# &lt;module-name&gt; — &lt;plain-language description&gt;

> **Module kind:** primitive  |  **Version:** 1.0.0

## Overview

One or two sentences describing what this module provisions, in plain
language. No jargon. A reader should know after this paragraph whether
this module is what they need.

## Resources

Terraform resources this module creates:

| Resource | Type | Purpose |
|----------|------|---------|
| `&lt;name&gt;` | `aws_&lt;type&gt;` | what it does |

## Inputs

| Name | Type | Required | Default | Description |
|------|------|----------|---------|-------------|
| `&lt;name&gt;` | string | yes | — | description |

## Outputs

| Name | Type | Description |
|------|------|-------------|
| `&lt;name&gt;` | string | description |

## NFRs

Non-functional requirements declared by the module's interface. Every
L1 primitive MUST declare `deletion_protection` and `encryption_enabled`
(both boolean, default `true`); they are mandatory NFRs for every L1.

| Name | Type | Default | Description |
|------|------|---------|-------------|
| `deletion_protection` | boolean | true | Prevent resource destruction via Terraform lifecycle prevent_destroy. |
| `encryption_enabled` | boolean | true | Enable encryption (at rest or in transit, as applicable). |
| `&lt;name&gt;` | &lt;type&gt; | &lt;default&gt; | description |

## Usage

```
# A concrete snippet showing how to reference this module or what a
# consumer writes to use it.
```

## Compliance extension points

Resources this module could be extended with for the future compliance
milestone (GDPR, SOX, SOC2, DORA). Not implemented yet — listed
so the redesign can plan for them.

- **&lt;area&gt;** — &lt;what could be added, e.g. KMS key for encryption&gt;

## Versioning

`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR
bumps require a new registry entry (immutable publication); old entries
enter a 12-month deprecation window.