Add support for FedRAMP Moderate Assured Workloads deployments - #162
Add support for FedRAMP Moderate Assured Workloads deployments#162jmpugh wants to merge 4 commits into
Conversation
| @@ -0,0 +1,64 @@ | |||
| # Copyright 2025 Google LLC | |||
There was a problem hiding this comment.
all of the below custom-org-policies adhere to what a default FRM Assured Workloads folder would set for you
| # naming: environment used in most resource names | ||
| prefix = join("-", compact([var.prefix, "prod"])) | ||
| prefix = join("-", compact([var.prefix, "prod"])) | ||
| kms_protection_level = coalesce(var.kms_protection_level, var.assured_workloads.regime == "FEDRAMP_MODERATE" ? "SOFTWARE" : "HSM") |
There was a problem hiding this comment.
as mentioned in the PR description, FRM does not require FIPS 140-3 Level 3 so SOFTWARE is the more cost-effective option
| output "kms_protection_level" { | ||
| description = "KMS protection level." | ||
| value = var.kms_protection_level | ||
| } |
There was a problem hiding this comment.
include in output so it can be used downstream
| exit 1 | ||
| fi | ||
| fi | ||
| deploy_networking |
There was a problem hiding this comment.
consolidates a lot of this duplicate code into the deploy_networking function
| done | ||
| } | ||
|
|
||
| destroy_networking() { |
There was a problem hiding this comment.
same comment as above, consolidates the destroy_networking code
| version_template = { | ||
| algorithm = "GOOGLE_SYMMETRIC_ENCRYPTION" | ||
| protection_level = "HSM" | ||
| protection_level = var.kms_protection_level |
There was a problem hiding this comment.
this is the only difference between the FRH and FRM networking configuration, I decided not to make a separate directory for FRM for this single change (and is consistent with how IL4 and IL5 share networking code)
1 participant
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
SOFTWARElevel protection in KMS which is more cost-effectiveFixes #101
Type of Change
Deployment & Compliance Impact
Checklist
Code Quality & Reusability
modules/orfast/can be leveraged for this change.documentation/naming-convention.md.Documentation
README.mdof the modified module or blueprint.Security
Testing
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.