Update default FAST org policies (#2906)

* Update org default org policies

* Update default FAST org policies

fast/stages/0-bootstrap/data/org-policies-managed/cloudbuild.yaml

@@ -0,0 +1,36 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../schemas/org-policies.schema.json
+
+compute.disableGuestAttributesAccess:
+  rules:
+    - enforce: true
+
+cloudbuild.disableCreateDefaultServiceAccount:
+  rules:
+    - enforce: true
+    
+cloudbuild.useBuildServiceAccount: 
+  rules:
+    - enforce: true
+    
+cloudbuild.useComputeServiceAccount:
+  rules:
+    - enforce: true
+    

fast/stages/0-bootstrap/data/org-policies-managed/compute.yaml

@@ -18,6 +18,10 @@
 
 # yaml-language-server: $schema=../../schemas/org-policies.schema.json
 
+compute.disableInternetNetworkEndpointGroup:
+  rules:
+  - enforce: true
+
 compute.disableGuestAttributesAccess:
   rules:
     - enforce: true
@@ -28,7 +32,11 @@ compute.disableNestedVirtualization:
 
 compute.disableSerialPortAccess:
   rules:
-  - enforce: true    
+  - enforce: true
+
+compute.disableVpcExternalIpv6:
+  rules:
+  - enforce: true
 
 compute.requireOsLogin:
   rules:
@@ -46,8 +54,8 @@ compute.skipDefaultNetworkCreation:
 
 compute.setNewProjectDefaultToZonalDNSOnly:
   rules:
-  - enforce: true  
-  
+  - enforce: true
+
 # only allow GCP images by default
 compute.trustedImageProjects:
   rules:

fast/stages/0-bootstrap/data/org-policies-managed/iam.yaml

@@ -34,6 +34,10 @@ iam.managed.allowedPolicyMembers:
           ]
         }
 
+iam.disableAuditLoggingExemption:
+  rules:
+    - enforce: true
+
 iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts:
   rules:
     - enforce: true
@@ -51,3 +55,13 @@ iam.serviceAccountKeyExposureResponse:
     - allow:
         values:
           - DISABLE_KEY
+
+iam.workloadIdentityPoolAwsAccounts:
+  rules:
+    - deny:
+        all: true
+
+iam.workloadIdentityPoolProviders:
+  rules:
+    - deny:
+        all: true

fast/stages/0-bootstrap/data/org-policies/cloudbuild.yaml

@@ -0,0 +1,36 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../schemas/org-policies.schema.json
+
+compute.disableGuestAttributesAccess:
+  rules:
+    - enforce: true
+
+cloudbuild.disableCreateDefaultServiceAccount:
+  rules:
+    - enforce: true
+    
+cloudbuild.useBuildServiceAccount: 
+  rules:
+    - enforce: true
+    
+cloudbuild.useComputeServiceAccount:
+  rules:
+    - enforce: true
+    

fast/stages/0-bootstrap/data/org-policies/compute.yaml

@@ -22,13 +22,21 @@ compute.disableGuestAttributesAccess:
   rules:
     - enforce: true
 
+compute.disableInternetNetworkEndpointGroup:
+  rules:
+  - enforce: true
+
 compute.disableNestedVirtualization:
   rules:
   - enforce: true
 
 compute.disableSerialPortAccess:
   rules:
-  - enforce: true    
+  - enforce: true
+
+compute.disableVpcExternalIpv6:
+  rules:
+  - enforce: true
 
 compute.requireOsLogin:
   rules:
@@ -46,8 +54,8 @@ compute.skipDefaultNetworkCreation:
 
 compute.setNewProjectDefaultToZonalDNSOnly:
   rules:
-  - enforce: true  
-  
+  - enforce: true
+
 # only allow GCP images by default
 compute.trustedImageProjects:
   rules:

fast/stages/0-bootstrap/data/org-policies/iam.yaml

@@ -38,6 +38,10 @@ iam.automaticIamGrantsForDefaultServiceAccounts:
   rules:
     - enforce: true
 
+iam.disableAuditLoggingExemption:
+  rules:
+    - enforce: true
+
 iam.disableServiceAccountKeyCreation:
   rules:
     - enforce: true
@@ -51,3 +55,13 @@ iam.serviceAccountKeyExposureResponse:
     - allow:
         values:
           - DISABLE_KEY
+
+iam.workloadIdentityPoolAwsAccounts:
+  rules:
+    - deny:
+        all: true
+
+iam.workloadIdentityPoolProviders:
+  rules:
+    - deny:
+        all: true