From 22e8ce2940510af3b851b953824d3d09417cd28f Mon Sep 17 00:00:00 2001
From: jmpugh <jeffpugh@google.com>
Date: Fri, 7 Aug 2026 13:54:58 +0000
Subject: [PATCH] Fix AW Folder reference when creating common services folder

---
 fast/stages-aw/0-bootstrap/budgets.tf      |  4 +---
 fast/stages-aw/0-bootstrap/main.tf         | 14 ++++++++++++++
 fast/stages-aw/0-bootstrap/organization.tf |  2 +-
 fast/stages-aw/0-bootstrap/outputs.tf      |  4 ++--
 4 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/fast/stages-aw/0-bootstrap/budgets.tf b/fast/stages-aw/0-bootstrap/budgets.tf
index a4fb0aa24..7b95ccb72 100644
--- a/fast/stages-aw/0-bootstrap/budgets.tf
+++ b/fast/stages-aw/0-bootstrap/budgets.tf
@@ -37,9 +37,7 @@ module "billing-account-budget" {
       ]
       filter = {
         resource_ancestors = [
-          var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED"
-          ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}"
-          : module.no-compliance-folder[0].folder.id
+          local.assured_workloads_folder
         ]
       }
     }
diff --git a/fast/stages-aw/0-bootstrap/main.tf b/fast/stages-aw/0-bootstrap/main.tf
index c8bf8c25f..5e941359e 100644
--- a/fast/stages-aw/0-bootstrap/main.tf
+++ b/fast/stages-aw/0-bootstrap/main.tf
@@ -36,4 +36,18 @@ locals {
   }
   # naming: environment used in most resource names
   prefix = join("-", compact([var.prefix, "prod"]))
+  assured_workloads_folder = (
+    var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED"
+    ? format("folders/%s", try(
+        coalesce(
+          one([
+            for r in try(google_assured_workloads_workload.primary[0].resources, []) :
+            tostring(r.resource_id) if r.resource_type == "CONSUMER_FOLDER"
+          ]),
+          try(tostring(google_assured_workloads_workload.primary[0].resources[0].resource_id), null)
+        ),
+        ""
+      ))
+    : try(module.no-compliance-folder[0].id, null)
+  )
 }
diff --git a/fast/stages-aw/0-bootstrap/organization.tf b/fast/stages-aw/0-bootstrap/organization.tf
index 87165c43a..996457934 100644
--- a/fast/stages-aw/0-bootstrap/organization.tf
+++ b/fast/stages-aw/0-bootstrap/organization.tf
@@ -214,7 +214,7 @@ module "no-compliance-folder" {
 
 module "branch-common-services-folder" {
   source = "../../../modules/folder"
-  parent = var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : "${module.no-compliance-folder[0].folder.id}"
+  parent = local.assured_workloads_folder
   name   = "${lookup(var.regime_mapping, var.assured_workloads.regime, var.assured_workloads.regime)} Common Services"
 }
 
diff --git a/fast/stages-aw/0-bootstrap/outputs.tf b/fast/stages-aw/0-bootstrap/outputs.tf
index 65e78a98c..3a8f60c6f 100644
--- a/fast/stages-aw/0-bootstrap/outputs.tf
+++ b/fast/stages-aw/0-bootstrap/outputs.tf
@@ -106,7 +106,7 @@ locals {
       project_number    = module.log-export-project.number
       writer_identities = module.organization.sink_writer_identities
     }
-    assured_workloads      = merge(var.assured_workloads, { "folder" = var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : "${module.no-compliance-folder[0].folder.id}" })
+    assured_workloads      = merge(var.assured_workloads, { "folder" = local.assured_workloads_folder })
     common_services_folder = module.branch-common-services-folder.folder.name
     regions                = var.regions
   }
@@ -128,7 +128,7 @@ output "alert_email" {
 
 output "assured_workload" {
   description = "Assured Workload folder for the deployment."
-  value       = var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : "folders/${module.no-compliance-folder[0].folder.id}"
+  value       = local.assured_workloads_folder
 }
 
 output "automation" {