[Calvin-Cheng1]

Description

Adds the deploy_org_resources object variable to fast/stages-aw/0-bootstrap to allow selective control over deploying organization-level resources for brownfield environments or folder-scoped deployments without organization-level permissions.

Each attribute defaults to true to preserve existing behavior:

• audit_config: Toggles google_organization_iam_audit_config.organization versus google_folder_iam_audit_config.folder on the root Assured Workloads folder.
• custom_roles: Toggles organization-level custom role creation and custom role IAM bindings (storage_viewer, organization_admin_viewer, tag_viewer), returning {} for custom_roles outputs when false.
• iam: Toggles organization-level IAM bindings in module.organization versus folder-scoped IAM bindings (filtering out organization-only roles) and conditional roles/resourcemanager.folderIamAdmin delegated grants in module.root-folder-config.
• logging_settings: Toggles module.organization-logging versus folder-level logging_settings in module.root-folder-config.
• logging_sinks: Toggles log sinks on module.organization versus module.root-folder-config and routes tfvars.logging.writer_identities accordingly.
• org_policies: Toggles organization policy creation and default organization policy import blocks.
• workforce_identity_pool: Toggles google_iam_workforce_pool.default creation.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Deployment & Compliance Impact

• Applicable Regimes:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Moderate
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • General / All
• NIST 800-53r5 Controls: AU-2, AU-6, AC-2, AC-6 (supports folder-scoped audit configs, log sinks, and least-privilege IAM when organization-level deployment is disabled).

Checklist

Code Quality & Reusability

• My code adheres to the Maximize Reusability principle. I have not redefined common elements and have reused existing base configurations and modules where possible.
• I have checked that no existing module or configuration in modules/ or fast/ can be leveraged for this change.
• My code follows the established naming conventions outlined in documentation/naming-convention.md.

Documentation

• I have updated the README.md of the modified module or blueprint.
• I have added/updated documentation for inputs (variables) and outputs.

Security

• My change adheres to GCP security best practices and the principle of least privilege.
• I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).

Testing

• I have tested my changes locally.
• I have included details of my testing in this PR.

Testing Performed

• Ran terraform fmt -check and terraform validate in fast/stages-aw/0-bootstrap.
• Regenerated and verified fast/stages-aw/0-bootstrap/README.md with tools/tfdoc.py and tools/check_documentation.py.

[aghassemlouei]

Appreciate the clean deploy_org_resources toggle structure for folder-scoped Stage 0 deployments. Running terraform plan across compliance regimes and validating the folder-scoped resources against an IL5 Assured Workloads folder surfaced six blocking plan, apply, and cross-stage issues documented inline:

1. fast/stages-aw/0-bootstrap/organization.tf fails terraform plan with Inconsistent conditional result types whenever deploy_org_resources.org_policies is true, including the default deploy_org_resources = {}.
2. fast/stages-aw/0-bootstrap/automation.tf fails terraform plan on fresh deployments with Invalid for_each argument when iam = false and custom_roles = true, and drops read access to the Stage 0 outputs bucket when custom_roles = false.
3. fast/stages-aw/0-bootstrap/organization.tf leaves four organization-only IAM roles unfiltered on module.root-folder-config, omits roles/resourcemanager.folderAdmin for bootstrap-0, and leaves 1-resman writing organization-level additive IAM without permissions when iam = false.
4. fast/stages-aw/0-bootstrap/organization.tf sets logging_settings on module.root-folder-config without a KMS key, which fails constraints/gcp.restrictNonCmekServices on IL5 and FEDRAMP_HIGH Assured Workloads folders and evaluates after Stage 0 projects are already created.
5. fast/stages-aw/0-bootstrap/outputs.tf writes custom_roles = {} into 0-bootstrap.auto.tfvars.json when custom_roles = false, which fails var.custom_roles object validation and unguarded var.custom_roles lookups in Stages 1 through 3.
6. fast/stages-aw/0-bootstrap/audit-logging.tf and organization.tf add count to google_organization_iam_audit_config.organization and module.organization-logging without moved blocks, planning a destroy-and-recreate on existing deployments.

Adding terraform test coverage for both the default deploy_org_resources = {} configuration and the folder-scoped toggle combinations will help catch plan-time regressions in CI.

[aghassemlouei]

All 6 review items are resolved and verified against Stage 0 and Stage 1 folder-scoped plans. LGTM.