 @@ resource "aws_cloudwatch_metric_alarm" "network_gw_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -446,7 +441,7 @@ resource "aws_cloudwatch_metric_alarm" "network_gw_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "route_table_changes" {
-  count = var.enabled && var.route_table_changes_enabled ? 1 : 0
+  count = var.route_table_changes_enabled ? 1 : 0
 
   name           = "RouteTableChanges"
   pattern        = "{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }"
@@ -460,7 +455,7 @@ resource "aws_cloudwatch_log_metric_filter" "route_table_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "route_table_changes" {
-  count = var.enabled && var.route_table_changes_enabled ? 1 : 0
+  count = var.route_table_changes_enabled ? 1 : 0
 
   alarm_name                = "RouteTableChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -471,7 +466,7 @@ resource "aws_cloudwatch_metric_alarm" "route_table_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to route tables will help ensure that all VPC traffic flows through an expected path."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -479,7 +474,7 @@ resource "aws_cloudwatch_metric_alarm" "route_table_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "vpc_changes" {
-  count = var.enabled && var.vpc_changes_enabled ? 1 : 0
+  count = var.vpc_changes_enabled ? 1 : 0
 
   name           = "VPCChanges"
   pattern        = "{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }"
@@ -493,7 +488,7 @@ resource "aws_cloudwatch_log_metric_filter" "vpc_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "vpc_changes" {
-  count = var.enabled && var.vpc_changes_enabled ? 1 : 0
+  count = var.vpc_changes_enabled ? 1 : 0
 
   alarm_name                = "VPCChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -504,7 +499,7 @@ resource "aws_cloudwatch_metric_alarm" "vpc_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring changes to VPC will help ensure that all VPC traffic flows through an expected path."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
@@ -512,7 +507,7 @@ resource "aws_cloudwatch_metric_alarm" "vpc_changes" {
 }
 
 resource "aws_cloudwatch_log_metric_filter" "organizations_changes" {
-  count = var.enabled && var.organizations_changes_enabled ? 1 : 0
+  count = var.organizations_changes_enabled ? 1 : 0
 
   name           = "OrganizationsChanges"
   pattern        = "{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = \"AcceptHandshake\") || ($.eventName = \"AttachPolicy\") || ($.eventName = \"CreateAccount\") || ($.eventName = \"CreateOrganizationalUnit\") || ($.eventName= \"CreatePolicy\") || ($.eventName = \"DeclineHandshake\") || ($.eventName = \"DeleteOrganization\") || ($.eventName = \"DeleteOrganizationalUnit\") || ($.eventName = \"DeletePolicy\") || ($.eventName = \"DetachPolicy\") || ($.eventName = \"DisablePolicyType\") || ($.eventName = \"EnablePolicyType\") || ($.eventName = \"InviteAccountToOrganization\") || ($.eventName = \"LeaveOrganization\") || ($.eventName = \"MoveAccount\") || ($.eventName = \"RemoveAccountFromOrganization\") || ($.eventName = \"UpdatePolicy\") || ($.eventName =\"UpdateOrganizationalUnit\")) }"
@@ -526,7 +521,7 @@ resource "aws_cloudwatch_log_metric_filter" "organizations_changes" {
 }
 
 resource "aws_cloudwatch_metric_alarm" "organizations_changes" {
-  count = var.enabled && var.organizations_changes_enabled ? 1 : 0
+  count = var.organizations_changes_enabled ? 1 : 0
 
   alarm_name                = "OrganizationsChanges"
   comparison_operator       = "GreaterThanOrEqualToThreshold"
@@ -537,7 +532,7 @@ resource "aws_cloudwatch_metric_alarm" "organizations_changes" {
   statistic                 = "Sum"
   threshold                 = "1"
   alarm_description         = "Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches."
-  alarm_actions             = [aws_sns_topic.alarms[0].arn]
+  alarm_actions             = [aws_sns_topic.alarms.arn]
   treat_missing_data        = "notBreaching"
   insufficient_data_actions = []
 
diff --git a/modules/alarm-baseline/migrations.tf b/modules/alarm-baseline/migrations.tf
new file mode 100644
index 00000000..60065478
--- /dev/null
+++ b/modules/alarm-baseline/migrations.tf
@@ -0,0 +1,13 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_sns_topic.alarms[0]
+  to   = aws_sns_topic.alarms
+}
+
+moved {
+  from = aws_sns_topic_policy.alarms[0]
+  to   = aws_sns_topic_policy.alarms
+}
diff --git a/modules/alarm-baseline/variables.tf b/modules/alarm-baseline/variables.tf
index 1631a6be..f35feee8 100644
--- a/modules/alarm-baseline/variables.tf
+++ b/modules/alarm-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "unauthorized_api_calls_enabled" {
   description = "The boolean flag whether the unauthorized_api_calls alarm is enabled or not. No resources are created when set to false."
   default     = true
diff --git a/modules/alarm-baseline/versions.tf b/modules/alarm-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/alarm-baseline/versions.tf
+++ b/modules/alarm-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/analyzer-baseline/README.md b/modules/analyzer-baseline/README.md
index ed33cc2a..3e0b99fc 100644
--- a/modules/analyzer-baseline/README.md
+++ b/modules/analyzer-baseline/README.md
@@ -9,7 +9,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -33,7 +33,6 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_analyzer_name"></a> [analyzer\_name](#input\_analyzer\_name) | The name for the IAM Access Analyzer resource to be created. | `string` | `"default-analyer"` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_is_organization"></a> [is\_organization](#input\_is\_organization) | The boolean flag whether this module is configured for the organization master account or the individual account. | `bool` | `false` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map` | <pre>{<br>  "Terraform": true<br>}</pre> | no |
 
diff --git a/modules/analyzer-baseline/main.tf b/modules/analyzer-baseline/main.tf
index 93b248a1..74108796 100644
--- a/modules/analyzer-baseline/main.tf
+++ b/modules/analyzer-baseline/main.tf
@@ -1,6 +1,4 @@
 resource "aws_accessanalyzer_analyzer" "default" {
-  count = var.enabled ? 1 : 0
-
   analyzer_name = var.analyzer_name
   type          = var.is_organization ? "ORGANIZATION" : "ACCOUNT"
 
diff --git a/modules/analyzer-baseline/migrations.tf b/modules/analyzer-baseline/migrations.tf
new file mode 100644
index 00000000..48abae80
--- /dev/null
+++ b/modules/analyzer-baseline/migrations.tf
@@ -0,0 +1,8 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_accessanalyzer_analyzer.default[0]
+  to   = aws_accessanalyzer_analyzer.default
+}
diff --git a/modules/analyzer-baseline/variables.tf b/modules/analyzer-baseline/variables.tf
index 4d9f0a18..9df076e6 100644
--- a/modules/analyzer-baseline/variables.tf
+++ b/modules/analyzer-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "analyzer_name" {
   description = "The name for the IAM Access Analyzer resource to be created."
   default     = "default-analyer"
diff --git a/modules/analyzer-baseline/versions.tf b/modules/analyzer-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/analyzer-baseline/versions.tf
+++ b/modules/analyzer-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/cloudtrail-baseline/README.md b/modules/cloudtrail-baseline/README.md
index ac3fa736..1a64d4ee 100644
--- a/modules/cloudtrail-baseline/README.md
+++ b/modules/cloudtrail-baseline/README.md
@@ -7,7 +7,7 @@ Enable CloudTrail in all regions and deliver events to CloudWatch Logs. CloudTra
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -49,7 +49,6 @@ No modules.
 | <a name="input_cloudwatch_logs_group_name"></a> [cloudwatch\_logs\_group\_name](#input\_cloudwatch\_logs\_group\_name) | The name of CloudWatch Logs group to which CloudTrail events are delivered. | `string` | `"cloudtrail-multi-region"` | no |
 | <a name="input_cloudwatch_logs_retention_in_days"></a> [cloudwatch\_logs\_retention\_in\_days](#input\_cloudwatch\_logs\_retention\_in\_days) | Number of days to retain logs for. CIS recommends 365 days.  Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. Set to 0 to keep logs indefinitely. | `number` | `365` | no |
 | <a name="input_dynamodb_event_logging_tables"></a> [dynamodb\_event\_logging\_tables](#input\_dynamodb\_event\_logging\_tables) | The list of DynamoDB table ARNs on which to enable event logging. | `list` | <pre>[<br>  "arn:aws:dynamodb"<br>]</pre> | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_iam_role_name"></a> [iam\_role\_name](#input\_iam\_role\_name) | The name of the IAM Role to be used by CloudTrail to delivery logs to CloudWatch Logs group. | `string` | `"CloudTrail-CloudWatch-Delivery-Role"` | no |
 | <a name="input_iam_role_policy_name"></a> [iam\_role\_policy\_name](#input\_iam\_role\_policy\_name) | The name of the IAM Role Policy to be used by CloudTrail to delivery logs to CloudWatch Logs group. | `string` | `"CloudTrail-CloudWatch-Delivery-Policy"` | no |
 | <a name="input_is_organization_trail"></a> [is\_organization\_trail](#input\_is\_organization\_trail) | Specifies whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. | `bool` | `false` | no |
diff --git a/modules/cloudtrail-baseline/main.tf b/modules/cloudtrail-baseline/main.tf
index f00709fc..cb02401e 100644
--- a/modules/cloudtrail-baseline/main.tf
+++ b/modules/cloudtrail-baseline/main.tf
@@ -2,7 +2,7 @@
 # CloudWatch Logs group to accept CloudTrail event stream.
 # --------------------------------------------------------------------------------------------------
 resource "aws_cloudwatch_log_group" "cloudtrail_events" {
-  count = var.cloudwatch_logs_enabled && var.enabled ? 1 : 0
+  count = var.cloudwatch_logs_enabled ? 1 : 0
 
   name              = var.cloudwatch_logs_group_name
   retention_in_days = var.cloudwatch_logs_retention_in_days
@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "cloudwatch_delivery_assume_policy" {
 }
 
 resource "aws_iam_role" "cloudwatch_delivery" {
-  count = var.cloudwatch_logs_enabled && var.enabled ? 1 : 0
+  count = var.cloudwatch_logs_enabled ? 1 : 0
 
   name               = var.iam_role_name
   assume_role_policy = data.aws_iam_policy_document.cloudwatch_delivery_assume_policy.json
@@ -35,7 +35,7 @@ resource "aws_iam_role" "cloudwatch_delivery" {
 }
 
 data "aws_iam_policy_document" "cloudwatch_delivery_policy" {
-  count = var.cloudwatch_logs_enabled && var.enabled ? 1 : 0
+  count = var.cloudwatch_logs_enabled ? 1 : 0
 
   statement {
     sid       = "AWSCloudTrailCreateLogStream2014110"
@@ -51,7 +51,7 @@ data "aws_iam_policy_document" "cloudwatch_delivery_policy" {
 }
 
 resource "aws_iam_role_policy" "cloudwatch_delivery_policy" {
-  count = var.cloudwatch_logs_enabled && var.enabled ? 1 : 0
+  count = var.cloudwatch_logs_enabled ? 1 : 0
 
   name = var.iam_role_policy_name
   role = aws_iam_role.cloudwatch_delivery[0].id
@@ -187,8 +187,6 @@ data "aws_iam_policy_document" "cloudtrail_key_policy" {
 }
 
 resource "aws_kms_key" "cloudtrail" {
-  count = var.enabled ? 1 : 0
-
   description             = "A KMS key to encrypt CloudTrail events."
   deletion_window_in_days = var.key_deletion_window_in_days
   enable_key_rotation     = "true"
@@ -204,14 +202,14 @@ resource "aws_kms_key" "cloudtrail" {
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_sns_topic" "cloudtrail-sns-topic" {
-  count = var.cloudtrail_sns_topic_enabled && var.enabled ? 1 : 0
+  count = var.cloudtrail_sns_topic_enabled ? 1 : 0
 
   name              = var.cloudtrail_sns_topic_name
-  kms_master_key_id = aws_kms_key.cloudtrail[0].id
+  kms_master_key_id = aws_kms_key.cloudtrail.id
 }
 
 data "aws_iam_policy_document" "cloudtrail-sns-policy" {
-  count = var.cloudtrail_sns_topic_enabled && var.enabled ? 1 : 0
+  count = var.cloudtrail_sns_topic_enabled ? 1 : 0
 
   statement {
     actions   = ["sns:Publish"]
@@ -225,7 +223,7 @@ data "aws_iam_policy_document" "cloudtrail-sns-policy" {
 }
 
 resource "aws_sns_topic_policy" "local-account-cloudtrail" {
-  count = var.cloudtrail_sns_topic_enabled && var.enabled ? 1 : 0
+  count = var.cloudtrail_sns_topic_enabled ? 1 : 0
 
   arn    = aws_sns_topic.cloudtrail-sns-topic[0].arn
   policy = data.aws_iam_policy_document.cloudtrail-sns-policy[0].json
@@ -236,8 +234,6 @@ resource "aws_sns_topic_policy" "local-account-cloudtrail" {
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_cloudtrail" "global" {
-  count = var.enabled ? 1 : 0
-
   name = var.cloudtrail_name
 
   cloud_watch_logs_group_arn    = var.cloudwatch_logs_enabled ? "${aws_cloudwatch_log_group.cloudtrail_events[0].arn}:*" : null
@@ -246,7 +242,7 @@ resource "aws_cloudtrail" "global" {
   include_global_service_events = true
   is_multi_region_trail         = true
   is_organization_trail         = var.is_organization_trail
-  kms_key_id                    = aws_kms_key.cloudtrail[0].arn
+  kms_key_id                    = aws_kms_key.cloudtrail.arn
   s3_bucket_name                = var.s3_bucket_name
   s3_key_prefix                 = var.s3_key_prefix
   sns_topic_name                = var.cloudtrail_sns_topic_enabled ? aws_sns_topic.cloudtrail-sns-topic[0].arn : null
diff --git a/modules/cloudtrail-baseline/migrations.tf b/modules/cloudtrail-baseline/migrations.tf
new file mode 100644
index 00000000..d256924d
--- /dev/null
+++ b/modules/cloudtrail-baseline/migrations.tf
@@ -0,0 +1,13 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_kms_key.cloudtrail[0]
+  to   = aws_kms_key.cloudtrail
+}
+
+moved {
+  from = aws_cloudtrail.global[0]
+  to   = aws_cloudtrail.global
+}
diff --git a/modules/cloudtrail-baseline/outputs.tf b/modules/cloudtrail-baseline/outputs.tf
index 416e69fd..95d44711 100644
--- a/modules/cloudtrail-baseline/outputs.tf
+++ b/modules/cloudtrail-baseline/outputs.tf
@@ -1,24 +1,24 @@
 output "cloudtrail" {
   description = "The trail for recording events in all regions."
-  value       = var.enabled ? aws_cloudtrail.global[0] : null
+  value       = aws_cloudtrail.global
 }
 
 output "cloudtrail_sns_topic" {
   description = "The sns topic linked to the cloudtrail."
-  value       = var.cloudtrail_sns_topic_enabled && var.enabled ? aws_sns_topic.cloudtrail-sns-topic[0] : null
+  value       = var.cloudtrail_sns_topic_enabled ? aws_sns_topic.cloudtrail-sns-topic[0] : null
 }
 
 output "kms_key" {
   description = "The  KMS key used for encrypting CloudTrail events."
-  value       = var.enabled ? aws_kms_key.cloudtrail[0] : null
+  value       = aws_kms_key.cloudtrail
 }
 
 output "log_delivery_iam_role" {
   description = "The IAM role used for delivering CloudTrail events to CloudWatch Logs."
-  value       = var.cloudwatch_logs_enabled && var.enabled ? aws_iam_role.cloudwatch_delivery[0] : null
+  value       = var.cloudwatch_logs_enabled ? aws_iam_role.cloudwatch_delivery[0] : null
 }
 
 output "log_group" {
   description = "The CloudWatch Logs log group which stores CloudTrail events."
-  value       = var.cloudwatch_logs_enabled && var.enabled ? aws_cloudwatch_log_group.cloudtrail_events[0].name : null
+  value       = var.cloudwatch_logs_enabled ? aws_cloudwatch_log_group.cloudtrail_events[0].name : null
 }
diff --git a/modules/cloudtrail-baseline/variables.tf b/modules/cloudtrail-baseline/variables.tf
index 06fe6089..aa22226b 100644
--- a/modules/cloudtrail-baseline/variables.tf
+++ b/modules/cloudtrail-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "aws_account_id" {
   description = "The AWS Account ID number of the account."
 }
diff --git a/modules/cloudtrail-baseline/versions.tf b/modules/cloudtrail-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/cloudtrail-baseline/versions.tf
+++ b/modules/cloudtrail-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/config-baseline/README.md b/modules/config-baseline/README.md
index 55e73882..2ce0a6ca 100644
--- a/modules/config-baseline/README.md
+++ b/modules/config-baseline/README.md
@@ -7,7 +7,7 @@ Enable AWS Config in all regions to automatically take configuration snapshots.
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -39,7 +39,6 @@ No modules.
 |------|-------------|------|---------|:--------:|
 | <a name="input_delivery_channel_name"></a> [delivery\_channel\_name](#input\_delivery\_channel\_name) | The name of the delivery channel. | `string` | `"default"` | no |
 | <a name="input_delivery_frequency"></a> [delivery\_frequency](#input\_delivery\_frequency) | The frequency which AWS Config sends a snapshot into the S3 bucket. | `string` | `"One_Hour"` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_iam_role_arn"></a> [iam\_role\_arn](#input\_iam\_role\_arn) | The ARN of the IAM Role which AWS Config will use. | `any` | n/a | yes |
 | <a name="input_include_global_resource_types"></a> [include\_global\_resource\_types](#input\_include\_global\_resource\_types) | Specifies whether AWS Config includes all supported types of global resources with the resources that it records. | `bool` | `true` | no |
 | <a name="input_recorder_name"></a> [recorder\_name](#input\_recorder\_name) | The name of the configuration recorder. | `string` | `"default"` | no |
diff --git a/modules/config-baseline/main.tf b/modules/config-baseline/main.tf
index 7ed259f0..777483f1 100644
--- a/modules/config-baseline/main.tf
+++ b/modules/config-baseline/main.tf
@@ -6,8 +6,6 @@ data "aws_region" "current" {}
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_sns_topic" "config" {
-  count = var.enabled ? 1 : 0
-
   name = var.sns_topic_name
 
   kms_master_key_id = var.sns_topic_kms_master_key_id
@@ -16,18 +14,15 @@ resource "aws_sns_topic" "config" {
 }
 
 resource "aws_sns_topic_policy" "config" {
-  count = var.enabled ? 1 : 0
-  arn   = aws_sns_topic.config[0].arn
+  arn = aws_sns_topic.config.arn
 
-  policy = data.aws_iam_policy_document.config-sns-policy[0].json
+  policy = data.aws_iam_policy_document.config-sns-policy.json
 }
 
 data "aws_iam_policy_document" "config-sns-policy" {
-  count = var.enabled ? 1 : 0
-
   statement {
     actions   = ["sns:Publish"]
-    resources = [aws_sns_topic.config[0].arn]
+    resources = [aws_sns_topic.config.arn]
 
     principals {
       type        = "Service"
@@ -43,8 +38,6 @@ data "aws_iam_policy_document" "config-sns-policy" {
 }
 
 resource "aws_config_configuration_recorder" "recorder" {
-  count = var.enabled ? 1 : 0
-
   name = var.recorder_name
 
   role_arn = var.iam_role_arn
@@ -56,26 +49,22 @@ resource "aws_config_configuration_recorder" "recorder" {
 }
 
 resource "aws_config_delivery_channel" "bucket" {
-  count = var.enabled ? 1 : 0
-
   name = var.delivery_channel_name
 
   s3_bucket_name = var.s3_bucket_name
   s3_key_prefix  = var.s3_key_prefix
-  sns_topic_arn  = aws_sns_topic.config[0].arn
+  sns_topic_arn  = aws_sns_topic.config.arn
 
   snapshot_delivery_properties {
     delivery_frequency = var.delivery_frequency
   }
 
-  depends_on = [aws_config_configuration_recorder.recorder[0]]
+  depends_on = [aws_config_configuration_recorder.recorder]
 }
 
 resource "aws_config_configuration_recorder_status" "recorder" {
-  count = var.enabled ? 1 : 0
-
-  name = aws_config_configuration_recorder.recorder[0].id
+  name = aws_config_configuration_recorder.recorder.id
 
   is_enabled = true
-  depends_on = [aws_config_delivery_channel.bucket[0]]
+  depends_on = [aws_config_delivery_channel.bucket]
 }
diff --git a/modules/config-baseline/migrations.tf b/modules/config-baseline/migrations.tf
new file mode 100644
index 00000000..5e062c52
--- /dev/null
+++ b/modules/config-baseline/migrations.tf
@@ -0,0 +1,28 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_sns_topic.config[0]
+  to   = aws_sns_topic.config
+}
+
+moved {
+  from = aws_sns_topic_policy.config[0]
+  to   = aws_sns_topic_policy.config
+}
+
+moved {
+  from = aws_config_configuration_recorder.recorder[0]
+  to   = aws_config_configuration_recorder.recorder
+}
+
+moved {
+  from = aws_config_configuration_recorder_status.recorder[0]
+  to   = aws_config_configuration_recorder_status.recorder
+}
+
+moved {
+  from = aws_config_delivery_channel.bucket[0]
+  to   = aws_config_delivery_channel.bucket
+}
diff --git a/modules/config-baseline/outputs.tf b/modules/config-baseline/outputs.tf
index 295ace30..20ee6775 100644
--- a/modules/config-baseline/outputs.tf
+++ b/modules/config-baseline/outputs.tf
@@ -1,9 +1,9 @@
 output "configuration_recorder" {
   description = "The configuration recorder."
-  value       = var.enabled ? aws_config_configuration_recorder.recorder[0] : null
+  value       = aws_config_configuration_recorder.recorder
 }
 
 output "config_sns_topic" {
   description = "The SNS topic that AWS Config delivers notifications to."
-  value       = var.enabled ? aws_sns_topic.config[0] : null
+  value       = aws_sns_topic.config
 }
diff --git a/modules/config-baseline/variables.tf b/modules/config-baseline/variables.tf
index 842eba95..7be7cbf3 100644
--- a/modules/config-baseline/variables.tf
+++ b/modules/config-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "iam_role_arn" {
   description = "The ARN of the IAM Role which AWS Config will use."
 }
diff --git a/modules/config-baseline/versions.tf b/modules/config-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/config-baseline/versions.tf
+++ b/modules/config-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/ebs-baseline/README.md b/modules/ebs-baseline/README.md
index 059c6d74..4c0c2e44 100644
--- a/modules/ebs-baseline/README.md
+++ b/modules/ebs-baseline/README.md
@@ -9,7 +9,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -30,9 +30,7 @@ No modules.
 
 ## Inputs
 
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
+No inputs.
 
 ## Outputs
 
diff --git a/modules/ebs-baseline/main.tf b/modules/ebs-baseline/main.tf
index 280ce04e..ce108c13 100644
--- a/modules/ebs-baseline/main.tf
+++ b/modules/ebs-baseline/main.tf
@@ -2,7 +2,5 @@
 # Enable Default EBS Encryption
 # --------------------------------------------------------------------------------------------------
 resource "aws_ebs_encryption_by_default" "this" {
-  count = var.enabled ? 1 : 0
-
   enabled = true
 }
diff --git a/modules/ebs-baseline/migrations.tf b/modules/ebs-baseline/migrations.tf
new file mode 100644
index 00000000..c12b94ba
--- /dev/null
+++ b/modules/ebs-baseline/migrations.tf
@@ -0,0 +1,8 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_ebs_encryption_by_default.this[0]
+  to   = aws_ebs_encryption_by_default.this
+}
diff --git a/modules/ebs-baseline/variables.tf b/modules/ebs-baseline/variables.tf
index 9b77876f..e69de29b 100644
--- a/modules/ebs-baseline/variables.tf
+++ b/modules/ebs-baseline/variables.tf
@@ -1,4 +0,0 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
diff --git a/modules/ebs-baseline/versions.tf b/modules/ebs-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/ebs-baseline/versions.tf
+++ b/modules/ebs-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/guardduty-baseline/README.md b/modules/guardduty-baseline/README.md
index 0d10b1d8..22c41942 100644
--- a/modules/guardduty-baseline/README.md
+++ b/modules/guardduty-baseline/README.md
@@ -7,7 +7,7 @@ Enable GuardDuty in all regions.
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -33,7 +33,6 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_disable_email_notification"></a> [disable\_email\_notification](#input\_disable\_email\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | `false` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_finding_publishing_frequency"></a> [finding\_publishing\_frequency](#input\_finding\_publishing\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | `"SIX_HOURS"` | no |
 | <a name="input_invitation_message"></a> [invitation\_message](#input\_invitation\_message) | Message for invitation. | `string` | `"This is an automatic invitation message from guardduty-baseline module."` | no |
 | <a name="input_master_account_id"></a> [master\_account\_id](#input\_master\_account\_id) | AWS account ID for master account. | `string` | `""` | no |
diff --git a/modules/guardduty-baseline/main.tf b/modules/guardduty-baseline/main.tf
index d2416510..d2b1229d 100644
--- a/modules/guardduty-baseline/main.tf
+++ b/modules/guardduty-baseline/main.tf
@@ -3,8 +3,6 @@
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_guardduty_detector" "default" {
-  count = var.enabled ? 1 : 0
-
   enable                       = true
   finding_publishing_frequency = var.finding_publishing_frequency
 
@@ -23,9 +21,9 @@ resource "aws_guardduty_detector" "default" {
 }
 
 resource "aws_guardduty_member" "members" {
-  count = var.enabled ? length(var.member_accounts) : 0
+  count = length(var.member_accounts)
 
-  detector_id = aws_guardduty_detector.default[0].id
+  detector_id = aws_guardduty_detector.default.id
   invite      = true
 
   account_id                 = var.member_accounts[count.index].account_id
@@ -35,8 +33,8 @@ resource "aws_guardduty_member" "members" {
 }
 
 resource "aws_guardduty_invite_accepter" "master" {
-  count = var.enabled && var.master_account_id != "" ? 1 : 0
+  count = var.master_account_id != "" ? 1 : 0
 
-  detector_id       = aws_guardduty_detector.default[0].id
+  detector_id       = aws_guardduty_detector.default.id
   master_account_id = var.master_account_id
 }
diff --git a/modules/guardduty-baseline/migrations.tf b/modules/guardduty-baseline/migrations.tf
new file mode 100644
index 00000000..76cad35e
--- /dev/null
+++ b/modules/guardduty-baseline/migrations.tf
@@ -0,0 +1,8 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_guardduty_detector.default[0]
+  to   = aws_guardduty_detector.default
+}
diff --git a/modules/guardduty-baseline/outputs.tf b/modules/guardduty-baseline/outputs.tf
index f0413467..067efd52 100644
--- a/modules/guardduty-baseline/outputs.tf
+++ b/modules/guardduty-baseline/outputs.tf
@@ -1,4 +1,4 @@
 output "guardduty_detector" {
   description = "The GuardDuty detector."
-  value       = var.enabled ? aws_guardduty_detector.default[0] : null
+  value       = aws_guardduty_detector.default
 }
diff --git a/modules/guardduty-baseline/variables.tf b/modules/guardduty-baseline/variables.tf
index 0aa9d673..07e5177a 100644
--- a/modules/guardduty-baseline/variables.tf
+++ b/modules/guardduty-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "disable_email_notification" {
   description = "Boolean whether an email notification is sent to the accounts."
   default     = false
diff --git a/modules/guardduty-baseline/versions.tf b/modules/guardduty-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/guardduty-baseline/versions.tf
+++ b/modules/guardduty-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/securityhub-baseline/README.md b/modules/securityhub-baseline/README.md
index 0d8a0ba0..7a2790b1 100644
--- a/modules/securityhub-baseline/README.md
+++ b/modules/securityhub-baseline/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
 
 ## Providers
@@ -45,7 +45,6 @@ No modules.
 | <a name="input_enable_cis_standard"></a> [enable\_cis\_standard](#input\_enable\_cis\_standard) | Boolean whether CIS standard is enabled. | `bool` | `true` | no |
 | <a name="input_enable_pci_dss_standard"></a> [enable\_pci\_dss\_standard](#input\_enable\_pci\_dss\_standard) | Boolean whether PCI DSS standard is enabled. | `bool` | `true` | no |
 | <a name="input_enable_product_arns"></a> [enable\_product\_arns](#input\_enable\_product\_arns) | List of Security Hub product ARNs, `<REGION>` will be replaced. See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html for list. | `list(string)` | `[]` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_member_accounts"></a> [member\_accounts](#input\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | `[]` | no |
 
 ## Outputs
diff --git a/modules/securityhub-baseline/main.tf b/modules/securityhub-baseline/main.tf
index ab1a24c6..89ab92d7 100644
--- a/modules/securityhub-baseline/main.tf
+++ b/modules/securityhub-baseline/main.tf
@@ -3,14 +3,13 @@ data "aws_region" "current" {}
 # Enable SecurityHub
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_account" "main" {
-  count = var.enabled ? 1 : 0
 }
 
 # --------------------------------------------------------------------------------------------------
 # Add member accounts
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_member" "members" {
-  count = var.enabled ? length(var.member_accounts) : 0
+  count = length(var.member_accounts)
 
   depends_on = [aws_securityhub_account.main]
   account_id = var.member_accounts[count.index].account_id
@@ -22,7 +21,7 @@ resource "aws_securityhub_member" "members" {
 # Subscribe CIS benchmark
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_standards_subscription" "cis" {
-  count = var.enabled && var.enable_cis_standard ? 1 : 0
+  count = var.enable_cis_standard ? 1 : 0
 
   standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
 
@@ -33,7 +32,7 @@ resource "aws_securityhub_standards_subscription" "cis" {
 # Subscribe AWS foundational security best practices standard
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_standards_subscription" "aws_foundational" {
-  count = var.enabled && var.enable_aws_foundational_standard ? 1 : 0
+  count = var.enable_aws_foundational_standard ? 1 : 0
 
   standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
 
@@ -44,7 +43,7 @@ resource "aws_securityhub_standards_subscription" "aws_foundational" {
 # Subscribe PCI DSS standard
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_standards_subscription" "pci_dss" {
-  count = var.enabled && var.enable_pci_dss_standard ? 1 : 0
+  count = var.enable_pci_dss_standard ? 1 : 0
 
   standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/pci-dss/v/3.2.1"
 
@@ -55,7 +54,7 @@ resource "aws_securityhub_standards_subscription" "pci_dss" {
 # Subscribe to 3rd party products
 # --------------------------------------------------------------------------------------------------
 resource "aws_securityhub_product_subscription" "products" {
-  count = var.enabled ? length(var.enable_product_arns) : 0
+  count = length(var.enable_product_arns)
 
   product_arn = replace(var.enable_product_arns[count.index], "<REGION>", data.aws_region.current.name)
 
diff --git a/modules/securityhub-baseline/migrations.tf b/modules/securityhub-baseline/migrations.tf
new file mode 100644
index 00000000..bf0d1408
--- /dev/null
+++ b/modules/securityhub-baseline/migrations.tf
@@ -0,0 +1,9 @@
+
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_securityhub_account.main[0]
+  to   = aws_securityhub_account.main
+}
diff --git a/modules/securityhub-baseline/variables.tf b/modules/securityhub-baseline/variables.tf
index 0dc4fd27..dccd49fe 100644
--- a/modules/securityhub-baseline/variables.tf
+++ b/modules/securityhub-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "enable_cis_standard" {
   description = "Boolean whether CIS standard is enabled."
   default     = true
diff --git a/modules/securityhub-baseline/versions.tf b/modules/securityhub-baseline/versions.tf
index 811c8034..706c4a0d 100644
--- a/modules/securityhub-baseline/versions.tf
+++ b/modules/securityhub-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/modules/vpc-baseline/README.md b/modules/vpc-baseline/README.md
index d8e663f9..4823ec37 100644
--- a/modules/vpc-baseline/README.md
+++ b/modules/vpc-baseline/README.md
@@ -11,7 +11,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.3 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.55.0 |
 
 ## Providers
@@ -44,7 +44,6 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_enable_flow_logs"></a> [enable\_flow\_logs](#input\_enable\_flow\_logs) | The boolean flag whether to enable VPC Flow Logs in the default VPC | `bool` | `true` | no |
-| <a name="input_enabled"></a> [enabled](#input\_enabled) | The boolean flag whether this module is enabled or not. No resources are created when set to false. | `bool` | `true` | no |
 | <a name="input_flow_logs_destination_type"></a> [flow\_logs\_destination\_type](#input\_flow\_logs\_destination\_type) | The type of the logging destination. Valid values: cloud-watch-logs, s3 | `string` | `"cloud-watch-logs"` | no |
 | <a name="input_flow_logs_iam_role_arn"></a> [flow\_logs\_iam\_role\_arn](#input\_flow\_logs\_iam\_role\_arn) | The ARN of the IAM Role which will be used by VPC Flow Logs if vpc\_log\_destination\_type is cloud-watch-logs. | `string` | `""` | no |
 | <a name="input_flow_logs_log_group_name"></a> [flow\_logs\_log\_group\_name](#input\_flow\_logs\_log\_group\_name) | The name of CloudWatch Logs group to which VPC Flow Logs are delivered if vpc\_log\_destination\_type is cloud-watch-logs. | `string` | `""` | no |
diff --git a/modules/vpc-baseline/main.tf b/modules/vpc-baseline/main.tf
index 938cf923..fea4edd7 100644
--- a/modules/vpc-baseline/main.tf
+++ b/modules/vpc-baseline/main.tf
@@ -23,7 +23,7 @@ data "aws_subnet" "default" {
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_cloudwatch_log_group" "default_vpc_flow_logs" {
-  count = var.enabled && var.enable_flow_logs && local.is_cw_logs ? 1 : 0
+  count = var.enable_flow_logs && local.is_cw_logs ? 1 : 0
 
   name              = var.flow_logs_log_group_name
   retention_in_days = var.flow_logs_retention_in_days
@@ -32,12 +32,12 @@ resource "aws_cloudwatch_log_group" "default_vpc_flow_logs" {
 }
 
 resource "aws_flow_log" "default_vpc_flow_logs" {
-  count = var.enabled && var.enable_flow_logs ? 1 : 0
+  count = var.enable_flow_logs ? 1 : 0
 
   log_destination_type = var.flow_logs_destination_type
   log_destination      = local.is_cw_logs ? aws_cloudwatch_log_group.default_vpc_flow_logs[0].arn : local.s3_destination_arn
   iam_role_arn         = local.is_cw_logs ? var.flow_logs_iam_role_arn : null
-  vpc_id               = aws_default_vpc.default[0].id
+  vpc_id               = aws_default_vpc.default.id
   traffic_type         = "ALL"
 
   tags = var.tags
@@ -48,8 +48,6 @@ resource "aws_flow_log" "default_vpc_flow_logs" {
 # --------------------------------------------------------------------------------------------------
 
 resource "aws_default_vpc" "default" {
-  count = var.enabled ? 1 : 0
-
   tags = merge(
     var.tags,
     { Name = "Default VPC" }
@@ -69,9 +67,7 @@ resource "aws_default_subnet" "default" {
 }
 
 resource "aws_default_route_table" "default" {
-  count = var.enabled ? 1 : 0
-
-  default_route_table_id = aws_default_vpc.default[0].default_route_table_id
+  default_route_table_id = aws_default_vpc.default.default_route_table_id
 
   tags = merge(
     var.tags,
@@ -83,9 +79,7 @@ resource "aws_default_route_table" "default" {
 // https://github.com/hashicorp/terraform/issues/9824
 // https://github.com/terraform-providers/terraform-provider-aws/issues/346
 resource "aws_default_network_acl" "default" {
-  count = var.enabled ? 1 : 0
-
-  default_network_acl_id = aws_default_vpc.default[0].default_network_acl_id
+  default_network_acl_id = aws_default_vpc.default.default_network_acl_id
 
   tags = merge(
     var.tags,
@@ -98,9 +92,7 @@ resource "aws_default_network_acl" "default" {
 }
 
 resource "aws_default_security_group" "default" {
-  count = var.enabled ? 1 : 0
-
-  vpc_id = aws_default_vpc.default[0].id
+  vpc_id = aws_default_vpc.default.id
 
   tags = merge(
     var.tags,
diff --git a/modules/vpc-baseline/migrations.tf b/modules/vpc-baseline/migrations.tf
new file mode 100644
index 00000000..363c5c26
--- /dev/null
+++ b/modules/vpc-baseline/migrations.tf
@@ -0,0 +1,23 @@
+# --------------------------------------------------------------------------------------------------
+# Migrations to 0.31.0
+# Removing `enabled` argument.
+# --------------------------------------------------------------------------------------------------
+moved {
+  from = aws_default_vpc.default[0]
+  to   = aws_default_vpc.default
+}
+
+moved {
+  from = aws_default_route_table.default[0]
+  to   = aws_default_route_table.default
+}
+
+moved {
+  from = aws_default_network_acl.default[0]
+  to   = aws_default_network_acl.default
+}
+
+moved {
+  from = aws_default_security_group.default[0]
+  to   = aws_default_security_group.default
+}
diff --git a/modules/vpc-baseline/outputs.tf b/modules/vpc-baseline/outputs.tf
index a50d0923..c6a6b069 100644
--- a/modules/vpc-baseline/outputs.tf
+++ b/modules/vpc-baseline/outputs.tf
@@ -1,24 +1,24 @@
 output "default_vpc" {
   description = "The default VPC."
-  value       = var.enabled ? aws_default_vpc.default[0] : null
+  value       = aws_default_vpc.default
 }
 
 output "default_security_group" {
   description = "The default security group."
-  value       = var.enabled ? aws_default_security_group.default[0] : null
+  value       = aws_default_security_group.default
 }
 
 output "default_network_acl" {
   description = "The default network ACL."
-  value       = var.enabled ? aws_default_network_acl.default[0] : null
+  value       = aws_default_network_acl.default
 }
 
 output "default_route_table" {
   description = "The default route table."
-  value       = var.enabled ? aws_default_route_table.default[0] : null
+  value       = aws_default_route_table.default
 }
 
 output "vpc_flow_logs_group" {
   description = "The CloudWatch Logs log group which stores VPC Flow Logs."
-  value       = var.enabled && local.is_cw_logs ? aws_cloudwatch_log_group.default_vpc_flow_logs[0] : null
+  value       = local.is_cw_logs ? aws_cloudwatch_log_group.default_vpc_flow_logs[0] : null
 }
diff --git a/modules/vpc-baseline/variables.tf b/modules/vpc-baseline/variables.tf
index a92dcb43..79bf944c 100644
--- a/modules/vpc-baseline/variables.tf
+++ b/modules/vpc-baseline/variables.tf
@@ -1,8 +1,3 @@
-variable "enabled" {
-  description = "The boolean flag whether this module is enabled or not. No resources are created when set to false."
-  default     = true
-}
-
 variable "enable_flow_logs" {
   description = "The boolean flag whether to enable VPC Flow Logs in the default VPC"
   default     = true
diff --git a/modules/vpc-baseline/versions.tf b/modules/vpc-baseline/versions.tf
index e95c3bb8..0103f91a 100644
--- a/modules/vpc-baseline/versions.tf
+++ b/modules/vpc-baseline/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13"
+  required_version = ">= 1.1.3"
 
   required_providers {
     aws = {
diff --git a/outputs.tf b/outputs.tf
index 7897d755..a3caaa12 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -13,7 +13,7 @@ output "audit_bucket" {
 
 output "alarm_sns_topic" {
   description = "The SNS topic to which CloudWatch Alarms will be sent."
-  value       = module.alarm_baseline.alarm_sns_topic
+  value       = one(module.alarm_baseline[*].alarm_sns_topic)
 }
 
 # --------------------------------------------------------------------------------------------------
@@ -22,27 +22,27 @@ output "alarm_sns_topic" {
 
 output "cloudtrail" {
   description = "The trail for recording events in all regions."
-  value       = module.cloudtrail_baseline.cloudtrail
+  value       = one(module.cloudtrail_baseline[*].cloudtrail)
 }
 
 output "cloudtrail_sns_topic" {
   description = "The sns topic linked to the cloudtrail."
-  value       = module.cloudtrail_baseline.cloudtrail_sns_topic
+  value       = one(module.cloudtrail_baseline[*].cloudtrail_sns_topic)
 }
 
 output "cloudtrail_kms_key" {
   description = "The KMS key used for encrypting CloudTrail events."
-  value       = module.cloudtrail_baseline.kms_key
+  value       = one(module.cloudtrail_baseline[*].kms_key)
 }
 
 output "cloudtrail_log_delivery_iam_role" {
   description = "The IAM role used for delivering CloudTrail events to CloudWatch Logs."
-  value       = module.cloudtrail_baseline.log_delivery_iam_role
+  value       = one(module.cloudtrail_baseline[*].log_delivery_iam_role)
 }
 
 output "cloudtrail_log_group" {
   description = "The CloudWatch Logs log group which stores CloudTrail events."
-  value       = module.cloudtrail_baseline.log_group
+  value       = one(module.cloudtrail_baseline[*].log_group)
 }
 
 # --------------------------------------------------------------------------------------------------
@@ -58,46 +58,46 @@ output "config_configuration_recorder" {
   description = "The configuration recorder in each region."
 
   value = {
-    "ap-northeast-1" = module.config_baseline_ap-northeast-1.configuration_recorder
-    "ap-northeast-2" = module.config_baseline_ap-northeast-2.configuration_recorder
-    "ap-northeast-3" = module.config_baseline_ap-northeast-3.configuration_recorder
-    "ap-south-1"     = module.config_baseline_ap-south-1.configuration_recorder
-    "ap-southeast-1" = module.config_baseline_ap-southeast-1.configuration_recorder
-    "ap-southeast-2" = module.config_baseline_ap-southeast-2.configuration_recorder
-    "ca-central-1"   = module.config_baseline_ca-central-1.configuration_recorder
-    "eu-central-1"   = module.config_baseline_eu-central-1.configuration_recorder
-    "eu-west-1"      = module.config_baseline_eu-west-1.configuration_recorder
-    "eu-west-2"      = module.config_baseline_eu-west-2.configuration_recorder
-    "eu-west-3"      = module.config_baseline_eu-west-3.configuration_recorder
-    "sa-east-1"      = module.config_baseline_sa-east-1.configuration_recorder
-    "us-east-1"      = module.config_baseline_us-east-1.configuration_recorder
-    "us-east-2"      = module.config_baseline_us-east-2.configuration_recorder
-    "us-west-1"      = module.config_baseline_us-west-1.configuration_recorder
-    "us-west-2"      = module.config_baseline_us-west-2.configuration_recorder
+    "ap-northeast-1" = one(module.config_baseline_ap-northeast-1[*].configuration_recorder)
+    "ap-northeast-2" = one(module.config_baseline_ap-northeast-2[*].configuration_recorder)
+    "ap-northeast-3" = one(module.config_baseline_ap-northeast-3[*].configuration_recorder)
+    "ap-south-1"     = one(module.config_baseline_ap-south-1[*].configuration_recorder)
+    "ap-southeast-1" = one(module.config_baseline_ap-southeast-1[*].configuration_recorder)
+    "ap-southeast-2" = one(module.config_baseline_ap-southeast-2[*].configuration_recorder)
+    "ca-central-1"   = one(module.config_baseline_ca-central-1[*].configuration_recorder)
+    "eu-central-1"   = one(module.config_baseline_eu-central-1[*].configuration_recorder)
+    "eu-west-1"      = one(module.config_baseline_eu-west-1[*].configuration_recorder)
+    "eu-west-2"      = one(module.config_baseline_eu-west-2[*].configuration_recorder)
+    "eu-west-3"      = one(module.config_baseline_eu-west-3[*].configuration_recorder)
+    "sa-east-1"      = one(module.config_baseline_sa-east-1[*].configuration_recorder)
+    "us-east-1"      = one(module.config_baseline_us-east-1[*].configuration_recorder)
+    "us-east-2"      = one(module.config_baseline_us-east-2[*].configuration_recorder)
+    "us-west-1"      = one(module.config_baseline_us-west-1[*].configuration_recorder)
+    "us-west-2"      = one(module.config_baseline_us-west-2[*].configuration_recorder)
   }
 }
 
 output "config_sns_topic" {
-  description = "The SNS topic that AWS Config delivers notifications to."
+  description = "The SNS topic) that AWS Config delivers notifications to."
 
   value = {
-    "ap-northeast-1" = module.config_baseline_ap-northeast-1.config_sns_topic
-    "ap-northeast-2" = module.config_baseline_ap-northeast-2.config_sns_topic
-    "ap-northeast-3" = module.config_baseline_ap-northeast-3.config_sns_topic
-    "ap-south-1"     = module.config_baseline_ap-south-1.config_sns_topic
-    "ap-southeast-1" = module.config_baseline_ap-southeast-1.config_sns_topic
-    "ap-southeast-2" = module.config_baseline_ap-southeast-2.config_sns_topic
-    "ca-central-1"   = module.config_baseline_ca-central-1.config_sns_topic
-    "eu-central-1"   = module.config_baseline_eu-central-1.config_sns_topic
-    "eu-north-1"     = module.config_baseline_eu-north-1.config_sns_topic
-    "eu-west-1"      = module.config_baseline_eu-west-1.config_sns_topic
-    "eu-west-2"      = module.config_baseline_eu-west-2.config_sns_topic
-    "eu-west-3"      = module.config_baseline_eu-west-3.config_sns_topic
-    "sa-east-1"      = module.config_baseline_sa-east-1.config_sns_topic
-    "us-east-1"      = module.config_baseline_us-east-1.config_sns_topic
-    "us-east-2"      = module.config_baseline_us-east-2.config_sns_topic
-    "us-west-1"      = module.config_baseline_us-west-1.config_sns_topic
-    "us-west-2"      = module.config_baseline_us-west-2.config_sns_topic
+    "ap-northeast-1" = one(module.config_baseline_ap-northeast-1[*].config_sns_topic)
+    "ap-northeast-2" = one(module.config_baseline_ap-northeast-2[*].config_sns_topic)
+    "ap-northeast-3" = one(module.config_baseline_ap-northeast-3[*].config_sns_topic)
+    "ap-south-1"     = one(module.config_baseline_ap-south-1[*].config_sns_topic)
+    "ap-southeast-1" = one(module.config_baseline_ap-southeast-1[*].config_sns_topic)
+    "ap-southeast-2" = one(module.config_baseline_ap-southeast-2[*].config_sns_topic)
+    "ca-central-1"   = one(module.config_baseline_ca-central-1[*].config_sns_topic)
+    "eu-central-1"   = one(module.config_baseline_eu-central-1[*].config_sns_topic)
+    "eu-north-1"     = one(module.config_baseline_eu-north-1[*].config_sns_topic)
+    "eu-west-1"      = one(module.config_baseline_eu-west-1[*].config_sns_topic)
+    "eu-west-2"      = one(module.config_baseline_eu-west-2[*].config_sns_topic)
+    "eu-west-3"      = one(module.config_baseline_eu-west-3[*].config_sns_topic)
+    "sa-east-1"      = one(module.config_baseline_sa-east-1[*].config_sns_topic)
+    "us-east-1"      = one(module.config_baseline_us-east-1[*].config_sns_topic)
+    "us-east-2"      = one(module.config_baseline_us-east-2[*].config_sns_topic)
+    "us-west-1"      = one(module.config_baseline_us-west-1[*].config_sns_topic)
+    "us-west-2"      = one(module.config_baseline_us-west-2[*].config_sns_topic)
   }
 }
 
@@ -109,22 +109,22 @@ output "guardduty_detector" {
   description = "The GuardDuty detector in each region."
 
   value = {
-    "ap-northeast-1" = module.guardduty_baseline_ap-northeast-1.guardduty_detector
-    "ap-northeast-2" = module.guardduty_baseline_ap-northeast-2.guardduty_detector
-    "ap-northeast-3" = module.guardduty_baseline_ap-northeast-3.guardduty_detector
-    "ap-south-1"     = module.guardduty_baseline_ap-south-1.guardduty_detector
-    "ap-southeast-1" = module.guardduty_baseline_ap-southeast-1.guardduty_detector
-    "ap-southeast-2" = module.guardduty_baseline_ap-southeast-2.guardduty_detector
-    "ca-central-1"   = module.guardduty_baseline_ca-central-1.guardduty_detector
-    "eu-central-1"   = module.guardduty_baseline_eu-central-1.guardduty_detector
-    "eu-north-1"     = module.guardduty_baseline_eu-north-1.guardduty_detector
-    "eu-west-1"      = module.guardduty_baseline_eu-west-1.guardduty_detector
-    "eu-west-2"      = module.guardduty_baseline_eu-west-2.guardduty_detector
-    "sa-east-1"      = module.guardduty_baseline_sa-east-1.guardduty_detector
-    "us-east-1"      = module.guardduty_baseline_us-east-1.guardduty_detector
-    "us-east-2"      = module.guardduty_baseline_us-east-2.guardduty_detector
-    "us-west-1"      = module.guardduty_baseline_us-west-1.guardduty_detector
-    "us-west-2"      = module.guardduty_baseline_us-west-2.guardduty_detector
+    "ap-northeast-1" = one(module.guardduty_baseline_ap-northeast-1[*].guardduty_detector)
+    "ap-northeast-2" = one(module.guardduty_baseline_ap-northeast-2[*].guardduty_detector)
+    "ap-northeast-3" = one(module.guardduty_baseline_ap-northeast-3[*].guardduty_detector)
+    "ap-south-1"     = one(module.guardduty_baseline_ap-south-1[*].guardduty_detector)
+    "ap-southeast-1" = one(module.guardduty_baseline_ap-southeast-1[*].guardduty_detector)
+    "ap-southeast-2" = one(module.guardduty_baseline_ap-southeast-2[*].guardduty_detector)
+    "ca-central-1"   = one(module.guardduty_baseline_ca-central-1[*].guardduty_detector)
+    "eu-central-1"   = one(module.guardduty_baseline_eu-central-1[*].guardduty_detector)
+    "eu-north-1"     = one(module.guardduty_baseline_eu-north-1[*].guardduty_detector)
+    "eu-west-1"      = one(module.guardduty_baseline_eu-west-1[*].guardduty_detector)
+    "eu-west-2"      = one(module.guardduty_baseline_eu-west-2[*].guardduty_detector)
+    "sa-east-1"      = one(module.guardduty_baseline_sa-east-1[*].guardduty_detector)
+    "us-east-1"      = one(module.guardduty_baseline_us-east-1[*].guardduty_detector)
+    "us-east-2"      = one(module.guardduty_baseline_us-east-2[*].guardduty_detector)
+    "us-west-1"      = one(module.guardduty_baseline_us-west-1[*].guardduty_detector)
+    "us-west-2"      = one(module.guardduty_baseline_us-west-2[*].guardduty_detector)
   }
 }
 
@@ -150,23 +150,23 @@ output "vpc_flow_logs_group" {
   description = "The CloudWatch Logs log group which stores VPC Flow Logs in each region."
 
   value = local.is_cw_logs ? {
-    "ap-northeast-1" = module.vpc_baseline_ap-northeast-1.vpc_flow_logs_group
-    "ap-northeast-2" = module.vpc_baseline_ap-northeast-2.vpc_flow_logs_group
-    "ap-northeast-3" = module.vpc_baseline_ap-northeast-3.vpc_flow_logs_group
-    "ap-south-1"     = module.vpc_baseline_ap-south-1.vpc_flow_logs_group
-    "ap-southeast-1" = module.vpc_baseline_ap-southeast-1.vpc_flow_logs_group
-    "ap-southeast-2" = module.vpc_baseline_ap-southeast-2.vpc_flow_logs_group
-    "ca-central-1"   = module.vpc_baseline_ca-central-1.vpc_flow_logs_group
-    "eu-central-1"   = module.vpc_baseline_eu-central-1.vpc_flow_logs_group
-    "eu-north-1"     = module.vpc_baseline_eu-north-1.vpc_flow_logs_group
-    "eu-west-1"      = module.vpc_baseline_eu-west-1.vpc_flow_logs_group
-    "eu-west-2"      = module.vpc_baseline_eu-west-2.vpc_flow_logs_group
-    "eu-west-3"      = module.vpc_baseline_eu-west-3.vpc_flow_logs_group
-    "sa-east-1"      = module.vpc_baseline_sa-east-1.vpc_flow_logs_group
-    "us-east-1"      = module.vpc_baseline_us-east-1.vpc_flow_logs_group
-    "us-east-2"      = module.vpc_baseline_us-east-2.vpc_flow_logs_group
-    "us-west-1"      = module.vpc_baseline_us-west-1.vpc_flow_logs_group
-    "us-west-2"      = module.vpc_baseline_us-west-2.vpc_flow_logs_group
+    "ap-northeast-1" = one(module.vpc_baseline_ap-northeast-1[*].vpc_flow_logs_group)
+    "ap-northeast-2" = one(module.vpc_baseline_ap-northeast-2[*].vpc_flow_logs_group)
+    "ap-northeast-3" = one(module.vpc_baseline_ap-northeast-3[*].vpc_flow_logs_group)
+    "ap-south-1"     = one(module.vpc_baseline_ap-south-1[*].vpc_flow_logs_group)
+    "ap-southeast-1" = one(module.vpc_baseline_ap-southeast-1[*].vpc_flow_logs_group)
+    "ap-southeast-2" = one(module.vpc_baseline_ap-southeast-2[*].vpc_flow_logs_group)
+    "ca-central-1"   = one(module.vpc_baseline_ca-central-1[*].vpc_flow_logs_group)
+    "eu-central-1"   = one(module.vpc_baseline_eu-central-1[*].vpc_flow_logs_group)
+    "eu-north-1"     = one(module.vpc_baseline_eu-north-1[*].vpc_flow_logs_group)
+    "eu-west-1"      = one(module.vpc_baseline_eu-west-1[*].vpc_flow_logs_group)
+    "eu-west-2"      = one(module.vpc_baseline_eu-west-2[*].vpc_flow_logs_group)
+    "eu-west-3"      = one(module.vpc_baseline_eu-west-3[*].vpc_flow_logs_group)
+    "sa-east-1"      = one(module.vpc_baseline_sa-east-1[*].vpc_flow_logs_group)
+    "us-east-1"      = one(module.vpc_baseline_us-east-1[*].vpc_flow_logs_group)
+    "us-east-2"      = one(module.vpc_baseline_us-east-2[*].vpc_flow_logs_group)
+    "us-west-1"      = one(module.vpc_baseline_us-west-1[*].vpc_flow_logs_group)
+    "us-west-2"      = one(module.vpc_baseline_us-west-2[*].vpc_flow_logs_group)
   } : null
 }
 
@@ -174,23 +174,23 @@ output "default_vpc" {
   description = "The default VPC."
 
   value = {
-    "ap-northeast-1" = module.vpc_baseline_ap-northeast-1.default_vpc
-    "ap-northeast-2" = module.vpc_baseline_ap-northeast-2.default_vpc
-    "ap-northeast-3" = module.vpc_baseline_ap-northeast-3.default_vpc
-    "ap-south-1"     = module.vpc_baseline_ap-south-1.default_vpc
-    "ap-southeast-1" = module.vpc_baseline_ap-southeast-1.default_vpc
-    "ap-southeast-2" = module.vpc_baseline_ap-southeast-2.default_vpc
-    "ca-central-1"   = module.vpc_baseline_ca-central-1.default_vpc
-    "eu-central-1"   = module.vpc_baseline_eu-central-1.default_vpc
-    "eu-north-1"     = module.vpc_baseline_eu-north-1.default_vpc
-    "eu-west-1"      = module.vpc_baseline_eu-west-1.default_vpc
-    "eu-west-2"      = module.vpc_baseline_eu-west-2.default_vpc
-    "eu-west-3"      = module.vpc_baseline_eu-west-3.default_vpc
-    "sa-east-1"      = module.vpc_baseline_sa-east-1.default_vpc
-    "us-east-1"      = module.vpc_baseline_us-east-1.default_vpc
-    "us-east-2"      = module.vpc_baseline_us-east-2.default_vpc
-    "us-west-1"      = module.vpc_baseline_us-west-1.default_vpc
-    "us-west-2"      = module.vpc_baseline_us-west-2.default_vpc
+    "ap-northeast-1" = one(module.vpc_baseline_ap-northeast-1[*].default_vpc)
+    "ap-northeast-2" = one(module.vpc_baseline_ap-northeast-2[*].default_vpc)
+    "ap-northeast-3" = one(module.vpc_baseline_ap-northeast-3[*].default_vpc)
+    "ap-south-1"     = one(module.vpc_baseline_ap-south-1[*].default_vpc)
+    "ap-southeast-1" = one(module.vpc_baseline_ap-southeast-1[*].default_vpc)
+    "ap-southeast-2" = one(module.vpc_baseline_ap-southeast-2[*].default_vpc)
+    "ca-central-1"   = one(module.vpc_baseline_ca-central-1[*].default_vpc)
+    "eu-central-1"   = one(module.vpc_baseline_eu-central-1[*].default_vpc)
+    "eu-north-1"     = one(module.vpc_baseline_eu-north-1[*].default_vpc)
+    "eu-west-1"      = one(module.vpc_baseline_eu-west-1[*].default_vpc)
+    "eu-west-2"      = one(module.vpc_baseline_eu-west-2[*].default_vpc)
+    "eu-west-3"      = one(module.vpc_baseline_eu-west-3[*].default_vpc)
+    "sa-east-1"      = one(module.vpc_baseline_sa-east-1[*].default_vpc)
+    "us-east-1"      = one(module.vpc_baseline_us-east-1[*].default_vpc)
+    "us-east-2"      = one(module.vpc_baseline_us-east-2[*].default_vpc)
+    "us-west-1"      = one(module.vpc_baseline_us-west-1[*].default_vpc)
+    "us-west-2"      = one(module.vpc_baseline_us-west-2[*].default_vpc)
   }
 }
 
@@ -198,23 +198,23 @@ output "default_security_group" {
   description = "The ID of the default security group."
 
   value = {
-    "ap-northeast-1" = module.vpc_baseline_ap-northeast-1.default_security_group
-    "ap-northeast-2" = module.vpc_baseline_ap-northeast-2.default_security_group
-    "ap-northeast-3" = module.vpc_baseline_ap-northeast-3.default_security_group
-    "ap-south-1"     = module.vpc_baseline_ap-south-1.default_security_group
-    "ap-southeast-1" = module.vpc_baseline_ap-southeast-1.default_security_group
-    "ap-southeast-2" = module.vpc_baseline_ap-southeast-2.default_security_group
-    "ca-central-1"   = module.vpc_baseline_ca-central-1.default_security_group
-    "eu-central-1"   = module.vpc_baseline_eu-central-1.default_security_group
-    "eu-north-1"     = module.vpc_baseline_eu-north-1.default_security_group
-    "eu-west-1"      = module.vpc_baseline_eu-west-1.default_security_group
-    "eu-west-2"      = module.vpc_baseline_eu-west-2.default_security_group
-    "eu-west-3"      = module.vpc_baseline_eu-west-3.default_security_group
-    "sa-east-1"      = module.vpc_baseline_sa-east-1.default_security_group
-    "us-east-1"      = module.vpc_baseline_us-east-1.default_security_group
-    "us-east-2"      = module.vpc_baseline_us-east-2.default_security_group
-    "us-west-1"      = module.vpc_baseline_us-west-1.default_security_group
-    "us-west-2"      = module.vpc_baseline_us-west-2.default_security_group
+    "ap-northeast-1" = one(module.vpc_baseline_ap-northeast-1[*].default_security_group)
+    "ap-northeast-2" = one(module.vpc_baseline_ap-northeast-2[*].default_security_group)
+    "ap-northeast-3" = one(module.vpc_baseline_ap-northeast-3[*].default_security_group)
+    "ap-south-1"     = one(module.vpc_baseline_ap-south-1[*].default_security_group)
+    "ap-southeast-1" = one(module.vpc_baseline_ap-southeast-1[*].default_security_group)
+    "ap-southeast-2" = one(module.vpc_baseline_ap-southeast-2[*].default_security_group)
+    "ca-central-1"   = one(module.vpc_baseline_ca-central-1[*].default_security_group)
+    "eu-central-1"   = one(module.vpc_baseline_eu-central-1[*].default_security_group)
+    "eu-north-1"     = one(module.vpc_baseline_eu-north-1[*].default_security_group)
+    "eu-west-1"      = one(module.vpc_baseline_eu-west-1[*].default_security_group)
+    "eu-west-2"      = one(module.vpc_baseline_eu-west-2[*].default_security_group)
+    "eu-west-3"      = one(module.vpc_baseline_eu-west-3[*].default_security_group)
+    "sa-east-1"      = one(module.vpc_baseline_sa-east-1[*].default_security_group)
+    "us-east-1"      = one(module.vpc_baseline_us-east-1[*].default_security_group)
+    "us-east-2"      = one(module.vpc_baseline_us-east-2[*].default_security_group)
+    "us-west-1"      = one(module.vpc_baseline_us-west-1[*].default_security_group)
+    "us-west-2"      = one(module.vpc_baseline_us-west-2[*].default_security_group)
   }
 }
 
@@ -222,23 +222,23 @@ output "default_network_acl" {
   description = "The default network ACL."
 
   value = {
-    "ap-northeast-1" = module.vpc_baseline_ap-northeast-1.default_network_acl
-    "ap-northeast-2" = module.vpc_baseline_ap-northeast-2.default_network_acl
-    "ap-northeast-3" = module.vpc_baseline_ap-northeast-3.default_network_acl
-    "ap-south-1"     = module.vpc_baseline_ap-south-1.default_network_acl
-    "ap-southeast-1" = module.vpc_baseline_ap-southeast-1.default_network_acl
-    "ap-southeast-2" = module.vpc_baseline_ap-southeast-2.default_network_acl
-    "ca-central-1"   = module.vpc_baseline_ca-central-1.default_network_acl
-    "eu-central-1"   = module.vpc_baseline_eu-central-1.default_network_acl
-    "eu-north-1"     = module.vpc_baseline_eu-north-1.default_network_acl
-    "eu-west-1"      = module.vpc_baseline_eu-west-1.default_network_acl
-    "eu-west-2"      = module.vpc_baseline_eu-west-2.default_network_acl
-    "eu-west-3"      = module.vpc_baseline_eu-west-3.default_network_acl
-    "sa-east-1"      = module.vpc_baseline_sa-east-1.default_network_acl
-    "us-east-1"      = module.vpc_baseline_us-east-1.default_network_acl
-    "us-east-2"      = module.vpc_baseline_us-east-2.default_network_acl
-    "us-west-1"      = module.vpc_baseline_us-west-1.default_network_acl
-    "us-west-2"      = module.vpc_baseline_us-west-2.default_network_acl
+    "ap-northeast-1" = one(module.vpc_baseline_ap-northeast-1[*].default_network_acl)
+    "ap-northeast-2" = one(module.vpc_baseline_ap-northeast-2[*].default_network_acl)
+    "ap-northeast-3" = one(module.vpc_baseline_ap-northeast-3[*].default_network_acl)
+    "ap-south-1"     = one(module.vpc_baseline_ap-south-1[*].default_network_acl)
+    "ap-southeast-1" = one(module.vpc_baseline_ap-southeast-1[*].default_network_acl)
+    "ap-southeast-2" = one(module.vpc_baseline_ap-southeast-2[*].default_network_acl)
+    "ca-central-1"   = one(module.vpc_baseline_ca-central-1[*].default_network_acl)
+    "eu-central-1"   = one(module.vpc_baseline_eu-central-1[*].default_network_acl)
+    "eu-north-1"     = one(module.vpc_baseline_eu-north-1[*].default_network_acl)
+    "eu-west-1"      = one(module.vpc_baseline_eu-west-1[*].default_network_acl)
+    "eu-west-2"      = one(module.vpc_baseline_eu-west-2[*].default_network_acl)
+    "eu-west-3"      = one(module.vpc_baseline_eu-west-3[*].default_network_acl)
+    "sa-east-1"      = one(module.vpc_baseline_sa-east-1[*].default_network_acl)
+    "us-east-1"      = one(module.vpc_baseline_us-east-1[*].default_network_acl)
+    "us-east-2"      = one(module.vpc_baseline_us-east-2[*].default_network_acl)
+    "us-west-1"      = one(module.vpc_baseline_us-west-1[*].default_network_acl)
+    "us-west-2"      = one(module.vpc_baseline_us-west-2[*].default_network_acl)
   }
 }
 
@@ -246,23 +246,23 @@ output "default_route_table" {
   description = "The default route table."
 
   value = {
-    "ap-northeast-1" = module.vpc_baseline_ap-northeast-1.default_route_table
-    "ap-northeast-2" = module.vpc_baseline_ap-northeast-2.default_route_table
-    "ap-northeast-3" = module.vpc_baseline_ap-northeast-3.default_route_table
-    "ap-south-1"     = module.vpc_baseline_ap-south-1.default_route_table
-    "ap-southeast-1" = module.vpc_baseline_ap-southeast-1.default_route_table
-    "ap-southeast-2" = module.vpc_baseline_ap-southeast-2.default_route_table
-    "ca-central-1"   = module.vpc_baseline_ca-central-1.default_route_table
-    "eu-central-1"   = module.vpc_baseline_eu-central-1.default_route_table
-    "eu-north-1"     = module.vpc_baseline_eu-north-1.default_route_table
-    "eu-west-1"      = module.vpc_baseline_eu-west-1.default_route_table
-    "eu-west-2"      = module.vpc_baseline_eu-west-2.default_route_table
-    "eu-west-3"      = module.vpc_baseline_eu-west-3.default_route_table
-    "sa-east-1"      = module.vpc_baseline_sa-east-1.default_route_table
-    "us-east-1"      = module.vpc_baseline_us-east-1.default_route_table
-    "us-east-2"      = module.vpc_baseline_us-east-2.default_route_table
-    "us-west-1"      = module.vpc_baseline_us-west-1.default_route_table
-    "us-west-2"      = module.vpc_baseline_us-west-2.default_route_table
+    "ap-northeast-1" = one(module.vpc_baseline_ap-northeast-1[*].default_route_table)
+    "ap-northeast-2" = one(module.vpc_baseline_ap-northeast-2[*].default_route_table)
+    "ap-northeast-3" = one(module.vpc_baseline_ap-northeast-3[*].default_route_table)
+    "ap-south-1"     = one(module.vpc_baseline_ap-south-1[*].default_route_table)
+    "ap-southeast-1" = one(module.vpc_baseline_ap-southeast-1[*].default_route_table)
+    "ap-southeast-2" = one(module.vpc_baseline_ap-southeast-2[*].default_route_table)
+    "ca-central-1"   = one(module.vpc_baseline_ca-central-1[*].default_route_table)
+    "eu-central-1"   = one(module.vpc_baseline_eu-central-1[*].default_route_table)
+    "eu-north-1"     = one(module.vpc_baseline_eu-north-1[*].default_route_table)
+    "eu-west-1"      = one(module.vpc_baseline_eu-west-1[*].default_route_table)
+    "eu-west-2"      = one(module.vpc_baseline_eu-west-2[*].default_route_table)
+    "eu-west-3"      = one(module.vpc_baseline_eu-west-3[*].default_route_table)
+    "sa-east-1"      = one(module.vpc_baseline_sa-east-1[*].default_route_table)
+    "us-east-1"      = one(module.vpc_baseline_us-east-1[*].default_route_table)
+    "us-east-2"      = one(module.vpc_baseline_us-east-2[*].default_route_table)
+    "us-west-1"      = one(module.vpc_baseline_us-west-1[*].default_route_table)
+    "us-west-2"      = one(module.vpc_baseline_us-west-2[*].default_route_table)
   }
 }
 
diff --git a/securityhub_baselines.tf b/securityhub_baselines.tf
index ba90ed9a..19c07e1a 100644
--- a/securityhub_baselines.tf
+++ b/securityhub_baselines.tf
@@ -6,12 +6,13 @@ locals {
 }
 
 module "securityhub_baseline_ap-northeast-1" {
+  count  = contains(var.target_regions, "ap-northeast-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
-  enabled                          = contains(var.target_regions, "ap-northeast-1") && var.securityhub_enabled
+
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -19,13 +20,13 @@ module "securityhub_baseline_ap-northeast-1" {
 }
 
 module "securityhub_baseline_ap-northeast-2" {
+  count  = contains(var.target_regions, "ap-northeast-2") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
 
-  enabled                          = contains(var.target_regions, "ap-northeast-2") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -34,13 +35,13 @@ module "securityhub_baseline_ap-northeast-2" {
 }
 
 module "securityhub_baseline_ap-northeast-3" {
+  count  = contains(var.target_regions, "ap-northeast-3") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
 
-  enabled                          = contains(var.target_regions, "ap-northeast-3") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -49,13 +50,13 @@ module "securityhub_baseline_ap-northeast-3" {
 }
 
 module "securityhub_baseline_ap-south-1" {
+  count  = contains(var.target_regions, "ap-south-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
 
-  enabled                          = contains(var.target_regions, "ap-south-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -64,13 +65,13 @@ module "securityhub_baseline_ap-south-1" {
 }
 
 module "securityhub_baseline_ap-southeast-1" {
+  count  = contains(var.target_regions, "ap-southeast-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
 
-  enabled                          = contains(var.target_regions, "ap-southeast-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -79,13 +80,13 @@ module "securityhub_baseline_ap-southeast-1" {
 }
 
 module "securityhub_baseline_ap-southeast-2" {
+  count  = contains(var.target_regions, "ap-southeast-2") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ap-southeast-2
   }
 
-  enabled                          = contains(var.target_regions, "ap-southeast-2") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -94,13 +95,13 @@ module "securityhub_baseline_ap-southeast-2" {
 }
 
 module "securityhub_baseline_ca-central-1" {
+  count  = contains(var.target_regions, "ca-central-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
 
-  enabled                          = contains(var.target_regions, "ca-central-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -109,13 +110,13 @@ module "securityhub_baseline_ca-central-1" {
 }
 
 module "securityhub_baseline_eu-central-1" {
+  count  = contains(var.target_regions, "eu-central-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
 
-  enabled                          = contains(var.target_regions, "eu-central-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -124,13 +125,13 @@ module "securityhub_baseline_eu-central-1" {
 }
 
 module "securityhub_baseline_eu-north-1" {
+  count  = contains(var.target_regions, "eu-north-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
 
-  enabled                          = contains(var.target_regions, "eu-north-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -139,13 +140,13 @@ module "securityhub_baseline_eu-north-1" {
 }
 
 module "securityhub_baseline_eu-west-1" {
+  count  = contains(var.target_regions, "eu-west-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
 
-  enabled                          = contains(var.target_regions, "eu-west-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -154,13 +155,13 @@ module "securityhub_baseline_eu-west-1" {
 }
 
 module "securityhub_baseline_eu-west-2" {
+  count  = contains(var.target_regions, "eu-west-2") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
 
-  enabled                          = contains(var.target_regions, "eu-west-2") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -169,13 +170,13 @@ module "securityhub_baseline_eu-west-2" {
 }
 
 module "securityhub_baseline_eu-west-3" {
+  count  = contains(var.target_regions, "eu-west-3") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
 
-  enabled                          = contains(var.target_regions, "eu-west-3") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -184,13 +185,13 @@ module "securityhub_baseline_eu-west-3" {
 }
 
 module "securityhub_baseline_sa-east-1" {
+  count  = contains(var.target_regions, "sa-east-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
 
-  enabled                          = contains(var.target_regions, "sa-east-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -199,13 +200,13 @@ module "securityhub_baseline_sa-east-1" {
 }
 
 module "securityhub_baseline_us-east-1" {
+  count  = contains(var.target_regions, "us-east-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
 
-  enabled                          = contains(var.target_regions, "us-east-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -214,13 +215,13 @@ module "securityhub_baseline_us-east-1" {
 }
 
 module "securityhub_baseline_us-east-2" {
+  count  = contains(var.target_regions, "us-east-2") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
 
-  enabled                          = contains(var.target_regions, "us-east-2") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -229,13 +230,13 @@ module "securityhub_baseline_us-east-2" {
 }
 
 module "securityhub_baseline_us-west-1" {
+  count  = contains(var.target_regions, "us-west-1") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
 
-  enabled                          = contains(var.target_regions, "us-west-1") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
@@ -244,13 +245,13 @@ module "securityhub_baseline_us-west-1" {
 }
 
 module "securityhub_baseline_us-west-2" {
+  count  = contains(var.target_regions, "us-west-2") && var.securityhub_enabled ? 1 : 0
   source = "./modules/securityhub-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
 
-  enabled                          = contains(var.target_regions, "us-west-2") && var.securityhub_enabled
   enable_cis_standard              = var.securityhub_enable_cis_standard
   enable_pci_dss_standard          = var.securityhub_enable_pci_dss_standard
   enable_aws_foundational_standard = var.securityhub_enable_aws_foundational_standard
diff --git a/vpc_baselines.tf b/vpc_baselines.tf
index 4bb08b5d..ba364029 100644
--- a/vpc_baselines.tf
+++ b/vpc_baselines.tf
@@ -62,13 +62,13 @@ resource "aws_iam_role_policy" "flow_logs_publish_policy" {
 # --------------------------------------------------------------------------------------------------
 
 module "vpc_baseline_ap-northeast-1" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-northeast-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-northeast-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-northeast-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -82,13 +82,13 @@ module "vpc_baseline_ap-northeast-1" {
 }
 
 module "vpc_baseline_ap-northeast-2" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-northeast-2") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-northeast-2
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-northeast-2")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -102,13 +102,13 @@ module "vpc_baseline_ap-northeast-2" {
 }
 
 module "vpc_baseline_ap-northeast-3" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-northeast-3") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-northeast-3
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-northeast-3")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -122,13 +122,13 @@ module "vpc_baseline_ap-northeast-3" {
 }
 
 module "vpc_baseline_ap-south-1" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-south-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-south-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-south-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -142,13 +142,13 @@ module "vpc_baseline_ap-south-1" {
 }
 
 module "vpc_baseline_ap-southeast-1" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-southeast-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-southeast-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-southeast-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -162,13 +162,13 @@ module "vpc_baseline_ap-southeast-1" {
 }
 
 module "vpc_baseline_ap-southeast-2" {
+  count  = local.is_enabled && contains(var.target_regions, "ap-southeast-2") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ap-southeast-2
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ap-southeast-2")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -182,13 +182,13 @@ module "vpc_baseline_ap-southeast-2" {
 }
 
 module "vpc_baseline_ca-central-1" {
+  count  = local.is_enabled && contains(var.target_regions, "ca-central-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.ca-central-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "ca-central-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -202,13 +202,13 @@ module "vpc_baseline_ca-central-1" {
 }
 
 module "vpc_baseline_eu-central-1" {
+  count  = local.is_enabled && contains(var.target_regions, "eu-central-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.eu-central-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "eu-central-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -222,13 +222,13 @@ module "vpc_baseline_eu-central-1" {
 }
 
 module "vpc_baseline_eu-north-1" {
+  count  = local.is_enabled && contains(var.target_regions, "eu-north-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.eu-north-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "eu-north-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -242,13 +242,13 @@ module "vpc_baseline_eu-north-1" {
 }
 
 module "vpc_baseline_eu-west-1" {
+  count  = local.is_enabled && contains(var.target_regions, "eu-west-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.eu-west-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "eu-west-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -262,13 +262,13 @@ module "vpc_baseline_eu-west-1" {
 }
 
 module "vpc_baseline_eu-west-2" {
+  count  = local.is_enabled && contains(var.target_regions, "eu-west-2") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.eu-west-2
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "eu-west-2")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -282,13 +282,13 @@ module "vpc_baseline_eu-west-2" {
 }
 
 module "vpc_baseline_eu-west-3" {
+  count  = local.is_enabled && contains(var.target_regions, "eu-west-3") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.eu-west-3
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "eu-west-3")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -302,13 +302,13 @@ module "vpc_baseline_eu-west-3" {
 }
 
 module "vpc_baseline_sa-east-1" {
+  count  = local.is_enabled && contains(var.target_regions, "sa-east-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.sa-east-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "sa-east-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -322,13 +322,13 @@ module "vpc_baseline_sa-east-1" {
 }
 
 module "vpc_baseline_us-east-1" {
+  count  = local.is_enabled && contains(var.target_regions, "us-east-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.us-east-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "us-east-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -342,13 +342,13 @@ module "vpc_baseline_us-east-1" {
 }
 
 module "vpc_baseline_us-east-2" {
+  count  = local.is_enabled && contains(var.target_regions, "us-east-2") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.us-east-2
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "us-east-2")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -362,13 +362,13 @@ module "vpc_baseline_us-east-2" {
 }
 
 module "vpc_baseline_us-west-1" {
+  count  = local.is_enabled && contains(var.target_regions, "us-west-1") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.us-west-1
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "us-west-1")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name
@@ -382,13 +382,13 @@ module "vpc_baseline_us-west-1" {
 }
 
 module "vpc_baseline_us-west-2" {
+  count  = local.is_enabled && contains(var.target_regions, "us-west-2") ? 1 : 0
   source = "./modules/vpc-baseline"
 
   providers = {
     aws = aws.us-west-2
   }
 
-  enabled                     = local.is_enabled && contains(var.target_regions, "us-west-2")
   enable_flow_logs            = var.vpc_enable_flow_logs
   flow_logs_destination_type  = var.vpc_flow_logs_destination_type
   flow_logs_log_group_name    = var.vpc_flow_logs_log_group_name