Implement various compliance configuration and principle of least privilege for hardened dataset

fast/stages/0-org-setup/datasets/hardened/README.md

@@ -34,7 +34,11 @@ To use this `hardened` dataset, create a `0-org-setup.auto.tfvars` file in the `
 
 ```tfvars
 factories_config = {
+  defaults         = "datasets/hardened/defaults.yaml"
+  folders          = "datasets/hardened/folders"
+  observability    = "datasets/hardened/observability"
   organization     = "datasets/hardened/organization"
+  projects         = "datasets/hardened/projects"
 }
 ```
 

fast/stages/0-org-setup/datasets/hardened/folders/data-platform/.config.yaml

@@ -0,0 +1,17 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../schemas/folder.schema.json
+
+name: Data Platform

fast/stages/0-org-setup/datasets/hardened/folders/data-platform/dev/.config.yaml

@@ -0,0 +1,52 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../../schemas/folder.schema.json
+
+name: Development
+iam_by_principals:
+  $iam_principals:service_accounts/iac-0/iac-dp-dev-rw:
+    - roles/bigquery.admin
+    - roles/composer.admin
+    - roles/compute.xpnAdmin
+    - roles/dataflow.admin
+    - roles/iam.serviceAccountAdmin
+    - roles/logging.admin
+    - roles/pubsub.admin
+    - roles/resourcemanager.folderAdmin
+    - roles/resourcemanager.projectCreator
+    - roles/resourcemanager.projectDeleter
+    - roles/resourcemanager.projectIamAdmin
+    - roles/serviceusage.serviceUsageAdmin
+    - roles/storage.admin
+  $iam_principals:service_accounts/iac-0/iac-dp-dev-ro:
+    - roles/bigquery.dataViewer
+    - roles/bigquery.jobUser
+    - roles/browser
+    - roles/composer.user
+    - roles/datacatalog.viewer
+    - roles/dataflow.viewer
+    - roles/logging.viewer
+    - roles/pubsub.viewer
+    - roles/resourcemanager.folderViewer
+    - roles/resourcemanager.tagViewer
+    - roles/serviceusage.serviceUsageViewer
+    - roles/storage.bucketViewer
+    - roles/storage.objectViewer
+    - $custom_roles:folder_viewer
+    - $custom_roles:logging_viewer
+    - $custom_roles:service_account_viewer
+    - $custom_roles:storage_viewer
+tag_bindings:
+  environment: $tag_values:environment/development

fast/stages/0-org-setup/datasets/hardened/folders/data-platform/prod/.config.yaml

@@ -0,0 +1,19 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../../schemas/folder.schema.json
+
+name: Production
+tag_bindings:
+  environment: $tag_values:environment/production

fast/stages/0-org-setup/datasets/hardened/folders/networking/.config.yaml

@@ -0,0 +1,73 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../schemas/folder.schema.json
+
+name: Networking
+iam_by_principals:
+  $iam_principals:service_accounts/iac-0/iac-networking-rw:
+    - roles/compute.networkAdmin
+    - roles/compute.securityAdmin
+    - roles/compute.xpnAdmin
+    - roles/dns.admin
+    - roles/iam.networkAdmin
+    - roles/logging.admin
+    - roles/resourcemanager.folderAdmin
+    - roles/resourcemanager.projectCreator
+    - roles/resourcemanager.projectDeleter
+    - roles/resourcemanager.projectIamAdmin
+    - roles/resourcemanager.tagUser
+    - roles/serviceusage.serviceUsageAdmin
+  $iam_principals:service_accounts/iac-0/iac-networking-ro:
+    - roles/browser
+    - roles/compute.networkViewer
+    - roles/dns.reader
+    - roles/logging.viewer
+    - roles/resourcemanager.folderViewer
+    - roles/resourcemanager.tagViewer
+    - roles/serviceusage.serviceUsageViewer
+    - $custom_roles:service_networking_viewer
+  $iam_principals:service_accounts/iac-0/iac-pf-rw:
+    - $custom_roles:service_project_network_admin
+  $iam_principals:service_accounts/iac-0/iac-pf-ro:
+    - roles/compute.viewer
+    - $custom_roles:project_iam_viewer
+iam_bindings:
+  dp_dev_rw:
+    members:
+      - $iam_principals:service_accounts/iac-0/iac-dp-dev-rw
+    role: $custom_roles:service_project_network_admin
+    condition:
+      expression: |
+        resource.matchTag('${organization.id}/environment', 'development')
+      title: Data platform dev service project admin.
+  dp_dev_ro:
+    role: roles/compute.networkViewer
+    members:
+      - $iam_principals:service_accounts/iac-0/iac-dp-dev-ro
+    condition:
+      title: Data platform dev network viewer.
+      expression: |
+        resource.matchTag('${organization.id}/environment', 'development')
+  project_factory:
+    role: roles/resourcemanager.projectIamAdmin
+    members:
+      - $iam_principals:service_accounts/iac-0/iac-pf-rw
+    condition:
+      title: Project factory delegated IAM grant.
+      expression: |
+        api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
+          'roles/compute.networkUser', 'roles/composer.sharedVpcAgent',
+          'roles/container.hostServiceAgentUser', 'roles/vpcaccess.user'
+        ])

fast/stages/0-org-setup/datasets/hardened/folders/networking/dev/.config.yaml

@@ -0,0 +1,33 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../../schemas/folder.schema.json
+
+name: Development
+iam:
+  $custom_roles:project_iam_viewer:
+    - $iam_principals:service_accounts/iac-0/iac-dp-dev-ro
+iam_bindings:
+  dp_dev:
+    role: roles/resourcemanager.projectIamAdmin
+    members:
+      - $iam_principals:service_accounts/iac-0/iac-dp-dev-rw
+    condition:
+      title: Data platform dev delegated IAM grant.
+      expression: |
+        api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
+          '${custom_roles.service_project_network_admin}'
+        ])
+tag_bindings:
+  environment: $tag_values:environment/development

fast/stages/0-org-setup/datasets/hardened/folders/networking/prod/.config.yaml

@@ -0,0 +1,19 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../../schemas/folder.schema.json
+
+name: Production
+tag_bindings:
+  environment: $tag_values:environment/production

fast/stages/0-org-setup/datasets/hardened/folders/security/.config.yaml

@@ -0,0 +1,53 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../schemas/folder.schema.json
+
+name: Security
+iam_by_principals:
+  $iam_principals:service_accounts/iac-0/iac-security-rw:
+    - roles/cloudkms.admin
+    - roles/logging.admin
+    - roles/resourcemanager.folderAdmin
+    - roles/resourcemanager.projectCreator
+    - roles/resourcemanager.projectDeleter
+    - roles/resourcemanager.projectIamAdmin
+    - roles/resourcemanager.tagUser
+    - roles/securitycenter.admin
+    - roles/serviceusage.serviceUsageAdmin
+  $iam_principals:service_accounts/iac-0/iac-security-ro:
+    - roles/browser
+    - roles/cloudkms.viewer
+    - roles/logging.viewer
+    - roles/resourcemanager.folderViewer
+    - roles/resourcemanager.tagViewer
+    - roles/securitycenter.viewer
+    - roles/serviceusage.serviceUsageViewer
+    - $custom_roles:logging_viewer
+  $iam_principals:service_accounts/iac-0/iac-pf-rw:
+    - roles/cloudkms.cryptoKeyEncrypterDecrypter
+  $iam_principals:service_accounts/iac-0/iac-pf-ro:
+    - roles/cloudkms.viewer
+    - $custom_roles:project_iam_viewer
+iam_bindings:
+  project_factory:
+    role: roles/resourcemanager.projectIamAdmin
+    members:
+      - $iam_principals:service_accounts/iac-0/iac-pf-rw
+    condition:
+      title: Project factory delegated IAM grant.
+      expression: |
+        api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
+          'roles/cloudkms.cryptoKeyEncrypterDecrypter'
+        ])

fast/stages/0-org-setup/datasets/hardened/folders/security/dev/.config.yaml

@@ -0,0 +1,25 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../0-org-setup/schemas/folder.schema.json
+
+name: Development
+parent: $folder_ids:security
+tag_bindings:
+  environment: $tag_values:environment/development
+iam_by_principals:
+  $iam_principals:service_accounts/iac-0/iac-dp-dev-ro:
+    - $custom_roles:cloudkms_viewer
+  $iam_principals:service_accounts/iac-0/iac-pf-ro:
+    - $custom_roles:cloudkms_viewer

fast/stages/0-org-setup/datasets/hardened/folders/security/prod/.config.yaml

@@ -0,0 +1,20 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../0-org-setup/schemas/folder.schema.json
+
+name: Production
+parent: $folder_ids:security
+tag_bindings:
+  environment: $tag_values:environment/production

fast/stages/0-org-setup/datasets/hardened/folders/teams/.config.yaml

@@ -0,0 +1,47 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../../../schemas/folder.schema.json
+
+name: Teams
+iam_by_principals:
+  $iam_principals:service_accounts/iac-0/iac-pf-rw:
+    - roles/bigquery.admin
+    - roles/container.admin
+    - roles/iam.serviceAccountAdmin
+    - roles/logging.admin
+    - roles/pubsub.admin
+    - roles/resourcemanager.folderAdmin
+    - roles/resourcemanager.projectCreator
+    - roles/resourcemanager.projectDeleter
+    - roles/resourcemanager.projectIamAdmin
+    - roles/resourcemanager.tagUser
+    - roles/serviceusage.serviceUsageAdmin
+    - roles/storage.admin
+    - $custom_roles:service_project_network_admin
+  $iam_principals:service_accounts/iac-0/iac-pf-ro:
+    - roles/bigquery.dataViewer
+    - roles/bigquery.jobUser
+    - roles/browser
+    - roles/compute.viewer
+    - roles/container.clusterViewer
+    - roles/logging.viewer
+    - roles/pubsub.viewer
+    - roles/resourcemanager.folderViewer
+    - roles/resourcemanager.tagViewer
+    - roles/serviceusage.serviceUsageViewer
+    - $custom_roles:logging_viewer
+    - $custom_roles:service_account_viewer
+tag_bindings:
+  context: $tag_values:context/project-factory

fast/stages/0-org-setup/datasets/hardened/organization/.config.yaml

@@ -64,6 +64,7 @@ iam_by_principals:
     - roles/resourcemanager.folderAdmin
     - roles/resourcemanager.organizationAdmin
     - roles/resourcemanager.projectCreator
+    - roles/resourcemanager.projectDeleter
     - roles/resourcemanager.projectMover
     - roles/resourcemanager.tagAdmin
     - roles/resourcemanager.tagUser
@@ -80,6 +81,7 @@ iam_by_principals:
     - roles/serviceusage.serviceUsageViewer
     - $custom_roles:organization_admin_viewer
     - $custom_roles:tag_viewer
+    - roles/securitycentermanagement.customModulesViewer
   $iam_principals:service_accounts/iac-0/iac-networking-rw:
     # uncomment for cooperative VPC-SC configurations
     # - roles/accesscontextmanager.policyEditor