fix(security): harden IAM conditions, FAST stages, repository tools, and blueprints

blueprints/fedramp-high/beyondcorp/provider.tf

@@ -31,12 +31,14 @@ terraform {
 }
 
 provider "google" {
+  project               = var.main_project_id
   region                = var.region
   billing_project       = var.main_project_id
   user_project_override = true
 }
 
 provider "google-beta" {
+  project               = var.main_project_id
   region                = var.region
   billing_project       = var.main_project_id
   user_project_override = true

blueprints/fedramp-high/beyondcorp/variables.tf

@@ -35,6 +35,7 @@ variable "oauth_client_id" {
 variable "oauth_client_secret" {
   description = "OAuth Client Secret for IAP."
   type        = string
+  sensitive   = true
 }
 
 variable "organization_id" {

blueprints/fedramp-high/bigtable/main.tf

@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-data "google_project" "project" {}
+data "google_project" "project" {
+  project_id = var.main_project_id
+}
 
 resource "google_project_service" "bigtable_api" {
   project            = var.main_project_id
@@ -51,7 +53,7 @@ resource "google_kms_crypto_key_iam_member" "bigtable_sa_kms_access" {
 resource "google_kms_crypto_key_iam_member" "bigtable_agent_kms_access" {
   crypto_key_id = data.google_kms_crypto_key.default.id
   role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-bigtable.iam.gserviceaccount.com"
+  member        = google_project_service_identity.bigtable_sa.member
 }
 
 module "bigtable-instance" {
@@ -68,5 +70,5 @@ module "bigtable-instance" {
     }
   }
   tables              = var.table
-  deletion_protection = false
+  deletion_protection = var.deletion_protection
 }

blueprints/fedramp-high/bigtable/terraform.tfvars.sample

@@ -4,9 +4,9 @@ core_project_id    = "xxxx-xxxx-xxxx-iac-core-0"
 bigtable_service_account_id = "bigtable-sa"
 instance_name = "bigtable-instance-00"
 cluster_id    = "bigtable-cluster-00"
-num_nodes     = 3
-auto_delete   = true
-region        = "us-east4"
+num_nodes           = 3
+deletion_protection = false
+region              = "us-east4"
 zone          = "us-east4-a"
 
 kms_keyring_name = "xxxx-xxxx-keyring"

blueprints/fedramp-high/bigtable/variables.tf

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-variable "auto_delete" {
-  description = "Persistent Disk auto delete options."
+variable "deletion_protection" {
+  description = "Prevent Terraform from destroying the Bigtable instance."
   type        = bool
   default     = true
 }
@@ -77,11 +77,7 @@ variable "table" {
     split_keys      = optional(list(string))
     column_families = map(object({}))
   }))
-  default = {
-    "Test" = {
-      column_families = {}
-    }
-  }
+  default = null
 }
 
 variable "zone" {

blueprints/fedramp-high/cloud-armor/main.tf

@@ -49,20 +49,23 @@ resource "google_compute_region_security_policy" "policy" {
   provider = google-beta
   for_each = local.policies
 
+  project     = var.main_project_id
+  region      = var.region
   name        = each.key
   description = each.value.description
   type        = "CLOUD_ARMOR"
 }
 
 resource "google_compute_region_security_policy_rule" "policy_rule" {
   provider   = google-beta
-  for_each   = { for rule in local.indexed_rules : rule.priority => rule }
+  for_each   = { for rule in local.indexed_rules : "${rule.policy}-${rule.priority}" => rule }
   depends_on = [google_compute_region_security_policy.policy]
 
+  project         = var.main_project_id
   security_policy = each.value.policy
   region          = each.value.region
   priority        = each.value.priority
-  action          = try(each.value.action, "allow")
+  action          = try(each.value.action, "deny(403)")
 
   preview     = try(each.value.preview, null)
   description = try(each.value.description, null)
@@ -79,7 +82,7 @@ resource "google_compute_region_security_policy_rule" "policy_rule" {
     dynamic "config" {
       for_each = try(each.value.expression, null) != null ? [] : [1]
       content {
-        src_ip_ranges = ["*"]
+        src_ip_ranges = try(each.value.src_ip_ranges, ["*"])
       }
     }
   }

blueprints/fedramp-high/cloud-composer-environment/variables.tf

@@ -60,7 +60,7 @@ variable "sa_display_name" {
 variable "service_agent_version" {
   description = "Composer Service Agent version. This must correspond to Composer version."
   type        = string
-  default     = "roles/composer.ServiceAgentV2Ext"
+  default     = "roles/composer.ServiceAgentV3Ext"
 }
 
 variable "subnetwork_name" {

blueprints/fedramp-high/cloud-functions/main.tf

@@ -51,16 +51,17 @@ resource "google_project_iam_member" "cloud_invoker" {
   member  = module.service-account-runner.iam_email
 }
 
-resource "google_kms_crypto_key_iam_binding" "cloud_storage" {
-  crypto_key_id = var.kms_key_name
-  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  members = [
+resource "google_kms_crypto_key_iam_member" "cloud_storage" {
+  for_each = toset([
     "serviceAccount:service-${data.google_project.current.number}@gs-project-accounts.iam.gserviceaccount.com",
     "serviceAccount:service-${data.google_project.current.number}@compute-system.iam.gserviceaccount.com",
     "serviceAccount:service-${data.google_project.current.number}@gcf-admin-robot.iam.gserviceaccount.com",
     "serviceAccount:service-${data.google_project.current.number}@gcp-sa-artifactregistry.iam.gserviceaccount.com",
     "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"
-  ]
+  ])
+  crypto_key_id = var.kms_key_name
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = each.value
 }
 
 resource "google_project_iam_member" "artifactregistry_createOnPushWriter" {
@@ -94,21 +95,35 @@ resource "null_resource" "cloud_function_deploy" {
     source_code_hash = sha256(join("", [for f in fileset("./src-code", "**") : file("./src-code/${f}")]))
   }
   provisioner "local-exec" {
+    environment = {
+      CF_NAME              = var.function_name
+      CF_PROJECT           = var.main_project_id
+      CF_REGION            = var.region
+      CF_RUNTIME           = var.function_runtime
+      CF_ENTRY_POINT       = var.function_entry_point
+      CF_MEMORY            = "${var.function_memory_mb}MB"
+      CF_TIMEOUT           = "${var.function_timeout_seconds}s"
+      CF_MAX_INSTANCES     = tostring(var.function_instance_count)
+      CF_DOCKER_REPOSITORY = module.registry-docker.id
+      CF_KMS_KEY           = var.kms_key_name
+      CF_SERVICE_ACCOUNT   = coalesce(var.service_account, module.service-account-runner.email)
+    }
     command = <<EOT
-      gcloud functions deploy "${var.function_name}" \
-        --project="${var.main_project_id}" \
-        --region="${var.region}" \
-        --runtime="${var.function_runtime}" \
+      gcloud functions deploy "$CF_NAME" \
+        --project="$CF_PROJECT" \
+        --region="$CF_REGION" \
+        --runtime="$CF_RUNTIME" \
         --trigger-http \
         --source="./src-code" \
-        --entry-point="${var.function_entry_point}" \
-        --memory="${var.function_memory_mb}MB" \
-        --timeout="${var.function_timeout_seconds}s" \
+        --entry-point="$CF_ENTRY_POINT" \
+        --memory="$CF_MEMORY" \
+        --timeout="$CF_TIMEOUT" \
+        --max-instances="$CF_MAX_INSTANCES" \
         --ingress-settings="internal-and-gclb" \
-        --binary-authorization default \
-        --docker-repository="${module.registry-docker.id}" \
-        --kms-key="${var.kms_key_name}" \
-        --service-account="${module.service-account-runner.email}"
+        --binary-authorization="default" \
+        --docker-repository="$CF_DOCKER_REPOSITORY" \
+        --kms-key="$CF_KMS_KEY" \
+        --service-account="$CF_SERVICE_ACCOUNT"
     EOT
   }
 }
@@ -142,5 +157,5 @@ module "registry-docker" {
       }
     }
   }
-  depends_on = [google_kms_crypto_key_iam_binding.cloud_storage]
+  depends_on = [google_kms_crypto_key_iam_member.cloud_storage]
 }

blueprints/fedramp-high/cloud-functions/outputs.tf

@@ -29,7 +29,7 @@ output "cloud_build_iam_member" {
 
 output "kms_crypto_key_iam_binding_members" {
   description = "IAM members assigned to roles/cloudkms.cryptoKeyEncrypterDecrypter for the specified KMS key."
-  value       = google_kms_crypto_key_iam_binding.cloud_storage.members
+  value       = [for m in google_kms_crypto_key_iam_member.cloud_storage : m.member]
 }
 
 output "logging_iam_member" {

blueprints/fedramp-high/cloud-functions/src-code/index.js

@@ -18,5 +18,6 @@ const functions = require('@google-cloud/functions-framework');
 
 // Define the function with the name "helloHttp"
 functions.http('helloHttp', (req, res) => {
-  res.send(`Hello, ${req.query.name || req.body.name || 'World'}!`);
+  res.set('Content-Type', 'text/plain');
+  res.send(`Hello, ${req.query.name || (req.body && req.body.name) || 'World'}!`);
 });

blueprints/fedramp-high/cloud-ids/variables.tf

@@ -59,7 +59,7 @@ variable "region" {
 variable "severity" {
   description = "Impact of an incident on a system."
   type        = string
-  default     = "MEDIUM"
+  default     = "INFORMATIONAL"
 }
 
 variable "subnetwork_list" {

blueprints/fedramp-high/cloud-run/main.tf

@@ -49,12 +49,6 @@ resource "google_project_iam_member" "cloud_run_permissions" {
   member  = "serviceAccount:${google_service_account.cloud_run_service_account.email}"
 }
 
-resource "google_kms_crypto_key_iam_member" "cloud_run_sa_kms_access" {
-  crypto_key_id = data.google_kms_crypto_key.default.id
-  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  member        = google_service_account.cloud_run_service_account.member
-}
-
 resource "google_kms_crypto_key_iam_member" "cloud_run_service_agent_kms_permissions" {
   crypto_key_id = data.google_kms_crypto_key.default.id
   role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
@@ -91,5 +85,5 @@ module "cloud_run" {
     }
   }
   service_account     = google_service_account.cloud_run_service_account.email
-  deletion_protection = false
+  deletion_protection = true
 }

blueprints/fedramp-high/cloud-run/variables.tf

@@ -27,8 +27,8 @@ variable "binary_authorization_policy" {
   type        = string
   default     = null
   validation {
-    condition     = var.binary_authorization_mode != "policy" || (var.binary_authorization_mode == "policy" && var.binary_authorization_policy != null)
-    error_message = "If binary_authorization_mode is set to 'policy', then binary_authorization_policy must be specified."
+    condition     = var.binary_authorization_policy == null || can(regex("^projects/[^/]+/policies/[^/]+$", var.binary_authorization_policy))
+    error_message = "If specified, binary_authorization_policy must match projects/PROJECT_ID/policies/POLICY_ID."
   }
 }
 
@@ -58,6 +58,7 @@ variable "env_vars" {
   description = "Environment variables for the Cloud Run service or job."
   type        = map(string)
   default     = {}
+  sensitive   = true
 }
 
 variable "ingress" {

blueprints/fedramp-high/cloud-scheduler-job/main.tf

@@ -23,15 +23,13 @@ resource "google_project_service" "cloudscheduler_api" {
 }
 
 # Grant Pub/Sub service account permissions on the KMS key for CMEK of the Pub/Sub topic
-resource "google_kms_crypto_key_iam_binding" "pubsub" {
+resource "google_kms_crypto_key_iam_member" "pubsub" {
   count = var.kms_key_name != null ? 1 : 0
   # This grants permission to the Pub/Sub service account to use the KMS key
   # for the *existing* Pub/Sub topic.
   crypto_key_id = var.kms_key_name # Full self-link of the existing KMS key
   role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  members = [
-    "serviceAccount:service-${data.google_project.current.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
-  ]
+  member        = "serviceAccount:service-${data.google_project.current.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
   # Depend on google_project_service_identity if we were creating it in this blueprint
   # but here, we just need to ensure the API is enabled.
   depends_on = [google_project_service.cloudscheduler_api] # Ensure API is enabled before IAM
@@ -60,7 +58,7 @@ module "pubsub_job" {
   }
   depends_on = [
     google_project_service.cloudscheduler_api,
-    google_kms_crypto_key_iam_binding.pubsub, # Ensure Pub/Sub SA has KMS permission if new topic is CMEK'd
+    google_kms_crypto_key_iam_member.pubsub, # Ensure Pub/Sub SA has KMS permission if new topic is CMEK'd
   ]
 }
 

blueprints/fedramp-high/cloud-scheduler-job/terraform.tfvars.sample

@@ -10,8 +10,8 @@ gcp_region      = "us-east4"    # The Google Cloud region where the Cloud Schedu
 topic_id        = "projects/YOUR_PUBSUB_PROJECT_ID/topics/YOUR_PUBSUB_TOPIC_NAME" # Full resource path of the existing Pub/Sub topic.
 # Example: "projects/my-pubsub-project/topics/my-existing-topic"
 
-data            = base64encode("YOUR_MESSAGE_HERE") # Base64-encoded data to be sent as the Pub/Sub message payload.
-# Example: base64encode("{\"key\": \"value\"}") or base64encode("My message")
+data            = "YOUR_MESSAGE_HERE" # Message payload to be base64-encoded and sent to the Pub/Sub topic.
+# Example: "{\"key\": \"value\"}" or "My message"
 
 # --- Cloud KMS for Pub/Sub Topic Encryption (CMEK) ---
 # This blueprint assumes your Pub/Sub topic is already encrypted with CMEK.

blueprints/fedramp-high/cloud-scheduler-job/variables.tf

@@ -16,6 +16,7 @@ variable "data" {
   description = "The base64-encoded data to be sent as the Pub/Sub message payload."
   type        = string
   default     = null
+  sensitive   = true
 }
 
 variable "description" {

blueprints/fedramp-high/cloud-spanner/variables.tf

@@ -26,6 +26,10 @@ variable "database_name" {
 variable "database_user" {
   description = "Database user or group. Must start with \"user:\" or \"group:\" or \"serviceAccount:\"."
   type        = string
+  validation {
+    condition     = can(regex("^(user|group|serviceAccount):", var.database_user))
+    error_message = "database_user must start with user:, group:, or serviceAccount:."
+  }
 }
 
 variable "display_name" {

blueprints/fedramp-high/cloud-translation/main.tf

@@ -58,6 +58,7 @@ module "workflows" {
   deletion_protection = var.deletion_protection
   description         = "Translation LLM example workflow."
   file                = var.file
+  kms_key_self_link   = var.kms_key_self_link
   service_account     = google_service_account.workflow_sa.email
   env_vars = {
     input_bucket  = "${module.input_bucket.url}/*.txt"
@@ -72,11 +73,8 @@ module "workflows" {
     "roles/serviceusage.serviceUsageConsumer" = [google_service_account.workflow_sa.member],
     "roles/storage.objectViewer"              = [google_service_account.workflow_sa.member],
     "roles/storage.objectCreator"             = [google_service_account.workflow_sa.member],
-    "roles/storage.objectUser"                = [google_service_account.workflow_sa.member],
     "roles/storage.insightsCollectorService"  = [google_service_account.workflow_sa.member],
     "roles/cloudtranslate.user"               = [google_service_account.workflow_sa.member],
-    "roles/cloudtranslate.viewer"             = [google_service_account.workflow_sa.member],
-    "roles/cloudtranslate.editor"             = [google_service_account.workflow_sa.member],
   }
   depends_on = [
     google_project_service.translate,

blueprints/fedramp-high/cloud-translation/variables.tf

@@ -24,6 +24,12 @@ variable "file" {
   default     = "code/example.yaml"
 }
 
+variable "kms_key_self_link" {
+  description = "The full self-link of the existing KMS key to use for Workflow encryption (CMEK)."
+  type        = string
+  default     = null
+}
+
 variable "main_project_id" {
   description = "The Google Project ID."
   type        = string

blueprints/fedramp-high/cloud-workstations/main.tf

@@ -50,17 +50,19 @@ resource "google_project_service" "workstations" {
   disable_on_destroy = false
 }
 
-data "google_project" "project" {}
+data "google_project" "project" {
+  project_id = var.main_project_id
+}
 
 module "workstations" {
   source         = "../../../modules/workstation-cluster"
   id             = var.cluster_id
   project_id     = var.main_project_id
   location       = var.region
   network_config = local.network_config
-  # private_cluster_config = {
-  #   enable_private_endpoint = true
-  # }
+  private_cluster_config = {
+    enable_private_endpoint = true
+  }
   workstation_configs = {
     (var.config_id) = {
       container = var.image == null ? null : {