diff --git a/blueprints/il5/postgresql/README.md b/blueprints/il5/postgresql/README.md
index 0a40159ee..853e692fb 100644
--- a/blueprints/il5/postgresql/README.md
+++ b/blueprints/il5/postgresql/README.md
@@ -35,7 +35,6 @@ google_service_networking_connection.postgres
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [core_project_id](variables.tf#L23) | This is the core project ID. Please set using a terraform.tfvars file. | string | ✓ | |
| [database_name](variables.tf#L34) | This is the name of the database. | string | ✓ | |
| [firewall_name](variables.tf#L64) | Firewall name. | string | ✓ | |
| [firewall_source_range](variables.tf#L69) | Firewall source IP range. | list(any) | ✓ | |
@@ -43,13 +42,11 @@ google_service_networking_connection.postgres
| [main_project_id](variables.tf#L173) | This is the project ID. Please set using a terraform.tfvars file. | string | ✓ | |
| [network_name](variables.tf#L178) | This is the name of the network. | string | ✓ | |
| [network_project_id](variables.tf#L183) | Project that the Compute Engine VPC is located. | string | ✓ | |
-| [subnetwork_name](variables.tf#L194) | This is the name of the subnetwork. | string | ✓ | |
| [allowed_firewall_ports](variables.tf#L17) | Allowed firewall ports. Postgresql used 5432. | list(number) | | [5432] |
| [database_instance_tier](variables.tf#L28) | This specifies the kind of machine-type that we will be running it from. | string | | "db-g1-small" |
| [database_version](variables.tf#L39) | This is the database type that we are running the cloud sql instance. | string | | "POSTGRES_13" |
| [deletion_protection](variables.tf#L45) | Terraform deletion protection. | bool | | true |
| [enable_pgaudit](variables.tf#L51) | This extension provides detailed session and object logging to comply with government, financial & ISO standards and provides auditing capabilities to mitigate threats by monitoring security events on the instance. | string | | "on" |
-| [google_compute_global_address_name](variables.tf#L74) | Global address for VPC name. | string | | "postgres" |
| [log_connections](variables.tf#L85) | Enabling the log_connections setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. | string | | "on" |
| [log_disconnections](variables.tf#L98) | Enabling the log_disconnections setting logs the end of each session, including the session duration. | string | | "on" |
| [log_error_verbosity](variables.tf#L111) | The log_error_verbosity flag controls the verbosity/details of messages logged. | string | | "default" |
diff --git a/blueprints/il5/postgresql/terraform.tfvars.sample b/blueprints/il5/postgresql/terraform.tfvars.sample
index e1ef8c720..2217d2397 100644
--- a/blueprints/il5/postgresql/terraform.tfvars.sample
+++ b/blueprints/il5/postgresql/terraform.tfvars.sample
@@ -1,5 +1,4 @@
main_project_id = "xxxx-xxxx-xxxx-main-0"
-core_project_id = "xxxx-xxxx-xxxx-iac-core-0"
network_project_id = "xxxx-xxxx-net-host"
database_name = "postgres-name-00"
@@ -8,7 +7,6 @@ database_instance_tier = "db-g1-small"
region = "us-east4"
network_name = "xxxx-spoke-0" # Must already exist
-subnetwork_name = "default-us-east4" # Must already exist
firewall_source_range = ["192.168.1.0/24"]
firewall_name = "allow-postgres"
diff --git a/blueprints/il5/postgresql/variables.tf b/blueprints/il5/postgresql/variables.tf
index 5a6b2a9ab..5af1bd523 100644
--- a/blueprints/il5/postgresql/variables.tf
+++ b/blueprints/il5/postgresql/variables.tf
@@ -20,11 +20,6 @@ variable "allowed_firewall_ports" {
default = [5432]
}
-variable "core_project_id" {
- description = "This is the core project ID. Please set using a terraform.tfvars file."
- type = string
-}
-
variable "database_instance_tier" {
description = "This specifies the kind of machine-type that we will be running it from."
type = string
@@ -71,12 +66,6 @@ variable "firewall_source_range" {
type = list(any)
}
-variable "google_compute_global_address_name" {
- description = "Global address for VPC name."
- type = string
- default = "postgres"
-}
-
variable "kms_key_name" {
description = "Full path to KMS key."
type = string
@@ -190,8 +179,3 @@ variable "region" {
type = string
default = "us-east4"
}
-
-variable "subnetwork_name" {
- description = "This is the name of the subnetwork."
- type = string
-}
diff --git a/fast/stages-aw/3-security/README.md b/fast/stages-aw/3-security/README.md
index 4781b4ac4..c5cc1a9e7 100644
--- a/fast/stages-aw/3-security/README.md
+++ b/fast/stages-aw/3-security/README.md
@@ -297,32 +297,30 @@ Some references that might be useful in setting up this stage
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [alert_email](variables.tf#L16) | Email to receive log alerts. | string | ✓ | |
-| [automation](variables.tf#L21) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | |
-| [billing_account](variables.tf#L29) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | |
-| [folder_ids](variables.tf#L62) | Folder name => id mappings, the 'security' folder name must exist. | object({…}) | ✓ | |
-| [organization](variables.tf#L123) | Organization details. | object({…}) | ✓ | |
-| [prefix](variables.tf#L139) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | |
-| [service_accounts](variables.tf#L149) | Automation service accounts that can assign the encrypt/decrypt roles on keys. | object({…}) | ✓ | |
-| [assured_workloads](variables.tf#L199) | Assured Workloads configuration. | any | | null |
-| [billing_override](variables.tf#L184) | Optional billing override configuration. If set, disables service account impersonation for project billing linkage and runs under the user account using the specified quota projects. | object({…}) | | null |
-| [common_services_folder](variables.tf#L259) | Common services folder ID. | any | | null |
-| [custom_roles](variables.tf#L193) | Custom IAM roles defined during bootstrap. | any | | null |
-| [envs_folders](variables.tf#L235) | Environment folders mappings. | any | | null |
-| [essential_contacts](variables.tf#L42) | Email used for essential contacts, unset if null. | string | | null |
-| [factories_config](variables.tf#L48) | Paths to folders that enable factory functionality. | object({…}) | | {} |
-| [fast_features](variables.tf#L253) | FAST features mapping. | any | | null |
-| [federated_identity_providers](variables.tf#L223) | Federated identity providers configuration. | any | | null |
-| [gcp_ranges](variables.tf#L229) | GCP address ranges configuration. | any | | null |
-| [groups](variables.tf#L211) | IAM groups configuration. | any | | null |
-| [kms_keys](variables.tf#L70) | KMS keys to create, keyed by name. | map(object({…})) | | {} |
-| [logging](variables.tf#L113) | Log writer identities for organization / folders. | object({…}) | | null |
-| [org_policy_classification_tags](variables.tf#L247) | Org policy classification tags configuration. | any | | null |
-| [outputs_location](variables.tf#L133) | Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable. | string | | null |
-| [regime_mapping](variables.tf#L217) | Compliance regime shorthand mapping. | any | | null |
-| [regions](variables.tf#L205) | GCP regions configuration. | any | | null |
-| [tenant_accounts](variables.tf#L241) | Tenant accounts configuration. | any | | null |
-| [vpc_sc](variables.tf#L160) | VPC SC configuration. | object({…}) | | {} |
+| [alert_email](variables.tf#L17) | Email to receive log alerts. | string | ✓ | |
+| [automation](variables.tf#L35) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | |
+| [billing_account](variables.tf#L43) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | |
+| [common_services_folder](variables.tf#L65) | Common services folder where non-tenant related resources should be kept. | string | ✓ | |
+| [envs_folders](variables.tf#L83) | List of environments to be created for projects to go into. | map(object({…})) | ✓ | |
+| [folder_ids](variables.tf#L127) | Folder name => id mappings, the 'security' folder name must exist. | object({…}) | ✓ | |
+| [organization](variables.tf#L202) | Organization details. | object({…}) | ✓ | |
+| [prefix](variables.tf#L218) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | |
+| [regions](variables.tf#L235) | Region definitions. Inherited from 0-bootstrap outputs. Must be specified in bootstrap terraform.tfvars. | object({…}) | ✓ | |
+| [service_accounts](variables.tf#L244) | Automation service accounts that can assign the encrypt/decrypt roles on keys. | object({…}) | ✓ | |
+| [tenant_accounts](variables.tf#L255) | Base Tenant accounts that are created for each folder, provided as a combination of environment and tenant. | map(object({…})) | ✓ | |
+| [assured_workloads](variables.tf#L23) | Configuration for Assured Workloads. | object({…}) | | {} |
+| [billing_override](variables.tf#L56) | Optional billing override configuration. If set, disables service account impersonation for project billing linkage and runs under the user account using the specified quota projects. | object({…}) | | null |
+| [custom_roles](variables.tf#L71) | Custom roles defined at the org level, in key => id format. | object({…}) | | null |
+| [essential_contacts](variables.tf#L91) | Email used for essential contacts, unset if null. | string | | null |
+| [factories_config](variables.tf#L97) | Paths to folders that enable factory functionality. | object({…}) | | {} |
+| [fast_features](variables.tf#L111) | Selective control for top-level FAST features. | object({…}) | | {} |
+| [gcp_ranges](variables.tf#L135) | GCP address ranges configuration. | any | | null |
+| [groups](variables.tf#L142) | IAM groups configuration. | any | | null |
+| [kms_keys](variables.tf#L149) | KMS keys to create, keyed by name. | map(object({…})) | | {} |
+| [logging](variables.tf#L192) | Log writer identities for organization / folders. | object({…}) | | null |
+| [outputs_location](variables.tf#L212) | Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable. | string | | null |
+| [regime_mapping](variables.tf#L228) | Compliance regime shorthand mapping. | any | | null |
+| [vpc_sc](variables.tf#L266) | VPC SC configuration. | object({…}) | | {} |
## Outputs
diff --git a/fast/stages-aw/3-security/variables.tf b/fast/stages-aw/3-security/variables.tf
index 7206afa28..3860525c4 100644
--- a/fast/stages-aw/3-security/variables.tf
+++ b/fast/stages-aw/3-security/variables.tf
@@ -13,11 +13,25 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
+
variable "alert_email" {
+ # tfdoc:variable:source 0-bootstrap
description = "Email to receive log alerts."
type = string
}
+variable "assured_workloads" {
+ # tfdoc:variable:source 1-resman
+ description = "Configuration for Assured Workloads."
+ type = object({
+ regime = optional(string)
+ location = optional(string)
+ folder = optional(string)
+ })
+ nullable = false
+ default = {}
+}
+
variable "automation" {
# tfdoc:variable:source 0-bootstrap
description = "Automation resources created by the bootstrap stage."
@@ -39,6 +53,41 @@ variable "billing_account" {
}
}
+variable "billing_override" {
+ description = "Optional billing override configuration. If set, disables service account impersonation for project billing linkage and runs under the user account using the specified quota projects."
+ type = object({
+ project = string
+ billing_project = string
+ })
+ default = null
+}
+
+variable "common_services_folder" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "Common services folder where non-tenant related resources should be kept."
+ type = string
+}
+
+variable "custom_roles" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "Custom roles defined at the org level, in key => id format."
+ type = object({
+ gcve_network_admin = string
+ organization_admin_viewer = string
+ service_project_network_admin = string
+ storage_viewer = string
+ })
+ default = null
+}
+
+variable "envs_folders" {
+ # tfdoc:variable:source 1-resman
+ description = "List of environments to be created for projects to go into."
+ type = map(object({
+ admin = string
+ }))
+}
+
variable "essential_contacts" {
description = "Email used for essential contacts, unset if null."
type = string
@@ -59,6 +108,22 @@ variable "factories_config" {
default = {}
}
+variable "fast_features" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "Selective control for top-level FAST features."
+ type = object({
+ data_platform = optional(bool, false)
+ gke = optional(bool, false)
+ gcve = optional(bool, false)
+ project_factory = optional(bool, false)
+ sandbox = optional(bool, false)
+ teams = optional(bool, false)
+ envs = optional(bool, false)
+ })
+ default = {}
+ nullable = false
+}
+
variable "folder_ids" {
# tfdoc:variable:source 1-resman
description = "Folder name => id mappings, the 'security' folder name must exist."
@@ -67,6 +132,20 @@ variable "folder_ids" {
})
}
+variable "gcp_ranges" {
+ # tfdoc:variable:source 2-networking
+ description = "GCP address ranges configuration."
+ type = any
+ default = null
+}
+
+variable "groups" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "IAM groups configuration."
+ type = any
+ default = null
+}
+
variable "kms_keys" {
description = "KMS keys to create, keyed by name."
type = map(object({
@@ -110,12 +189,6 @@ variable "kms_keys" {
nullable = false
}
-variable "kms_protection_level" {
- description = "KMS protection level."
- type = string
- nullable = true
-}
-
variable "logging" {
# tfdoc:variable:source 0-bootstrap
description = "Log writer identities for organization / folders."
@@ -152,6 +225,22 @@ variable "prefix" {
}
}
+variable "regime_mapping" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "Compliance regime shorthand mapping."
+ type = any
+ default = null
+}
+
+variable "regions" {
+ # tfdoc:variable:source 0-bootstrap
+ description = "Region definitions. Inherited from 0-bootstrap outputs. Must be specified in bootstrap terraform.tfvars."
+ type = object({
+ primary = string
+ })
+ nullable = false
+}
+
variable "service_accounts" {
# tfdoc:variable:source 1-resman
description = "Automation service accounts that can assign the encrypt/decrypt roles on keys."
@@ -163,6 +252,17 @@ variable "service_accounts" {
})
}
+variable "tenant_accounts" {
+ # tfdoc:variable:source 1-resman
+ description = "Base Tenant accounts that are created for each folder, provided as a combination of environment and tenant."
+ type = map(object({
+ tenant = string
+ env = string
+ main_project = string
+ admin_principal = string
+ }))
+}
+
variable "vpc_sc" {
description = "VPC SC configuration."
type = object({
@@ -186,85 +286,3 @@ variable "vpc_sc" {
default = {}
nullable = false
}
-
-variable "billing_override" {
- description = "Optional billing override configuration. If set, disables service account impersonation for project billing linkage and runs under the user account using the specified quota projects."
- type = object({
- project = string
- billing_project = string
- })
- default = null
-}
-
-variable "custom_roles" {
- description = "Custom IAM roles defined during bootstrap."
- type = any
- default = null
-}
-
-variable "assured_workloads" {
- description = "Assured Workloads configuration."
- type = any
- default = null
-}
-
-variable "regions" {
- description = "GCP regions configuration."
- type = any
- default = null
-}
-
-variable "groups" {
- description = "IAM groups configuration."
- type = any
- default = null
-}
-
-variable "regime_mapping" {
- description = "Compliance regime shorthand mapping."
- type = any
- default = null
-}
-
-variable "federated_identity_providers" {
- description = "Federated identity providers configuration."
- type = any
- default = null
-}
-
-variable "gcp_ranges" {
- description = "GCP address ranges configuration."
- type = any
- default = null
-}
-
-variable "envs_folders" {
- description = "Environment folders mappings."
- type = any
- default = null
-}
-
-variable "tenant_accounts" {
- description = "Tenant accounts configuration."
- type = any
- default = null
-}
-
-variable "org_policy_classification_tags" {
- description = "Org policy classification tags configuration."
- type = any
- default = null
-}
-
-variable "fast_features" {
- description = "FAST features mapping."
- type = any
- default = null
-}
-
-variable "common_services_folder" {
- description = "Common services folder ID."
- type = any
- default = null
-}
-