Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Enhancement] blueprints/il5, fedramp-high: scope project-wide IAM bindings to resources, wire CMEK, and restrict firewall targets

Abierto
  • ¿Algo no está bien?
#374 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@LeonxLJX ya está trabajando en esto.

Desde el 28/10/2026.

  • #380 de @LeonxLJX — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
32/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
gcp, terraform
Área
cloud, infrastructure, security

Línea de trabajo

Start with the blueprints/il5 and blueprints/fedramp-high directories, reading #33 and #346 for the least-privilege context, then locate the named modules (cloud-composer-environment, cloud-functions, cloud-run, cloud-workstations, cnap, vertex-mlops, il5/pub-sub-project, cloud-spanner, cloud-sql, postgresql, bastion-pattern). Find the existing project-wide google_project_iam_member bindings, CMEK omissions, and ingress firewall rules. Done means those bindings are scoped to the specific resource, CMEK key names and service-identity grants are wired, firewall target_tags/logging are set, and shielded-instance/deletion defaults are applied; verify with terraform fmt, terraform validate, and a plan per blueprint.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Enhancement Framework - FedRAMP High Framework - IL5 Level of Effort - Medium Priority - Medium Scope - Blueprint Security

Description

Multiple workload blueprints under blueprints/il5 and blueprints/fedramp-high grant project-wide IAM bindings where resource-level or subnet-level bindings are supported, omit CMEK kms_key_name wiring on storage or database resources, or omit target_tags on ingress firewall rules.

  1. Scope project-wide google_project_iam_member bindings for roles/compute.networkUser, roles/storage.objectAdmin, roles/secretmanager.secretAccessor, roles/pubsub.publisher, roles/pubsub.subscriber, and roles/cloudkms.cryptoKeyEncrypterDecrypter down to the specific subnetwork, bucket, secret, topic, subscription, or crypto key in cloud-composer-environment, cloud-functions, cloud-run, cloud-workstations, cnap, vertex-mlops, and il5/pub-sub-project.
  2. Wire CMEK kms_key_name into cloud-composer-environment and cloud-spanner along with roles/cloudkms.cryptoKeyEncrypterDecrypter for the Spanner service identity in both blueprints/il5 and blueprints/fedramp-high.
  3. Scope ingress firewall rules in blueprints/il5/postgresql and blueprints/il5/bastion-pattern with target_tags and enable firewall logging.
  4. Enable shielded_instance_config and deletion_protection defaults across vertex-mlops, cloud-sql, and postgresql blueprints.

Additional Context

Tracked under #33. Split out from #346 so least-privilege IAM, CMEK, and firewall hardening can be delivered per blueprint family.

Lenguaje dominante
HCL
Estrellas
61
Forks
28
Merge medio
1 d 22 h
PR fusionados (30 d)
72

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/stellar-engine

Todos los issues de google/stellar-engine

Issues similares

Más issues de Cloud

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.