Coalfire GCP RAMPpak

Coalfire created reference architecture for FedRAMP Google Cloud builds. This repository is used as a parent directory to deploy Coalfire-CF/terraform-google-<service> modules.

Learn more at Coalfire OpenSource.

Get our SSP Templates and Reference Architecture Design Document Template

Architecture

Tooling

• gcloud CLI (435.0.0)
• Terraform (1.5.0)
• Terraform Google Cloud Platform Provider Provider (4.70.0)

Dependencies

1. Setup Cloud Identity and verify your domain.
2. After Cloud Identity has been configured, create an organization.
   • Turn on 2-Step Verification enforcement.
3. Create grp-gcp-org-admins@your-domain.com group in Cloud Identity and add members.
   • Add Security label to group.
   • Select Restricted Access type.
4. Create FedRAMP Moderate Assured Workloads folder in Cloud Console on the Assured Workloads page. Assured Workloads is required for FedRAMP compliance as Google doesn't have a GovCloud offering.
   • Compliance type: FedRAMP Moderate
   • Region: US
   • Folder location: choose organization
   • Folder name: fldr-assured-workloads
   • Review and create folder

Deployment Order of Operations

1. Dependencies
2. Security Core
3. Networking Setup
4. Bastions

Deployment Configurations

Each folder, e.x. organization/security_core has a README that provides configuration steps, documents outputs, dependencies, and other notes on each component in the environment.

Modifications when new Admins are added

• Add new user in Admin console
• Add new user as member to grp-gcp-org-admins@your-domain.com group

Environment Setup

• Download and install the gcloud CLI - https://cloud.google.com/sdk/gcloud#download_and_install_the
• Create a new configuration - gcloud config configurations create <name>
• Activate the new configuration - gcloud config configurations activate <name>
• Authenticate gcloud with new configuration - gcloud auth application-default login

Resources

• Creating and managing organization resources
• Create an Assured Workloads folder
• Google Cloud FedRAMP implementation guide
• Google Cloud services and authorized regions that are covered by FedRAMP

Contributing

If you're interested in contributing to our projects, please review the Contributing Guidelines. And send an email to our team to receive a copy of our CLA and start the onboarding process.

License

Copyright

Copyright © 2024 Coalfire Systems Inc.