[Bug] gemini-stage-0: modelarmor.googleapis.com is in neither service list, so a plain terraform apply fails on a disabled API whenever Model Armor is enabled

[JohnHales]

Bug Description

gemini-stage-0/model_armor.tf:25 creates a google_model_armor_template whenever Model Armor is requested, but the Model Armor API appears in neither of the stage's service lists:

# gemini-stage-0/main.tf:23-36
locals {
  base_services = [
    "aiplatform.googleapis.com",
    "discoveryengine.googleapis.com",
    "compute.googleapis.com",
    "cloudkms.googleapis.com",
    "bigquery.googleapis.com",
    "storage.googleapis.com",
    "accesscontextmanager.googleapis.com",
    "iam.googleapis.com",
    "iap.googleapis.com",
    "orgpolicy.googleapis.com",
    "serviceusage.googleapis.com",
    "secretmanager.googleapis.com"
  ]

  restricted_services = [
    "beyondcorp.googleapis.com",
    "certificatemanager.googleapis.com"
  ]

The only thing that enables it is an imperative call inside the wizard:

# deploy.sh:1361
gcloud services enable modelarmor.googleapis.com

which runs only if the operator goes through the interactive flow, and answers yes to the Model Armor prompt, and is on a regime that reaches that prompt at all. Anyone applying the stage directly with Terraform — after editing tfvars, from CI, or on a re-apply — gets the standard SERVICE_DISABLED 403 on google_model_armor_template, because nothing in the configuration enables the API it needs.

This is the same class as the already-filed #104 (blueprints requiring APIs the framework never enables), but inside the stage's own service list rather than a FAST stage's.

Environment and Deployment Context

• Stellar Engine Version/Commit: main at commit f64ce6cd (re-verified 2026-08-10)
• Deployment Type:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Medium
  • FedRAMP High
  • FedRAMP Moderate
  • DoD IL4
  • DoD IL5
  • Stand-alone / Custom
• FAST Stage (if applicable): N/A — this is a blueprint, not a FAST stage
  • Stage 0 (Bootstrap)
  • Stage 1 (Resource Management)
  • Stage 2 (Network Creation)
  • Stage 3 (Security and Audit)
• Affected Component:
  • blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/main.tf:23-36 (the service lists)
  • blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/model_armor.tf:25 (the resource)
  • blueprints/fedramp-high/gemini-enterprise/deploy.sh:1361 (the imperative enable)
• Terraform Version: 1.12.2 (pinned by deploy.sh via tfenv; the stage declares required_version >= 1.7.4)
• GCP Provider Version: hashicorp/google >= 6.21.0 (stage-0 declared constraint)

Steps to Reproduce

1. Configure stage-0 with an application whose enable_model_armor = true (or set the tfvars by hand).
2. terraform apply directly, without going through deploy.sh's Model Armor prompt.
3. The apply fails creating google_model_armor_template — the API is not enabled.

Expected Behavior

The configuration enables the APIs its own resources require.

Actual Behavior

A terraform apply that has not been preceded by deploy.sh's interactive Model Armor prompt fails creating google_model_armor_template, because nothing in the configuration enables modelarmor.googleapis.com.

Relevant Logs and Errors

Expected error (from source inspection; not captured from a run) — the standard SERVICE_DISABLED response:

Error: Error creating Template: googleapi: Error 403: Model Armor API has not been used in
project <project> before or it is disabled. Enable it by visiting
https://console.developers.google.com/apis/api/modelarmor.googleapis.com/overview?project=<project>
then retry.

  with google_model_armor_template.model_armor_template[0],
  on model_armor.tf line 25, in resource "google_model_armor_template" "model_armor_template":

Suggested Fix

Add modelarmor.googleapis.com to local.restricted_services. That list is already gated on exactly the regimes that offer Model Armor (FEDRAMP_HIGH / NONE, main.tf:43-45), so it is the correct home; the deploy.sh call can stay as a convenience or go.

Additional Context

Read from source; confirmed against main @ f64ce6cd, 2026-08-10.