Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Feature Request] 2-networking: add a tfvars-driven IAM map on the shared-VPC host project (parity with Stage 3's kms_keys iam)

Abierto
  • ¿Algo no está bien?
#120 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 3 días

@aghassemlouei ya está trabajando en esto.

Desde el 8/10/2026.

  • #283 de @aghassemlouei — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
google-cloud, terraform
Área
authorization, cloud, infrastructure

Línea de trabajo

Empieza comparando las líneas 57–63 de 2-networking-a-fedramp-high/branch-net-envs.tf con las líneas 58–62 de 2-networking-b-il5-ngfw/branch-net-envs.tf; después, inspecciona la estructura de IAM de los tfvars de Stage 3 KMS y los bloques delegated-grants comentados. El trabajo estará terminado cuando env-spoke-projects acepte datos IAM adicionales para el proyecto host de shared-VPC en ambas variantes de networking sin editar branch-net-envs.tf por cada grant.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Enhancement Level of Effort - Medium Priority - Medium Scope - Fast Scope - Stage 2

Feature Description

Stage 3's KMS keys accept an iam map directly in tfvars — granting a new principal a role on a specific key is a pure data change. Stage 2's shared-VPC host project has no equivalent: the iam block in branch-net-envs.tf (lines 57–63) is hardcoded to resolve members from three fixed service_accounts keys (gke-dev, project-factory-dev, project-factory-prod), all bound to roles/dns.admin. A delegated-grants pattern exists directly below but is commented out (lines 64+). Add a tfvars-driven additional-IAM map to env-spoke-projects.

Use Case

Onboarding any workload whose deploy identity needs a scoped grant on the host project — e.g., a blueprint that creates a firewall rule in the shared-VPC host project under an impersonated, least-privilege deploy identity — currently requires editing branch-net-envs.tf. modules/project's factories_config doesn't cover IAM bindings (only custom roles, observability, org policies, quotas), so there is no file-drop alternative either. The Stage 3 KMS pattern proves the tfvars-driven shape already works in this repo.

Proposed Solution

Add a tfvars-driven iam_bindings_additive-style map on env-spoke-projects (or finish and expose the existing commented-out delegated-grant pattern), mirroring Stage 3's kms_keys.<key>.iam.

Compliance & Deployment Context

  • Target Deployment Type(s):
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Medium
    • FedRAMP High
    • DoD IL5
    • DoD IL4
    • All / General
  • Relevant NIST 800-53r5 Controls: AC-6 (least privilege) — enables scoped host-project grants for workload deploy identities instead of broadly-privileged ones.

Reusability Check

Stellar Engine prioritizes reusability.

  • I have checked if this functionality can be achieved by extending an existing module or blueprint. (modules/project factories don't cover IAM; the commented-out delegated-grant block is unfinished.)
  • I have verified that this does not duplicate existing functionality.

Alternatives Considered

Editing branch-net-envs.tf per grant (current state — a stage source edit for a routine operational need); granting broader roles to avoid repeat edits (worse for least privilege).

Additional Context

Verified at main @ 3728fc98. This is the concrete reason a least-privilege deployment-identity design can be done with a tfvars-only change on the Stage 3/KMS side but not on the Stage 2 side. Regime applicability (verified): the identical hardcoded roles/dns.admin block exists in both networking variants (2-networking-a-fedramp-high/branch-net-envs.tf:57-63 and 2-networking-b-il5-ngfw/branch-net-envs.tf:58-62, same commented-out delegated-grants pattern), so FedRAMP High, IL4, and IL5 deployments are all affected.

Lenguaje dominante
HCL
Estrellas
55
Forks
21
Merge medio
1 d 22 h
PR fusionados (30 d)
24

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/stellar-engine

Todos los issues de google/stellar-engine

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.