google / google/stellar-engine

[Feature Request] Out-of-Band Drift Alerting

Open
#46 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
HCL
Stars
49
Forks
20
Avg merge
3d 14h
Merged PRs (30d)
28

Description

## Feature Description
Automated alerting triggered when infrastructure changes are made outside of the authorized Terraform CI/CD service account.

## Use Case
To maintain strict compliance and security, administrators need to know immediately if a human operator makes manual edits (drift) in the Google Cloud Console.

## Proposed Solution
Create a dedicated blueprint utilizing Google Cloud Log Router and Pub/Sub to filter for administrative write operations missing the Terraform service account identity, and route those events to an alerting topic.

## Compliance & Deployment Context
* **Target Deployment Type(s):**
* [ ] US Region Restricted (e.g., Access Policy constraint)
* [ ] FedRAMP Medium
* [x] FedRAMP High
* [ ] DoD IL4
* [ ] DoD IL5
* [ ] All / General
* **Relevant NIST 800-53r5 Controls:** AU-6 (Audit Record Review, Analysis, and Reporting), SI-4 (System Monitoring).

## Reusability Check
Stellar Engine prioritizes reusability.
* [x] I have checked if this functionality can be achieved by extending an existing module or blueprint.
* [x] I have verified that this does not duplicate existing functionality.

## Alternatives Considered
Relying strictly on Security Command Center, which does not provide immediate granular alerting for out-of-band IAM/Compute modifications.

## Additional Context
This was explicitly requested in the legacy Feature Braindump from 2023.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.