From 99f57374e62f79ede21c31359d5d62de6aa5cf5a Mon Sep 17 00:00:00 2001 From: Aloys Jehwin Date: Fri, 28 Aug 2026 22:31:04 +0530 Subject: [PATCH] fix(2-networking-a-fedramp): encrypt NVA boot disk with the vdss KMS key The stage creates a vdss-keyring/default HSM key and grants cryptoKeyEncrypterDecrypter to the NVA service account and the VDSS host project compute service agent, but never references the key, so the NVA boot disks stay Google-managed. The IL5 stage uses the identically-named key on its bastion and NGFW disks. Fixes #193 Signed-off-by: Aloys Jehwin --- fast/stages-aw/2-networking-a-fedramp/nva.tf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fast/stages-aw/2-networking-a-fedramp/nva.tf b/fast/stages-aw/2-networking-a-fedramp/nva.tf index bf021afc7..48ccab98a 100644 --- a/fast/stages-aw/2-networking-a-fedramp/nva.tf +++ b/fast/stages-aw/2-networking-a-fedramp/nva.tf @@ -77,6 +77,9 @@ module "nva-template" { image = "cos-cloud/cos-stable" } } + encryption = { + kms_key_self_link = module.kms.keys.default.id + } options = { allow_stopping_for_update = true deletion_protection = false