google · ForeverYoung48 · Jul 21, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-# Copyright 2025 Google LLC
+# Copyright 2026 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+
 workflow:
   rules:
     - when: never # This rule will always prevent the pipeline from running until we have a properly configured and registered runner instance.

diff --git a/.tflint.hcl b/.tflint.hcl
@@ -1,3 +1,19 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 // Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");

diff --git a/GEMINI.md b/GEMINI.md
@@ -1,3 +1,19 @@
+<!--
+Copyright 2026 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
 # gemini.md - AI Assistant Guidelines for Stellar Engine
 
 ## Project Overview

diff --git a/README.md b/README.md
@@ -1,3 +1,19 @@
+<!--
+Copyright 2026 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
 ## Introduction
 
 Stellar Engine is a fork of the Google Cloud Foundation Fabric (CFF) repository, aimed at providing Infrastructure as Code (IaC) for Google Cloud Platform (GCP) customers who need to create a landing zone environment with the Assured Workload overlays. In addition to the IaC, there is [documentation available](docs/path-to-authorization.md) for both the DISA FedRAMP High (FRH), DoD Impact Level 4 (IL4) and DoD Impact Level (IL5) compliance regimes that provide a mapping of National Institute of Standards and Technology (NIST) 800-53r5 controls to enable projects that leverage the Stellar Engine codebase to accelerate the speed at which an Authorization to Operate (ATO) can be attained.

diff --git a/automation/allow_bq.sh b/automation/allow_bq.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#### Use this script at your own risk. The author assumes no responsibility for any damages or losses incurred through its use.
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+cd "${SCRIPT_DIR}" || exit
+
+# shellcheck source=automation/config.env.sample
+source "${SCRIPT_DIR}"/config.env
+
+
+# Mapping abbreviations
+if [[ ${COMPLIANCE_REGIME} == "FEDRAMP_HIGH" ]]; then
+  COMPLIANCE_REGIME="FRH"
+elif [[ ${COMPLIANCE_REGIME} == "FEDRAMP_MODERATE" ]]; then
+  COMPLIANCE_REGIME="FRM"
+fi
+
+aw_folder=$(gcloud resource-manager folders list --folder="${TOP_LEVEL_FOLDER_ID}" --filter="display_name:${COMPLIANCE_REGIME}-${PREFIX}" --format="value(ID)")
+echo 'constraint: constraints/gcp.restrictServiceUsage' > tmp_aw_policy.yaml
+
+gcloud resource-manager org-policies describe constraints/gcp.restrictServiceUsage --folder="${aw_folder}" --format='yaml(listPolicy.allowedValues)' >> tmp_aw_policy.yaml
+{
+  echo "  - bigquery.googleapis.com"
+  echo "  - bigqueryconnection.googleapis.com"
+  echo "  - bigquerydatapolicy.googleapis.com"
+  echo "  - bigquerydatatransfer.googleapis.com"
+  echo "  - bigquerymigration.googleapis.com"
+  echo "  - bigqueryreservation.googleapis.com"
+  echo "  - bigquerystorage.googleapis.com"
+
+} >> tmp_aw_policy.yaml
+
+gcloud resource-manager org-policies set-policy tmp_aw_policy.yaml --folder="${aw_folder}"
diff --git a/automation/allow_compliance_apis.sh b/automation/allow_compliance_apis.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) 
+cd "${SCRIPT_DIR}" || exit
+
+compliance_LIST="${SCRIPT_DIR}/allowed_apis.yaml"
+LZ_EXCEPTIONS="${SCRIPT_DIR}/lz_exceptions.yaml"
+PLAN_FILE="tfplan"
+
+echo "-------------------------------------------------------"
+echo "Running compliance IL5 + COA2 API Cross-Check..."
+echo "-------------------------------------------------------"
+
+if [[ ! -f "$compliance_LIST" ]]; then
+    echo "[ERROR] compliance list not found at $compliance_LIST"
+    exit 1
+fi
+
+if [[ ! -f "$LZ_EXCEPTIONS" ]]; then
+    echo "[ERROR] LZ Exceptions list not found at $LZ_EXCEPTIONS"
+    exit 1
+fi
+
+ALLOWED_compliance=$(yq eval '.allowed_apis[]' "$compliance_LIST")
+ALLOWED_COA2=$(yq eval '.COA2[]' "$LZ_EXCEPTIONS")
+
+ALLOWED_APIS=$(echo -e "${ALLOWED_compliance}\n${ALLOWED_COA2}" | sort -u | sed '/^null$/d')
+
+cd "${SCRIPT_DIR}/../fast/stages-aw/1-assured-workload" || exit 1
+if [[ ! -f "$PLAN_FILE" ]]; then
+    echo "Creating temporary plan for validation..."
+    terraform plan -out="$PLAN_FILE" > /dev/null
+fi
+
+REQUESTED_APIS=$(terraform show -json "$PLAN_FILE" | jq -r '.resource_changes[]? | select(.type == "google_project_service") | .change.after.service' | sort -u)
+MISSING_APIS=""
+
+for api in $REQUESTED_APIS; do
+    if ! echo "$ALLOWED_APIS" | grep -qx "$api"; then
+        echo "[!] VIOLATION: '$api' is NOT in the compliance approved list or COA2 exceptions."
+        MISSING_APIS+="$api "
+    fi
+done
+
+if [[ -n "$MISSING_APIS" ]]; then
+    echo -e "\n[ERROR] compliance COMPLIANCE FAILURE"
+    echo "The following APIs are requested in code but missing from approved lists:"
+    for missing in $MISSING_APIS; do echo "  - $missing"; done
+    exit 1
+else
+    echo "compliance/COA2 Cross-Check Passed: All requested services are authorized."
+    exit 0
+fi
diff --git a/automation/allowed_apis.yaml b/automation/allowed_apis.yaml
@@ -0,0 +1,48 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#testing purposes API's that already match existing list in the org. 
+allowed_apis:
+  - artifactregistry.googleapis.com
+  - bigquery.googleapis.com
+  - bigquerydatatransfer.googleapis.com
+  - privateca.googleapis.com
+  - cloudbuild.googleapis.com
+  - composer.googleapis.com
+  - datafusion.googleapis.com
+  - dns.googleapis.com
+  - cloudidentity.googleapis.com
+  - cloudkms.googleapis.com
+  - logging.googleapis.com
+  - monitoring.googleapis.com
+  - run.googleapis.com
+  - spanner.googleapis.com
+  - sqladmin.googleapis.com
+  - storage.googleapis.com
+  - cloudtasks.googleapis.com
+  - vision.googleapis.com
+  - workstations.googleapis.com
+  - compute.googleapis.com
+  - dataflow.googleapis.com
+  - dataproc.googleapis.com
+  - eventarc.googleapis.com
+  - gkehub.googleapis.com
+  - container.googleapis.com
+  - iam.googleapis.com
+  - redis.googleapis.com
+  - pubsub.googleapis.com
+  - secretmanager.googleapis.com
+  - dlp.googleapis.com
+  - speech.googleapis.com
+  - datapipelines.googleapis.com
diff --git a/automation/clean.sh b/automation/clean.sh
@@ -0,0 +1,81 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#### This script is an experimental state, and is designed to help clean environments
+#### Use this script at your own risk. The author assumes no responsibility for any damages or losses incurred through its use.
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# shellcheck source=automation/config.env.sample
+source "${SCRIPT_DIR}"/config.env
+
+# Tags
+parent_tag_name=$(gcloud resource-manager tags keys list \
+  --parent=organizations/"${ORGANIZATION_ID}" \
+  --format="value(name)")
+
+child_tag_name=$(gcloud resource-manager tags values list \
+  --parent="${parent_tag_name}" \
+  --format="value(name)")
+
+gcloud resource-manager tags values delete "$child_tag_name"
+gcloud resource-manager tags keys delete "$parent_tag_name"
+
+# Custom Org Roles
+declare -a custom_org_roles=()
+while IFS= read -r role_name; do
+    custom_org_roles+=("$role_name")
+done < <(gcloud iam roles list \
+          --organization="${ORGANIZATION_ID}" \
+          --filter='name~^organizations/' \
+          --format='value(name)' | awk -F'/' '{print $NF}' 2>/dev/null)
+
+for i in "${custom_org_roles[@]}"; do
+  gcloud iam roles delete --organization="${ORGANIZATION_ID}" "$i"
+done
+
+# Log Sinks
+gcloud logging sinks delete "empty-audit-logs" --organization="$ORGANIZATION_ID"
+gcloud logging sinks delete "workspace-audit-logs" --organization="$ORGANIZATION_ID"
+gcloud logging sinks delete "vpc-sc" --organization="$ORGANIZATION_ID"
+gcloud logging sinks delete "audit-logs" --organization="$ORGANIZATION_ID"
+
+# Org Roles
+gcloud iam roles delete gcveNetworkAdmin --organization="$ORGANIZATION_ID"
+gcloud iam roles delete storageViewer --organization="$ORGANIZATION_ID"
+gcloud iam roles delete organizationIamAdmin --organization="$ORGANIZATION_ID"
+gcloud iam roles delete tenantNetworkAdmin --organization="$ORGANIZATION_ID"
+gcloud iam roles delete tagViewer --organization="$ORGANIZATION_ID"
+gcloud iam roles delete serviceProjectNetworkAdmin --organization="$ORGANIZATION_ID"
+gcloud iam roles delete organizationAdminViewer --organization="$ORGANIZATION_ID"
+
+# Org Policies
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/clouddeploy.disableServiceLabelGeneration
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/cloudfunctions.requireVPCConnector
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableAllIpv6
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableHybridCloudIpv6
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableInternetNetworkEndpointGroup
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableSshInBrowser
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableVpcExternalIpv6
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.disableVpcInternalIpv6
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.requireOsLogin
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/essentialcontacts.disableProjectSecurityContacts
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/firestore.requireP4SAforImportExport
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/gcp.detailedAuditLoggingMode
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/gcp.disableCloudLogging
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/iam.disableServiceAccountCreation
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/iap.requireGlobalIapWebDisabled
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/iap.requireRegionalIapWebDisabled
+gcloud resource-manager org-policies delete --organization="$ORGANIZATION_ID" constraints/compute.requireOsLogin
diff --git a/automation/compliance_exceptions.yaml b/automation/compliance_exceptions.yaml
@@ -0,0 +1,43 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# lz_exceptions.yaml
+# Combined list of Category 1 and Category 2 API exceptions for LZ Infrastructure
+# These APIs are authorized for use in Core LZ projects only.
+COA2:
+# Category 1: IL5 Authorized / compliance Catalog Update Pending
+#category_1_exceptions:
+  - accesscontextmanager.googleapis.com
+  - cloudasset.googleapis.com
+  - cloudbilling.googleapis.com
+  - networkconnectivity.googleapis.com
+  - servicedirectory.googleapis.com
+# Category 2: Management/Enabling APIs Not Listed in compliance Catalog
+# category_2_exceptions:
+  - assuredworkloads.googleapis.com
+  - bigqueryreservation.googleapis.com
+  - bigquerystorage.googleapis.com
+  - billingbudgets.googleapis.com
+  - cloudquotas.googleapis.com
+  - cloudresourcemanager.googleapis.com
+  - essentialcontacts.googleapis.com
+  - iamcredentials.googleapis.com
+  - iap.googleapis.com
+  - networksecurity.googleapis.com
+  - orgpolicy.googleapis.com
+  - servicenetworking.googleapis.com
+  - serviceusage.googleapis.com
+  - stackdriver.googleapis.com
+  - storage-component.googleapis.com
+  - sts.googleapis.com