[Enhancement] blueprints/il5, fedramp-high: scope project-wide IAM bindings to resources, wire CMEK, and restrict firewall targets

未关闭
  • 哪里不对？
#374 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@LeonxLJX 已经在做这个了。

开始于 2026年10月28日。

  • #380 来自 @LeonxLJX —— 未关闭

评估

难度
4/5
预计耗时
3-5 天
新手友好度
32/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
gcp, terraform
领域
cloud, infrastructure, security

调研方向

Start with the blueprints/il5 and blueprints/fedramp-high directories, reading #33 and #346 for the least-privilege context, then locate the named modules (cloud-composer-environment, cloud-functions, cloud-run, cloud-workstations, cnap, vertex-mlops, il5/pub-sub-project, cloud-spanner, cloud-sql, postgresql, bastion-pattern). Find the existing project-wide google_project_iam_member bindings, CMEK omissions, and ingress firewall rules. Done means those bindings are scoped to the specific resource, CMEK key names and service-identity grants are wired, firewall target_tags/logging are set, and shielded-instance/deletion defaults are applied; verify with terraform fmt, terraform validate, and a plan per blueprint.

由索引模型根据 Issue 内容生成。

描述

Enhancement Framework - FedRAMP High Framework - IL5 Level of Effort - Medium Priority - Medium Scope - Blueprint Security

Description

Multiple workload blueprints under blueprints/il5 and blueprints/fedramp-high grant project-wide IAM bindings where resource-level or subnet-level bindings are supported, omit CMEK kms_key_name wiring on storage or database resources, or omit target_tags on ingress firewall rules.

  1. Scope project-wide google_project_iam_member bindings for roles/compute.networkUser, roles/storage.objectAdmin, roles/secretmanager.secretAccessor, roles/pubsub.publisher, roles/pubsub.subscriber, and roles/cloudkms.cryptoKeyEncrypterDecrypter down to the specific subnetwork, bucket, secret, topic, subscription, or crypto key in cloud-composer-environment, cloud-functions, cloud-run, cloud-workstations, cnap, vertex-mlops, and il5/pub-sub-project.
  2. Wire CMEK kms_key_name into cloud-composer-environment and cloud-spanner along with roles/cloudkms.cryptoKeyEncrypterDecrypter for the Spanner service identity in both blueprints/il5 and blueprints/fedramp-high.
  3. Scope ingress firewall rules in blueprints/il5/postgresql and blueprints/il5/bastion-pattern with target_tags and enable firewall logging.
  4. Enable shielded_instance_config and deletion_protection defaults across vertex-mlops, cloud-sql, and postgresql blueprints.

Additional Context

Tracked under #33. Split out from #346 so least-privilege IAM, CMEK, and firewall hardening can be delivered per blueprint family.

主要语言
HCL
星标
61
派生
28
平均合并
1 天 22 小时
30 天内合并 PR
72

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

google/stellar-engine 的其他 Issue

查看 google/stellar-engine 的全部 Issue

相似的 Issue

更多 Cloud Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。