Add support for FedRAMP Moderate Assured Workloads deployments

README.md

@@ -22,7 +22,7 @@ The target audience for Stellar Engine is organizations and teams that operate i
 
 Stellar Engine offers several significant benefits, particularly for organizations operating in regulated environments or requiring high levels of compliance and security. Here are the key advantages based on the summary:
 
-- **Pre-Built Compliance Mappings:** The inclusion of documentation mapping NIST 800-53r5 controls for FRH, IL4, and IL5 simplifies the process of achieving compliance. This allows organizations to fast-track their ATO processes by leveraging pre-validated configurations.  <br />
+- **Pre-Built Compliance Mappings:** The inclusion of documentation mapping NIST 800-53r5 controls for FRH, FRM, IL4, and IL5 simplifies the process of achieving compliance. This allows organizations to fast-track their ATO processes by leveraging pre-validated configurations.  <br />
 IaC for Compliance: By embedding compliance requirements into IaC, Stellar Engine ensures that key controls are implemented consistently and automatically.   <br />
 - **Consistency and Scalability:** Utilizing IaC enables repeatable and reliable deployment of landing zones, ensuring that infrastructure adheres to best practices and compliance standards.  <br />
 - **Flexibility:** While tailored for Assured Workload overlays, Stellar Engine serves as a foundation for other compliance regimes, making it adaptable to various regulatory requirements.  <br />

fast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml

@@ -0,0 +1,64 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+%{ if !contains(["FEDRAMP_MODERATE"], regime) ~}
+# This boolean constraint, when enforced, disables creating Cloud Armor security
+# policies. By default, you can create Cloud Armor security policies in any
+# organization, folder, or project.
+# COULD HAVE
+compute.disableGlobalCloudArmorPolicy:
+  rules:
+  - enforce: true
+
+# This boolean constraint disables creation of global load balancing products.
+# When enforced, only regional load balancing products without global dependencies
+# can be created. By default, creation of global load balancing is allowed.
+# COULD HAVE
+compute.disableGlobalLoadBalancing:
+  rules:
+  - enforce: true
+
+# This boolean constraint, when enforced, disables creation of global
+# self-managed SSL Certificates. Creation of google-managed or regional
+# self-managed certificates is not disabled by this constraint. By default,
+# you can create global self-managed SSL Certificates in any organization,
+# folder, or project.
+# COULD HAVE
+compute.disableGlobalSelfManagedSslCertificate:
+  rules:
+  - enforce: true
+
+# This list constraint defines the set of load balancer types which can be
+# created for an organization, folder, or project. Every load balancer type
+# to be allowed or denied must be listed explicitly. By default, creation of
+# all types of load balancers is allowed. The list of allowed or denied values
+# must be identified as the string name of a load balancer, and can only
+# include values from the list below:
+#   [ INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS, EXTERNAL_NETWORK_TCP_UDP,
+#     EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, EXTERNAL_HTTP_HTTPS,
+#     EXTERNAL_MANAGED_HTTP_HTTPS, REGIONAL_INTERNAL_MANAGED_TCP_PROXY,
+#     REGIONAL_EXTERNAL_MANAGED_TCP_PROXY,
+#     GLOBAL_EXTERNAL_MANAGED_HTTP_HTTPS].
+# To include all internal or all external load balancer types, use the
+# in: prefix followed by INTERNAL or EXTERNAL. For example, allowing
+# in:INTERNAL will allow all load balancer types from the above list that
+# include INTERNAL.
+# COULD HAVE
+compute.restrictLoadBalancerCreationForTypes:
+  rules:
+  - allow:
+      values:
+        - in:INTERNAL
+%{ endif ~}

fast/stages-aw/0-bootstrap/data/custom-org-policies/networking_policy.yaml

@@ -73,3 +73,15 @@ compute.restrictVpcPeering:
       values:
         - under:organizations/${organization_id}
         - under:folders/832634261155 # https://autonomousthingz-life.medium.com/google-cloud-organisation-policies-get-the-restrict-vpc-peering-usage-organisation-policy-d87dce84a5e7
+
+%{ if !contains(["FEDRAMP_MODERATE"], regime) ~}
+# This list constraint defines the type of protocol forwarding rule objects
+# with target instance that a user can create.
+# COULD HAVE
+compute.restrictProtocolForwardingCreationForTypes:
+  rules:
+    - allow:
+        values:
+          - INTERNAL
+%{ endif ~}
+

fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml

@@ -100,13 +100,15 @@ essentialcontacts.managed.allowedContactDomains:
   - enforce: true
 
 
+%{ if !contains(["FEDRAMP_MODERATE", "FRM"], regime) ~}
 # Policy: compute.managed.restrictProtocolForwardingCreationForTypes
 # Description: Restricts the creation of protocol forwarding.
 # You might need to adjust rules based on your exact requirements,
 # but 'enforce: true' typically means the default Google-managed behavior is enforced.
 compute.managed.restrictProtocolForwardingCreationForTypes:
   rules:
   - enforce: true
+%{ endif ~}
 
 # Policy: iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts
 # Description: Prevents default service accounts from being granted privileged basic roles.
@@ -124,4 +126,39 @@ iam.managed.disableServiceAccountKeyCreation:
 # Description: Disables the upload of service account keys.
 iam.managed.disableServiceAccountKeyUpload:
   rules:
-  - enforce: true
+  - enforce: true
+
+# This list constraint defines the set of locations where location-based Google
+# Cloud resources can be created. By default, resources can be created in any
+# location. Policies for this constraint can specify multi-regions such as asia
+# and europe, regions such as us-east1 or europe-west1 as allowed or denied
+# locations. Allowing or denying a multi-region does not imply that all included
+# sub-locations should also be allowed or denied. For example, if the policy
+# denies the us multi-region (which refers to multi-region resources, like some
+# storage services), resources can still be created in the regional location
+# us-east1. On the other hand, the in:us-locations group contains all locations
+# within the us region, and can be used to block every region. We recommend
+# using value groups to define your policy. You can specify value groups,
+# collections of locations that are curated by Google to provide a simple way
+# to define your resource locations. To use value groups in your organization
+# policy, prefix your entries with the string in:, followed by the value group.
+# For example, to create resources that will only be physically located within
+# the US, set in:us-locations in the list of allowed values. If the
+# suggested_value field is used in a location policy, it should be a region.
+# If the value specified is a region, a UI for a zonal resource may pre-populate
+# any zone in that region.
+# SHOULD HAVE
+%{ if !contains(["FEDRAMP_MODERATE"], regime) ~}
+gcp.resourceLocations:
+  rules:
+  - allow:
+      values:
+        - in:us-locations
+%{ else ~}
+gcp.resourceLocations:
+  rules:
+  - deny:
+      values:
+        - in:asia-east2-locations
+        - in:global
+%{ endif ~}

fast/stages-aw/0-bootstrap/data/org-policies/lb_policy.yaml

@@ -13,53 +13,6 @@
 # limitations under the License.
 
 ---
-# This boolean constraint, when enforced, disables creating Cloud Armor security
-# policies. By default, you can create Cloud Armor security policies in any
-# organization, folder, or project.
-# COULD HAVE
-compute.disableGlobalCloudArmorPolicy:
-  rules:
-  - enforce: true
-
-# This boolean constraint disables creation of global load balancing products.
-# When enforced, only regional load balancing products without global dependencies
-# can be created. By default, creation of global load balancing is allowed.
-# COULD HAVE
-compute.disableGlobalLoadBalancing:
-  rules:
-  - enforce: true
-
-# This boolean constraint, when enforced, disables creation of global
-# self-managed SSL Certificates. Creation of google-managed or regional
-# self-managed certificates is not disabled by this constraint. By default,
-# you can create global self-managed SSL Certificates in any organization,
-# folder, or project.
-# COULD HAVE
-compute.disableGlobalSelfManagedSslCertificate:
-  rules:
-  - enforce: true
-
-# This list constraint defines the set of load balancer types which can be
-# created for an organization, folder, or project. Every load balancer type
-# to be allowed or denied must be listed explicitly. By default, creation of
-# all types of load balancers is allowed. The list of allowed or denied values
-# must be identified as the string name of a load balancer, and can only
-# include values from the list below:
-#   [ INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS, EXTERNAL_NETWORK_TCP_UDP,
-#     EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, EXTERNAL_HTTP_HTTPS,
-#     EXTERNAL_MANAGED_HTTP_HTTPS, REGIONAL_INTERNAL_MANAGED_TCP_PROXY,
-#     REGIONAL_EXTERNAL_MANAGED_TCP_PROXY,
-#     GLOBAL_EXTERNAL_MANAGED_HTTP_HTTPS].
-# To include all internal or all external load balancer types, use the
-# in: prefix followed by INTERNAL or EXTERNAL. For example, allowing
-# in:INTERNAL will allow all load balancer types from the above list that
-# include INTERNAL.
-# COULD HAVE
-compute.restrictLoadBalancerCreationForTypes:
-  rules:
-  - allow:
-      values:
-        - in:INTERNAL
 
 # This boolean constraint, when enforced, disables turning on Identity-Aware
 # Proxy on global resources. Enabling IAP on regional resources is not

fast/stages-aw/0-bootstrap/data/org-policies/networking_policy.yaml

@@ -81,22 +81,6 @@ compute.requireVpcFlowLogs:
         values:
           - COMPREHENSIVE
 
-# This list constraint defines the type of protocol forwarding rule objects
-# with target instance that a user can create. When this constraint is enforced,
-# new forwarding rule objects with target instance will be limited to internal
-# and/or external IP addresses, based on the types specified. The types to be
-# allowed or denied must be listed explicitly. By default, creation of both
-# internal and external protocol forwarding rule objects with target instance
-# are allowed.
-# The list of allowed or denied values can only include values from the list
-# below: [INTERNAL, EXTERNAL]. .
-# COULD HAVE
-compute.restrictProtocolForwardingCreationForTypes:
-  rules:
-    - allow:
-        values:
-          - INTERNAL
-
 # This list constraint defines the set of VPC networks that are allowed to be
 # peered with the VPC networks belonging to this project, folder, or
 # organization. By default, a Network Admin for one network can peer with any

fast/stages-aw/0-bootstrap/data/org-policies/platform_policy.yaml

@@ -36,31 +36,6 @@ gcp.disableCloudLogging:
   rules:
   - enforce: false
 
-# This list constraint defines the set of locations where location-based Google
-# Cloud resources can be created. By default, resources can be created in any
-# location. Policies for this constraint can specify multi-regions such as asia
-# and europe, regions such as us-east1 or europe-west1 as allowed or denied
-# locations. Allowing or denying a multi-region does not imply that all included
-# sub-locations should also be allowed or denied. For example, if the policy
-# denies the us multi-region (which refers to multi-region resources, like some
-# storage services), resources can still be created in the regional location
-# us-east1. On the other hand, the in:us-locations group contains all locations
-# within the us region, and can be used to block every region. We recommend
-# using value groups to define your policy. You can specify value groups,
-# collections of locations that are curated by Google to provide a simple way
-# to define your resource locations. To use value groups in your organization
-# policy, prefix your entries with the string in:, followed by the value group.
-# For example, to create resources that will only be physically located within
-# the US, set in:us-locations in the list of allowed values.If the
-# suggested_value field is used in a location policy, it should be a region.
-# If the value specified is a region, a UI for a zonal resource may pre-populate
-# any zone in that region.
-# SHOULD HAVE
-gcp.resourceLocations:
-  rules:
-  - allow:
-      values:
-        - in:us-locations
 
 # This constraint defines the set of Google Cloud resource services that can be
 # used within an organization, folder, or project, such as compute.googleapis.com

fast/stages-aw/0-bootstrap/kms.tf

@@ -15,7 +15,7 @@
 locals {
   version_template = {
     algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-    protection_level = "HSM"
+    protection_level = var.kms_protection_level
   }
 }
 module "logging-kms" {
@@ -75,4 +75,4 @@ module "gcs-kms" {
       "serviceAccount:${var.prefix}-prod-resman-0r@${var.prefix}-prod-iac-core-0.iam.gserviceaccount.com"
     ]
   }
-}
+}

fast/stages-aw/0-bootstrap/main.tf

@@ -35,5 +35,6 @@ locals {
     kms     = var.regions.primary
   }
   # naming: environment used in most resource names
-  prefix = join("-", compact([var.prefix, "prod"]))
+  prefix               = join("-", compact([var.prefix, "prod"]))
+  kms_protection_level = coalesce(var.kms_protection_level, var.assured_workloads.regime == "FEDRAMP_MODERATE" ? "SOFTWARE" : "HSM")
 }

fast/stages-aw/0-bootstrap/organization.tf

@@ -115,6 +115,7 @@ locals {
         customer_id : var.organization.customer_id
         drs_tag_name : local.drs_tag_name
         allowed_domains : var.org_policies_config.constraints.allowed_policy_member_domains
+        regime : var.assured_workloads.regime
       }))
     ]
   )...)

fast/stages-aw/0-bootstrap/outputs.tf

@@ -163,6 +163,11 @@ output "custom_roles" {
   value       = module.organization.custom_role_id
 }
 
+output "kms_protection_level" {
+  description = "KMS protection level."
+  value       = var.kms_protection_level
+}
+
 output "outputs_bucket" {
   description = "GCS bucket where generated output files are stored."
   value       = module.automation-tf-output-gcs.name

fast/stages-aw/0-bootstrap/variables.tf

@@ -192,6 +192,12 @@ variable "iam_by_principals" {
   nullable    = false
 }
 
+variable "kms_protection_level" {
+  description = "KMS protection level."
+  type        = string
+  nullable    = true
+}
+
 variable "locations" {
   description = "Optional locations for GCS, BigQuery, and logging buckets created here."
   type = object({

fast/stages-aw/1-resman/kms.tf

@@ -35,7 +35,7 @@ module "tenant-project-keys" {
       rotation_period = "7776000s" # CIS Compliance Benchmark 1.10
       version_template = {
         algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-        protection_level = "HSM"
+        protection_level = var.kms_protection_level
       }
     },
     default = {
@@ -45,7 +45,7 @@ module "tenant-project-keys" {
       rotation_period = "7776000s"
       version_template = {
         algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-        protection_level = "HSM"
+        protection_level = var.kms_protection_level
       }
     }
   }

fast/stages-aw/1-resman/variables.tf

@@ -240,6 +240,12 @@ variable "groups" {
   default  = {}
 }
 
+variable "kms_protection_level" {
+  description = "KMS protection level."
+  type        = string
+  nullable    = true
+}
+
 variable "regions" {
   # tfdoc:variable:source 0-bootstrap
   description = "Region definitions. Inherited from 0-bootstrap outputs. Must be specified in bootstrap terraform.tfvars."

fast/stages-aw/2-networking-a-fedramp-high/nva.tf

@@ -200,7 +200,7 @@ module "kms" {
       purpose         = "ENCRYPT_DECRYPT"
       version_template = {
         algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-        protection_level = "HSM"
+        protection_level = var.kms_protection_level
       }
     }
   }

fast/stages-aw/2-networking-a-fedramp-high/variables.tf

@@ -202,9 +202,14 @@ variable "billing_override" {
 }
 
 variable "assured_workloads" {
-  description = "Assured Workloads configuration."
-  type        = any
-  default     = null
+  description = "Configuration for Assured Workloads."
+  type = object({
+    regime   = optional(string)
+    location = optional(string)
+    folder   = optional(string)
+  })
+  nullable = false
+  default  = {}
 }
 
 variable "common_services_folder" {
@@ -231,6 +236,12 @@ variable "groups" {
   default     = null
 }
 
+variable "kms_protection_level" {
+  description = "KMS protection level."
+  type        = string
+  nullable    = true
+}
+
 variable "regime_mapping" {
   description = "Compliance regime shorthand mapping."
   type        = any

fast/stages-aw/3-security/core-dev.tf

@@ -56,7 +56,7 @@ module "dev-sec-kms" {
     name     = "dev-${each.key}"
     version_template = {
       algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-      protection_level = "HSM"
+      protection_level = var.kms_protection_level
     }
   }
   keys = local.kms_locations_keys[each.key]