Deploy GuardDuty across the organizations

[DevShrekOps]

• [x] Create a new directory capabilities/guardduty.
• [x] Create subdirectories for the prod and dev root modules, and the resources child module.
• [x] Prepare the management accounts:
  • [x] Enable trusted access between Organizations and GuardDuty.
  • [x] Register the security accounts as delegated admins for GuardDuty in all enabled regions.
• [x] Enable GuardDuty in the security accounts in all enabled regions.
• [x] Configure GuardDuty to automatically be enabled in all member accounts in all enabled regions.
• [x] Configure GuardDuty to automatically enable all features in all accounts in all enabled regions.
  • [x] Don't yet automatically enable agent & addon management of the runtime monitoring feature. More research required.

[DevShrekOps]

I ran into a lot of problems with this task related to performing an action in all enabled regions of an account:

• Although a data source exists to fetch a list of enabled regions in an account, the list can't be looped over in a resource block because Terraform needs to know at plan time the number of instances of a resource being created with for_each or count, as well as the keys for for_each, whereas the list from the data source wouldn't be known until apply time.
• Even given a list of enabled regions that's known at plan time, Terraform doesn't support looping through that list in a providers block. Instead, a separate providers block needs to be declared per region with the region hard-coded.
• Likewise, a separate resource or module block needs to be declared for each region.
• Much like CloudTrail, enabling org GuardDuty will require separate changes to multiple accounts. As much as I like having one Terraform config per account (e.g., to make it easy to track all resources created within each account), I very much don't like separate parts of the same capability being scattered across multiple Terraform configs.

It's possible the upcoming Terraform Stacks feature will provide solutions for the above issues, but in the meantime, I'm exploring other ways to approach this type of task, even if means some rearchitecture.