google / google/stellar-engine
[Feature Request] Out-of-Band Drift Alerting
- Dominant language
- HCL
- Stars
- 49
- Forks
- 20
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 28
Description
## Feature Description
Automated alerting triggered when infrastructure changes are made outside of the authorized Terraform CI/CD service account.
## Use Case
To maintain strict compliance and security, administrators need to know immediately if a human operator makes manual edits (drift) in the Google Cloud Console.
## Proposed Solution
Create a dedicated blueprint utilizing Google Cloud Log Router and Pub/Sub to filter for administrative write operations missing the Terraform service account identity, and route those events to an alerting topic.
## Compliance & Deployment Context
* **Target Deployment Type(s):**
* [ ] US Region Restricted (e.g., Access Policy constraint)
* [ ] FedRAMP Medium
* [x] FedRAMP High
* [ ] DoD IL4
* [ ] DoD IL5
* [ ] All / General
* **Relevant NIST 800-53r5 Controls:** AU-6 (Audit Record Review, Analysis, and Reporting), SI-4 (System Monitoring).
## Reusability Check
Stellar Engine prioritizes reusability.
* [x] I have checked if this functionality can be achieved by extending an existing module or blueprint.
* [x] I have verified that this does not duplicate existing functionality.
## Alternatives Considered
Relying strictly on Security Command Center, which does not provide immediate granular alerting for out-of-band IAM/Compute modifications.
## Additional Context
This was explicitly requested in the legacy Feature Braindump from 2023.
Contributor guide
Assessment
This issue has not been assessed yet.