Description of Documentation Need
var.kms_keys in 3-security defaults to {} (variables.tf, default at line ~109), so the kms_locations local is empty and the for_each on prod-sec-kms / dev-sec-kms iterates over nothing — no keyring and no key are created. There is no terraform.tfvars (or sample) in the stage. The security projects come up with no keyrings at all. This is arguably intended (keys are opt-in), but it is undocumented, and any downstream consumer expecting a workload key — e.g., a CMEK-enabled blueprint — finds nothing, with no pointer to what to populate.
Target Audience
Operators running Stage 3 for the first time; blueprint consumers wiring CMEK.
Proposed Location
fast/stages-aw/3-security/README.md, plus a shipped terraform.tfvars.sample in the stage.
Content Outline / Draft
- Prominent note: Stage 3 produces no keyrings/keys until
var.kms_keys is populated.
- A documented sample
terraform.tfvars with one representative key (locations, rotation, per-key version_template with protection_level = "HSM" — spelling out the per-key template also mitigates the silent-SOFTWARE trap filed separately).
- How downstream consumers retrieve key paths (
terraform output kms_keys, keyed {env}-{name}:{location}).
Compliance Context (if applicable)
Prevents empty-keyring surprises where CMEK is the expected posture (SC-12/SC-13 support). Verified at 3728fc98: 3-security is a single stage shared by all Assured Workloads regimes (regime selection is a 0-bootstrap variable; no regime conditioning in this code path), so FedRAMP High, IL4, and IL5 (the regimes SE currently supports) are all affected.
Description of Documentation Need
var.kms_keysin 3-security defaults to{}(variables.tf, default at line ~109), so thekms_locationslocal is empty and thefor_eachonprod-sec-kms/dev-sec-kmsiterates over nothing — no keyring and no key are created. There is noterraform.tfvars(or sample) in the stage. The security projects come up with no keyrings at all. This is arguably intended (keys are opt-in), but it is undocumented, and any downstream consumer expecting a workload key — e.g., a CMEK-enabled blueprint — finds nothing, with no pointer to what to populate.Target Audience
Operators running Stage 3 for the first time; blueprint consumers wiring CMEK.
Proposed Location
fast/stages-aw/3-security/README.md, plus a shippedterraform.tfvars.samplein the stage.Content Outline / Draft
var.kms_keysis populated.terraform.tfvarswith one representative key (locations, rotation, per-keyversion_templatewithprotection_level = "HSM"— spelling out the per-key template also mitigates the silent-SOFTWARE trap filed separately).terraform output kms_keys, keyed{env}-{name}:{location}).Compliance Context (if applicable)
Prevents empty-keyring surprises where CMEK is the expected posture (SC-12/SC-13 support). Verified at
3728fc98:3-securityis a single stage shared by all Assured Workloads regimes (regime selection is a 0-bootstrap variable; no regime conditioning in this code path), so FedRAMP High, IL4, and IL5 (the regimes SE currently supports) are all affected.