Fix AW Folder reference when creating common services folder

[jmpugh]

Description

Explicitly look for the CONSUMER_FOLDER created by the google_assured_workloads_workload terraform resource to use as the parent for the Common Services child folder.

Fixes#168

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: (If this PR helps satisfy or modifies control implementations, list them here)

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

Tested via an IL5 deployment.

[Calvin-Cheng1]

Only concern I have with this approach is the assured_workloads_folder can potentially = a no compliance folder if no regime is selected which probably doesn't happen often but would be a incorrect statement.

Thoughts on this using a local in organization.tf as:

consumer_folder_id = try(one([
for r in google_assured_workloads_workload.primary[0].resources : r.resource_id if r.resource_type == "CONSUMER_FOLDER"
]), null)

This should evaluate to the AW folder in IL5 and always result in 1 and not the CMEK project.

Then we can keep the same logic as before and change:

var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : "folders/${module.no-compliance-folder[0].folder.id}"

to:

var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${local.consumer_folder_id}" : "folders/${module.no-compliance-folder[0].folder.id}"