Integration and CCCS Security Asessement Procedure: 3rd party vendors that provide value added services for the landing zone

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/dev/solutions/landing-zone/architecture.md#di-44-3rd-party-vendor-partner-service-integration
As a platform admin I need to integrate a 3rd party IaaS, PaaS, SaaS service into the landing zone to provide specific functionality.
As a security admin I need to validate the security posture of the 3rd party service and validate or facilitate CCCS approval.

Detail integration procedures for 3rd party vendors that provide value added services for the landing zone.
An example was the recent addition of an IaaS NGFW to the perimeter by the SSC team.

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/258

See also for release cadence - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/350

## Rough Procedure (based on history) - iterative/editing/ongoing

Variant 1: Co-located: Landing Zone (LZ) repo owner gets a formal SA&A/ATO (Security Assessment and Authorization / Authority to Operate) that includes the vendor service in the core service list.

TLDR;
- Clone existing code
- Run LZ baseline
- Integrate new/existing vendor code
- Test/doc/secure/review + formal PR (pull request) ongoing
- Participate indirectly in the SA&A/ATO process with the security assessment occurring on this LZ
- Participate indirectly in the CCCS assessment.
- Participate in [Assured Workloads](https://cloud.google.com/assured-workloads) Compliance work
- Release as part of a major or minor release + release notes (breaking changes) -

Get 1 or more dev/test/prod Google Cloud GCP organizations to work with. Ideally at least 1 is new/empty.
Goal: Both the vendor partner and the team (SSC, Google, Collaborating Orgs, Partners) developing the pubsec landing zone repository work together to create/integrate deployment yamls, onboarding scripts, documentation and security review/mitigation. Security, DevOps, Architecture and developer experience for both the standalone and managed aspects of the landing zone are worked out between the teams in public on the repo.

(optional) Get a new GCP org and enable Cloud Identity either with/without workspaces or Identity Federation.
See guide at https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md A common use case is 3rd party email, 3rd party domain registration and shared (existing) billing. See https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md#onboarding-category-3b1-3rd-party-email-account---3rd-party-aws-route53-domain-validation---reuse-existing-billing-account

Clone/fork the pubsec repo via instructions starting at
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit

Follow instructions to Run the LZ baseline in your org
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/docs/landing-zone-v2

Start working with the LZ team to integrate new/existing vendor code
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues
Example
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/258

Iterative: test/doc/secure/review + formal PR (pull request) ongoing

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/pulls
Example
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/pull/283

Participate indirectly in the SA&A/ATO process with the security assessment occurring on this LZ
Participate indirectly in the CCCS assessment.

Release as part of a major or minor release + release notes (breaking changes) - see https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/350

Variant 2: Marketplace