Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Feature Request] No research blueprint family — the README names universities as a target audience, every blueprint is FedRAMP High, FedRAMP Moderate or IL5

Open
#239 2 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 2 days

@Calvin-Cheng1 is already working on this.

Since Sep 16, 2026.

Assessment

This issue has not been assessed yet.

Description

enhancement

Feature Description

A blueprints/research/ family for the unspecified regime, aimed at universities and research institutions.

Use Case

The README lists "Educational and Research Institutions" under Target Audience. Every shipped blueprint targets FedRAMP High, FedRAMP Moderate or IL5. A university running NSF or NIH work usually has no Assured Workloads requirement, so it pays the compliance overhead and gets nothing back.

Three gaps show up on every deployment I do:

  1. Egress. Researchers run pip install, pull from HuggingFace, and fetch datasets from Zenodo and nf-core. An inspected-egress topology blocks all of it. Per-spoke Cloud NAT lets it through.
  2. Who creates projects. Central IT on the critical path for every new principal investigator (PI) project works for ten researchers and fails at hundreds.
  3. Blast radius. A PI who needs a public IP for one sandbox VM shouldn't need an org-wide policy change.

Proposed Solution

A blueprint family covering: NCC egress (see #58), department folders with tag-scoped org-policy delegation (see #14), sandbox and hardened folder presets (see #12), and project templates for each.

I have all of it deployed in a fork and can contribute it. Opening this first to check you want the family at all, and where it should live, before sending PRs against the three issues separately.

Compliance & Deployment Context

  • Target Deployment Type(s):
    • All / General — specifically the unspecified regime, where no Assured Workloads folder is created.
  • Relevant NIST 800-53r5 Controls: Not compliance-driven. The delegation piece touches AC-6 (least privilege) by replacing org-wide policy admin with folder-scoped grants.

Reusability Check

  • I have checked if this functionality can be achieved by extending an existing module or blueprint.
  • I have verified that this does not duplicate existing functionality.

Alternatives Considered

Leaving it in its current fork.

Additional Context

Related: #58, #14, #12.

Dominant language
HCL
Stars
51
Forks
21
Avg merge
1d 15h
Merged PRs (30d)
30

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from google/stellar-engine

All issues in google/stellar-engine

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.