[Feature Request] No research blueprint family — the README names universities as a target audience, every blueprint is FedRAMP High, FedRAMP Moderate or IL5
Los mantenedores suelen responder en 3 días
@Calvin-Cheng1 ya está trabajando en esto.
Desde el 16/9/2026.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Feature Description
A blueprints/research/ family for the unspecified regime, aimed at universities and research institutions.
Use Case
The README lists "Educational and Research Institutions" under Target Audience. Every shipped blueprint targets FedRAMP High, FedRAMP Moderate or IL5. A university running NSF or NIH work usually has no Assured Workloads requirement, so it pays the compliance overhead and gets nothing back.
Three gaps show up on every deployment I do:
- Egress. Researchers run
pip install, pull from HuggingFace, and fetch datasets from Zenodo and nf-core. An inspected-egress topology blocks all of it. Per-spoke Cloud NAT lets it through. - Who creates projects. Central IT on the critical path for every new principal investigator (PI) project works for ten researchers and fails at hundreds.
- Blast radius. A PI who needs a public IP for one sandbox VM shouldn't need an org-wide policy change.
Proposed Solution
A blueprint family covering: NCC egress (see #58), department folders with tag-scoped org-policy delegation (see #14), sandbox and hardened folder presets (see #12), and project templates for each.
I have all of it deployed in a fork and can contribute it. Opening this first to check you want the family at all, and where it should live, before sending PRs against the three issues separately.
Compliance & Deployment Context
- Target Deployment Type(s):
- All / General — specifically the unspecified regime, where no Assured Workloads folder is created.
- Relevant NIST 800-53r5 Controls: Not compliance-driven. The delegation piece touches AC-6 (least privilege) by replacing org-wide policy admin with folder-scoped grants.
Reusability Check
- I have checked if this functionality can be achieved by extending an existing module or blueprint.
- I have verified that this does not duplicate existing functionality.
Alternatives Considered
Leaving it in its current fork.
Additional Context
Related: #58, #14, #12.
- Lenguaje dominante
- HCL
- Estrellas
- 55
- Forks
- 21
- Merge medio
- 1 d 22 h
- PR fusionados (30 d)
- 24
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de google/stellar-engine
-
[Feature Request] Remove Source Repo references and modules and replace with SSMPosiblemente ocupada @Calvin-Cheng1 la tomó hace 10 días. AbiertoEnhancement Level of Effort - High Priority - High Scope - Blueprint Scope - Fast Scope - Module
Dificultad 4/5 3-5 días Aptitud para principiantes 45/100
google/stellar-engine#198 · 2 comentarios · 1 asignado ·
Los mantenedores suelen responder en 3 días
-
[Feature Request]Customize Org Policy Enforcement Based on Regime SettingPosiblemente ocupada @aghassemlouei la tomó hace 7 días. Abiertocompliance Enhancement Framework - FedRAMP High Framework - IL5 Level of Effort - Low Priority - Medium Scope - Fast Scope - Stage 0
Dificultad 5/5 Más de una semana Aptitud para principiantes 35/100
google/stellar-engine#197 ·
Los mantenedores suelen responder en 3 días
-
compliance Enhancement Framework - FedRAMP Moderate Level of Effort - High Priority - Medium Scope - Blueprint
Dificultad 5/5 Más de una semana Aptitud para principiantes 38/100
google/stellar-engine#192 ·
Los mantenedores suelen responder en 3 días
-
compliance Enhancement Level of Effort - Medium Priority - Medium Scope - Blueprint Security
Dificultad 5/5 Más de una semana Aptitud para principiantes 38/100
google/stellar-engine#188 ·
Los mantenedores suelen responder en 3 días
-
[Feature Request] 2-networking: add a tfvars-driven IAM map on the shared-VPC host project (parity with Stage 3's kms_keys iam)Posiblemente ocupada @aghassemlouei la tomó hace 7 días. AbiertoEnhancement Level of Effort - Medium Priority - Medium Scope - Fast Scope - Stage 2
Dificultad 4/5 3-5 días Aptitud para principiantes 52/100
google/stellar-engine#120 ·
Los mantenedores suelen responder en 3 días