From 68dfc8a76be7f0c23f402519a8529dcd751216e4 Mon Sep 17 00:00:00 2001 From: Alijohn Ghassemlouei Date: Fri, 28 Aug 2026 11:55:10 -0400 Subject: [PATCH 1/2] fix(0-bootstrap): add allowed domain parameters to managed essential contacts policy (#108) --- .../0-bootstrap/data/custom-org-policies/platform_policy.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml b/fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml index 8252a2bf9..972f06110 100644 --- a/fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml +++ b/fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml @@ -98,6 +98,7 @@ iam.allowedPolicyMemberDomains: essentialcontacts.managed.allowedContactDomains: rules: - enforce: true + parameters: '{"allowedDomains":["@${domain_name}"]}' %{ if !contains(["FEDRAMP_MODERATE"], regime) ~} From 5469ef5d4300417bb156cb285101f0a62fa8720f Mon Sep 17 00:00:00 2001 From: Alijohn Ghassemlouei Date: Fri, 28 Aug 2026 11:55:47 -0400 Subject: [PATCH 2/2] docs(blueprints): add deployer permissions and impersonation guide to postgresql and app-engine (#115) --- blueprints/fedramp-high/app-engine/README.md | 32 +++++++++++++++ blueprints/il5/postgresql/README.md | 43 +++++++++++++++----- 2 files changed, 65 insertions(+), 10 deletions(-) diff --git a/blueprints/fedramp-high/app-engine/README.md b/blueprints/fedramp-high/app-engine/README.md index 7342bfa1d..58812d1d8 100644 --- a/blueprints/fedramp-high/app-engine/README.md +++ b/blueprints/fedramp-high/app-engine/README.md @@ -37,6 +37,38 @@ You should see this README and some terraform files. Use the GCP consule to verify if the resources have been created. ```To verify the creation of Instance classes: Go to Instances in your landing project```
+ +## Deployer Permissions + +The service account or identity deploying this blueprint requires the following roles: +- **Workload Project (`main_project_id`):** + - `roles/appengine.appCreator` or `roles/appengine.appAdmin` + - `roles/serviceusage.serviceUsageAdmin` + +### Impersonated Deployment Configuration + +When deploying through service account impersonation, the Terraform `google` and `google-beta` providers must specify `user_project_override = true` and `billing_project` set to the workload project. Without this setting, provider-level quota and API enablement checks resolve against the deploying service account's project rather than the target workload project, leading to false `SERVICE_DISABLED` errors. + +Example provider configuration: + +```hcl +provider "google" { + project = "" + region = "" + impersonate_service_account = "@.iam.gserviceaccount.com" + user_project_override = true + billing_project = "" +} + +provider "google-beta" { + project = "" + region = "" + impersonate_service_account = "@.iam.gserviceaccount.com" + user_project_override = true + billing_project = "" +} +``` + ## Variables diff --git a/blueprints/il5/postgresql/README.md b/blueprints/il5/postgresql/README.md index 0a40159ee..3621cd324 100644 --- a/blueprints/il5/postgresql/README.md +++ b/blueprints/il5/postgresql/README.md @@ -17,19 +17,42 @@ limitations under the License. 1. Copy terraform.tfvars.sample to terraform.tfvars 1. Updated terraform.tfvars -## Notes -1. There seems to be a provider bug that will not allow a full terraform delete to complete due to the following error: +## Deployer Permissions -``` -Unable to remove Service Networking Connection, err: Error waiting for Delete Service Networking Connection: Error code 9, message: Failed to delete connection; Producer services (e.g. CloudSQL, Cloud Memstore, etc.) are still using this connection. -``` +The service account or identity deploying this blueprint requires the following roles: +- **Workload Project (`main_project_id`):** + - `roles/cloudsql.admin` + - `roles/serviceusage.serviceUsageAdmin` +- **Network Host Project (`network_project_id`):** + - `roles/compute.networkUser` + - `roles/compute.securityAdmin` (for managing the firewall rule) +- **KMS Project / Key (`kms_key_name`):** + - `roles/cloudkms.cryptoKeyEncrypterDecrypter` -To ensure proper deletion, please manually delete the peered network that is created, release the allocated ip address, and remove the following three services from the terraform state (terraform state rm ) -``` -data.google_compute_network.network -google_compute_global_address.postgres -google_service_networking_connection.postgres +### Impersonated Deployment Configuration + +When deploying through service account impersonation, the Terraform `google` and `google-beta` providers must specify `user_project_override = true` and `billing_project` set to the workload project. Without this setting, provider-level quota and API enablement checks resolve against the deploying service account's project rather than the target workload project, leading to false `SERVICE_DISABLED` errors. + +Example provider configuration: + +```hcl +provider "google" { + project = "" + region = "" + impersonate_service_account = "@.iam.gserviceaccount.com" + user_project_override = true + billing_project = "" +} + +provider "google-beta" { + project = "" + region = "" + impersonate_service_account = "@.iam.gserviceaccount.com" + user_project_override = true + billing_project = "" +} ``` + ## Variables