google/stellar-engine

View on GitHub

Framework for management of compliant Google Cloud infrastructure and design patterns for Assured Workloads featuring best practices and documentation to accelerate accreditation efforts e.g., Federal Authorization to Operate (ATO).

Stars: 51
Forks: 21
Open beginner issues: 7
Indexed issues: 76
Avg merge: 3d 12h
Merged PRs (30d): 35

Dominant language: HCL
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 16, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

[Bug] gem4gov app update-compliance: the engine patch is rejected (updateMask contains the immutable path disable_analytics), so the compliance feature states are never applied by the command Open

Bug Level of Effort - Low Priority - Medium

Difficulty 3/5 1-2 days Newbie friendliness 76/100

google/stellar-engine#259 · Opened Sep 22, 2026
[Documentation] docs/ddg.md: billing_override under three later stages still names 1-resman's tfvars, the enable-services fallback one-liner cannot work, and the Stage 0 Assured Workloads note quotes the wrong error and a folder that does not exist Open

Documentation Level of Effort - Low Priority - Medium

Difficulty 2/5 1-3 hours Newbie friendliness 90/100

google/stellar-engine#258 · Opened Sep 21, 2026
[Bug] 0-bootstrap: with logging sinks (the sample default) the log-sink key is granted to a Cloud Logging service account nothing creates, and the CMEK log buckets fail with "CMEK is not provisioned" — the project-level Logging settings are never read Open

Bug Level of Effort - Low Priority - High

Difficulty 4/5 3-5 days Newbie friendliness 68/100

google/stellar-engine#257 · Opened Sep 21, 2026
[Bug] 0-bootstrap: essentialcontacts.managed.allowedContactDomains parameters are double-encoded (organization.tf jsonencode()s the JSON string from platform_policy.yaml) — the post-migration apply fails Open

Bug Level of Effort - Low Priority - High

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

google/stellar-engine#256 · Opened Sep 21, 2026
[Bug] 2-networking-a-fedramp: time_sleep.peering_delay does not stagger the spoke peerings (peering-envs depends on the whole for_each resource, so all three start together) — a fresh apply can fail with "peering operation in progress" for two spokes Open

Bug Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 68/100

google/stellar-engine#255 · Opened Sep 21, 2026
[Bug] 2-networking-a-fedramp: the hierarchical firewall policy defaults to the unprefixed name net-default, which is unique per organization — a second deployment in the same org (a redeploy under a new prefix) fails at apply Open

Bug Level of Effort - Low Priority - Low

Difficulty 3/5 1-2 days Newbie friendliness 78/100

google/stellar-engine#254 · Opened Sep 21, 2026
[Feature Request] Streamline FAST stage IAM impersonation tooling to reduce cross-stage 403 errors Open

Documentation Enhancement Level of Effort - Medium Priority - Medium Scope - Fast

Difficulty 5/5 Over a week Newbie friendliness 38/100

google/stellar-engine#253 · Opened Sep 18, 2026
[Feature Request] Add pre-flight OS/shell environment checks and containerized workstation support for Windows Open

Enhancement Level of Effort - Medium Priority - Medium Scope - Fast

Difficulty 5/5 Over a week Newbie friendliness 45/100

google/stellar-engine#252 · Opened Sep 18, 2026
[Bug] Single-pass apply fails when relocating _Default Cloud Logging sink from global Open

Bug Framework - FedRAMP Moderate Level of Effort - Medium Priority - High Scope - Fast Security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

google/stellar-engine#251 · Opened Sep 18, 2026
[Feature Request] No research blueprint family — the README names universities as a target audience, every blueprint is FedRAMP High, FedRAMP Moderate or IL5 Open

enhancement

google/stellar-engine#239 · 2 comments · 1 assignee · Opened Sep 13, 2026
[Documentation] path-to-authorization.md advertises FedRAMP Moderate baselines for the SCTM and Policies and Procedures templates, but the published template set is FedRAMP High and IL5 only Open

documentation Level of Effort - High Priority - Medium

Difficulty 1/5 1-3 hours Newbie friendliness 88/100

google/stellar-engine#232 · Opened Sep 10, 2026
[Bug] Brownfield discovery offers the wrong Terraform state bucket: it looks for gs://<prefix>-tn-<env>-<tenant>-0, but a tenant's own stage state lives in gs://<prefix>-<env>-<tenant>-iac-0 Open

Bug Gemini - Government Level of Effort - Low Priority - High

Difficulty 3/5 1-2 days Newbie friendliness 74/100

google/stellar-engine#230 · Opened Sep 10, 2026
[Bug] modules/project and modules/iam-service-account silently truncate over-length IDs instead of failing, and the documented prefix limit of 7 characters now leaves zero margin (naming-convention.md still says 6) Open

bug Level of Effort - Low Priority - Low

Difficulty 4/5 3-5 days Newbie friendliness 68/100

google/stellar-engine#228 · Opened Sep 10, 2026
[Bug] 2-networking-a-fedramp: the NVA cluster runs on Spot VMs with automatic_restart disabled, so a preemption removes the organization's only internet egress path — the IL5 stage runs the equivalent appliances on-demand Open

bug Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 55/100

google/stellar-engine#199 · Opened Aug 21, 2026
[Feature Request] Remove Source Repo references and modules and replace with SSM Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

google/stellar-engine#198 · Opened Aug 20, 2026
[Feature Request]Customize Org Policy Enforcement Based on Regime Setting Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

google/stellar-engine#197 · Opened Aug 19, 2026
[Documentation] FedRAMP Moderate networking: record whether a Moderate-specific network pattern was superseded, which regions it supports, and where IL2 lands Open

documentation Level of Effort - Medium Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 55/100

google/stellar-engine#195 · Opened Aug 17, 2026
[Feature Request] No FedRAMP Moderate blueprint family — the platform supports FRM but every workload blueprint is still FedRAMP High or IL5 only Open

enhancement Level of Effort - High Priority - Medium

Difficulty 5/5 Over a week Newbie friendliness 38/100

google/stellar-engine#192 · Opened Aug 17, 2026
[Bug] gem4gov-cli: the compliance regime has no effect on the engine's feature posture — FedRAMP High, IL4 and IL5 print the same list and apply the same engine_features.yaml Open

Bug Gemini - Government Level of Effort - Medium Priority - High

Difficulty 4/5 3-5 days Newbie friendliness 48/100

google/stellar-engine#190 · Opened Aug 17, 2026
[Feature Request] Create a blueprint for SCC Notifications for NIST 800_53 R5 Controls in Security Command Center Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 38/100

google/stellar-engine#188 · Opened Aug 12, 2026
[Bug] gemini-enterprise time-based access: the configured time zone is not honored — a re-run silently resets it to America/New_York, and the level's title and hour descriptions assert Eastern regardless of what was set Open

Bug Gemini - Government Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 58/100

google/stellar-engine#187 · Opened Aug 11, 2026
[Bug] gemini-enterprise: usage-audit logging half-applies and nothing notices — the engine is left observabilityEnabled without sensitiveLoggingEnabled, so every prompt and response logs as <elided> Open

Bug Gemini - Government Level of Effort - Low Priority - Medium Security

Difficulty 3/5 1-2 days Newbie friendliness 68/100

google/stellar-engine#182 · Opened Aug 11, 2026
[Feature Request] Move self-managed SSL Certificate uploads to Terraform for G4G deployments Open

Enhancement Gemini - Enterprise Gemini - Government Level of Effort - Low Priority - Low

Difficulty 4/5 3-5 days Newbie friendliness 55/100

google/stellar-engine#161 · Opened Jul 24, 2026
[Feature Request] Implement Versioning Process to Pull Request functionality Open

enhancement

google/stellar-engine#151 · 1 assignee · Opened Jul 20, 2026
[Bug] 2-networking-a-fedramp-high: NVA return-route generation only routes the FIRST tenant subnet per environment ([0] index) — additional tenant subnets get no NVA return route and lose ALL internet egress Open

bug Level of Effort - Low Priority - Medium

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

google/stellar-engine#146 · Opened Jul 10, 2026
[Bug] deploy.sh validates the identity groups twice in one Step-1 run (Identity-step describe + Manual-Steps re-confirm), and the two can disagree Open

Bug Gemini - Government Level of Effort - Low Priority - Low

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

google/stellar-engine#135 · Opened Jul 9, 2026
[Bug] Standard Brownfield auto-discovers a nonexistent CMEK keyring (${Cap_Env}-${Tenant}-keyring) with no override prompt, writing a broken kms_key_id that fails the gemini-stage-0 apply Open

Bug Gemini - Government Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 48/100

google/stellar-engine#132 · Opened Jul 9, 2026
[Feature Request] gem4gov: add a license-retraction command (retractLicenseConfig) + range-reclaim helper Open

Enhancement Gemini - Government Level of Effort - Medium Priority - Low

Difficulty 4/5 3-5 days Newbie friendliness 52/100

google/stellar-engine#123 · Opened Jul 7, 2026
[Feature Request] gem4gov: implement BigQuery import in the standalone datastore import command Open

Enhancement Gemini - Government Level of Effort - Medium Priority - Medium

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

google/stellar-engine#122 · Opened Jul 7, 2026
[Feature Request] gem4gov: add a license-assignment command (batchUpdateUserLicenses) Open

Enhancement Gemini - Government Level of Effort - Medium Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 58/100

google/stellar-engine#121 · Opened Jul 7, 2026
[Feature Request] 2-networking: add a tfvars-driven IAM map on the shared-VPC host project (parity with Stage 3's kms_keys iam) Open

enhancement Level of Effort - Medium Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 52/100

google/stellar-engine#120 · Opened Jul 7, 2026
[Feature Request] FAST stages: retype essential_contacts from single-email string to the modules' full EMAIL => [types] contact map Open

enhancement Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 64/100

google/stellar-engine#119 · Opened Jul 7, 2026
[Documentation] il5/postgresql classic firewall rule sits outside Stage 2's hierarchical firewall policy governance — document the coexistence or migrate Open

documentation Level of Effort - Medium Priority - Medium

Difficulty 2/5 Half a day Newbie friendliness 72/100

google/stellar-engine#117 · 1 comment · Opened Jul 7, 2026
[Bug] gemini-enterprise deploy.sh silently installs tfenv, pins Terraform to 1.12.2, and mutates the user's PATH/.bashrc — overriding a newer Terraform with no opt-out Open

Bug Gemini - Government Level of Effort - Low Priority - Medium

Difficulty 3/5 1-2 days Newbie friendliness 55/100

google/stellar-engine#114 · Opened Jul 7, 2026
[Bug] gemini-stage-1: shared-VPC network resolution relies on try() fallbacks against stage-0 outputs — misleading failure when outputs are absent or misshaped Open

Bug Gemini - Government Level of Effort - Low Priority - Low

Difficulty 3/5 1-2 days Newbie friendliness 67/100

google/stellar-engine#111 · Opened Jul 7, 2026
[Bug] deploy.sh: brownfield CMEK auto-discovery assumes a project/keyring layout Stellar Engine FAST does not produce Open

Bug Gemini - Government Level of Effort - Medium Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 55/100

google/stellar-engine#106 · Opened Jul 7, 2026
[Bug] postgresql and app-engine blueprints require APIs the framework never enables (sqladmin.googleapis.com, appengine.googleapis.com) — fresh-tenant applies fail until the operator enables them manually Open

bug Level of Effort - Low Priority - Medium

google/stellar-engine#104 · 1 assignee · Opened Jul 7, 2026
[Feature Request] Extend gemini-enterprise blueprint to support FedRAMP Moderate Open

Enhancement Gemini - Enterprise Gemini - Government Level of Effort - Medium

google/stellar-engine#102 · 1 comment · 1 assignee · Opened Jul 6, 2026
[Feature Request] Relocate gemini-enterprise blueprint source code Open

Enhancement Gemini - Enterprise Gemini - Government Level of Effort - Low Priority - Low

Difficulty 3/5 1-2 days Newbie friendliness 48/100

google/stellar-engine#99 · Opened Jul 6, 2026
[Bug] Broken Link - Missing Network Design Diagram - 404 Open

bug documentation

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

google/stellar-engine#91 · Opened Jun 17, 2026
[Documentation] DDG drift vs. current code needs to be resolved Open

documentation Level of Effort - Low Priority - Medium

Difficulty 4/5 3-5 days Newbie friendliness 45/100

google/stellar-engine#83 · 2 comments · Opened Jun 2, 2026
[Documentation] Move the contents of documentation into docs Open

documentation Level of Effort - Low Priority - Low

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

google/stellar-engine#81 · Opened Jun 1, 2026
[Feature Request] Automated Enforcement of Sharing Artifacts Open

enhancement

google/stellar-engine#80 · 1 assignee · Opened Jun 1, 2026
[Documentation] Clarifications in the path-to-authorization documentation Open

documentation Level of Effort - Low Priority - Low

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

google/stellar-engine#79 · Opened Jun 1, 2026
[Feature Request] Integrate Network Connectivity Center (NCC) Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

google/stellar-engine#58 · 1 comment · Opened May 6, 2026
[Bug] Fix Custom KMS Organizational Policy Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

google/stellar-engine#57 · 1 comment · Opened May 6, 2026
[Feature Request] Automate Project ID randomization for soft-delete mitigation Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

google/stellar-engine#50 · Opened May 5, 2026
[Feature Request] Automate `backend.tf` state bucket substitutions Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

google/stellar-engine#49 · Opened May 5, 2026
[Documentation] Add Stage Output Diagrams to READMEs Open

documentation

Difficulty 3/5 1-2 days Newbie friendliness 68/100

google/stellar-engine#48 · Opened May 5, 2026
[Feature Request] Out-of-Band Drift Alerting Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

google/stellar-engine#46 · Opened May 5, 2026

google/stellar-engine

Get new issues in your inbox