Skip to content

Add support for FedRAMP Moderate Assured Workloads deployments - #162

Merged
aghassemlouei merged 9 commits into
mainfrom
jeffpugh/g4g-frm
Aug 10, 2026
Merged

Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom
jeffpugh/g4g-frm

Conversation

@jmpugh

@jmpughjmpugh commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

Description

Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:

  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective

Fixes#101

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update

Deployment & Compliance Impact

  • Applicable Regimes:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Moderate
    • FedRAMP High
    • DoD IL4
    • DoD IL5
    • General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)

Checklist

Code Quality & Reusability

  • My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  • I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  • My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

  • I have updated the README.md of the modified module or blueprint.
  • I have added/updated documentation for inputs (variables) and outputs.

Security

  • My change adheres to GCP security best practices and the principle of least privilege.
  • I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).

Testing

  • I have tested my changes locally.
  • I have included details of my testing in this PR.

Testing Performed

I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.

jmpugh
jmpugh commented Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh commented Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh requested a review from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei added enhancement New feature or request Priority - High Critical issues blocking development or users; urgent bugs or core features for release Level of Effort - High Complex task taking a week or more; consider breaking this down into smaller issues. labels Aug 10, 2026
aghassemlouei
aghassemlouei previously approved these changes Aug 10, 2026
View reviewed changes

@aghassemloueiaghassemlouei left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript

aghassemlouei
aghassemlouei previously approved these changes Aug 10, 2026
View reviewed changes

@aghassemloueiaghassemlouei left a comment •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.

@aghassemlouei
aghassemlouei enabled auto-merge (squash) August 10, 2026 19:34
@aghassemlouei
aghassemlouei merged commit 7033b8c into mainAug 10, 2026
13 checks passed
@github-project-automationgithub-project-automationBot moved this from Todo to Done in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei deleted the jeffpugh/g4g-frm branch August 10, 2026 20:10
This was referenced Aug 11, 2026
Open
Open
@scottonixscottonix mentioned this pull request Aug 28, 2026
Open
19 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees

No one assigned

Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate

3 participants

@jmpugh@aghassemlouei@LanceWray
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Add support for FedRAMP Moderate Assured Workloads deployments by jmpugh · Pull Request #162 · google/stellar-engine · GitHub
Skip to content
Add support for FedRAMP Moderate Assured Workloads deployments - #162
Merged
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Aug 10, 2026
Merged
Add support for FedRAMP Moderate Assured Workloads deployments#162
aghassemlouei merged 9 commits into
mainfrom 
jeffpugh/g4g-frm
Conversation
@jmpugh
@jmpughjmpugh
commented
Jul 24, 2026

Copy link


Copy Markdown

Collaborator
Description
Updates Stellar Engine FAST stages to deploy Assured Workloads supporting the FedRAMP Moderate compliance regime. The major differences between FedRAMP Moderate and High are the following:
  • FRM does not have to conform to the strict US-data boundary
  • FRM allows for global resource deployment (eg Load Balancing) due to the above
  • FRM has more relaxed encryption policies, namely allowing for SOFTWARE level protection in KMS which is more cost-effective
Fixes#101
Type of Change
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to not work as expected)
  •  Documentation update
Deployment & Compliance Impact
  • Applicable Regimes:
    •  US Region Restricted (e.g., Access Policy constraint)
    •  FedRAMP Moderate
    •  FedRAMP High
    •  DoD IL4
    •  DoD IL5
    •  General / All
  • NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)
Checklist
Code Quality & Reusability
  •  My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
  •  I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
  •  My code follows the established naming conventions outlined in documentation/naming-convention.md.
Documentation
  •  I have updated the README.md of the modified module or blueprint.
  •  I have added/updated documentation for inputs (variables) and outputs.
Security
  •  My change adheres to GCP security best practices and the principle of least privilege.
  •  I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
Testing
  •  I have tested my changes locally.
  •  I have included details of my testing in this PR.
Testing Performed
I have successfully completed the FAST stages to deploy Assured Workloads compliant with the FedRAMP Moderate regime.
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/data/custom-org-policies/lb_policy.yaml
jmpugh
jmpugh
commented
Jul 24, 2026
View reviewed changes
Comment threadfast/stages-aw/0-bootstrap/main.tf
Comment threadfast/stages-aw/0-bootstrap/outputs.tf
Comment threadscripts/deploy.sh
Comment threadscripts/destroy.sh
Comment threadfast/stages-aw/2-networking-a-fedramp/nva.tf
@jmpugh
jmpugh
requested a review
from LanceWrayJuly 24, 2026 19:46
@aghassemloueiaghassemlouei
added

enhancement
New feature or request
Priority - High
Critical issues blocking development or users; urgent bugs or core features for release
Level of Effort - High
Complex task taking a week or more; consider breaking this down into smaller issues.
labels
Aug 10, 2026
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment


Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed a minor issue with the shellscript
aghassemlouei
aghassemlouei
previously approved these changes
Aug 10, 2026
View reviewed changes
@aghassemloueiaghassemlouei
left a comment
•

edited

Loading

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made some minor modifications to get the workflows to work but this looks functionally good. Nice work @jmpugh! Leaving it with @LanceWray to fully review before merging it into main.
@aghassemlouei
aghassemlouei
enabled auto-merge (squash)
August 10, 2026 19:34
@aghassemlouei
aghassemlouei
merged commit 7033b8c
into
mainAug 10, 2026

13 checks passed

@github-project-automationgithub-project-automationBot
moved this from Todo
to Done
in stellar-engineAug 10, 2026
@aghassemlouei
aghassemlouei
deleted the

jeffpugh/g4g-frm

branch
August 10, 2026 20:10

This was referenced Aug 11, 2026

Open


Open

@scottonixscottonix
mentioned this pull request
Aug 28, 2026
 Open

19 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@LanceWrayLanceWrayLanceWray approved these changes
@aghassemloueiaghassemloueiaghassemlouei left review comments
@michael-intindolamichael-intindolaAwaiting requested review from michael-intindola
@woodham1woodham1Awaiting requested review from woodham1
@mgcarey-googlemgcarey-googleAwaiting requested review from mgcarey-google

Assignees


No one assigned


Labels

enhancementNew feature or requestLevel of Effort - HighComplex task taking a week or more; consider breaking this down into smaller issues.Priority - HighCritical issues blocking development or users; urgent bugs or core features for release

Projects

stellar-engine

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Extend Stellar Engine to support FedRAMP Moderate


3 participants

@jmpugh@aghassemlouei@LanceWray