google · aghassemlouei · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -19,6 +19,7 @@ Please provide details about your deployment to help us reproduce the issue.
     *   [ ] US Region Restricted (e.g., Access Policy constraint)
     *   [ ] FedRAMP Medium
     *   [ ] FedRAMP High
+    *   [ ] FedRAMP Moderate
     *   [ ] DoD IL4
     *   [ ] DoD IL5
     *   [ ] Stand-alone / Custom

diff --git a/.github/ISSUE_TEMPLATE/documentation-suggestion.md b/.github/ISSUE_TEMPLATE/documentation-suggestion.md
@@ -20,4 +20,4 @@ Where should this documentation live? e.g., existing file in `docs/`, a new file
 Please provide a draft or outline of the content you would like to add.
 
 ## Compliance Context (if applicable)
-Does this documentation relate to a specific compliance regime (FedRAMP High, IL5) or NIST control?
+Does this documentation relate to a specific compliance regime (FedRAMP Moderate, FedRAMP High, IL5) or NIST control?
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -22,6 +22,7 @@ A clear and concise description of what you want to happen.
     *   [ ] US Region Restricted (e.g., Access Policy constraint)
     *   [ ] FedRAMP Medium
     *   [ ] FedRAMP High
+    *   [ ] FedRAMP Moderate
     *   [ ] DoD IL4
     *   [ ] DoD IL5
     *   [ ] All / General

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -14,6 +14,7 @@ Fixes # (GitHub issue id)
     *   [ ] US Region Restricted (e.g., Access Policy constraint)
     *   [ ] FedRAMP Moderate
     *   [ ] FedRAMP High
+    *   [ ] FedRAMP Moderate
     *   [ ] DoD IL4
     *   [ ] DoD IL5
     *   [ ] General / All
@@ -32,7 +33,7 @@ Fixes # (GitHub issue id)
 
 ### Security
 - [ ] My change adheres to GCP security best practices and the principle of least privilege.
-- [ ] I have ensured compliance with the targeted regime (FedRAMP High, IL5, etc.).
+- [ ] I have ensured compliance with the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).
 
 ### Testing
 - [ ] I have tested my changes locally.

diff --git a/GEMINI.md b/GEMINI.md
@@ -4,7 +4,7 @@
 
 Stellar Engine is a fork of the Google Cloud Foundation Fabric (CFF), providing Infrastructure as Code (IaC) to help Google Cloud Platform
 (GCP) customers create secure and compliant landing zones. It has a strong focus on environments requiring Assured Workload overlays, such
-as FedRAMP High, IL4, and IL5, and includes documentation mapping NIST 800-53r5 controls to accelerate Authorization to Operate (ATO)
+as FedRAMP Moderate, FedRAMP High, IL4, and IL5, and includes documentation mapping NIST 800-53r5 controls to accelerate Authorization to Operate (ATO)
 processes.
 
 **Key Technologies:** Terraform, Google Cloud Platform (GCP)
@@ -35,7 +35,7 @@ outputs, and any dependencies.
 Consistency in naming variables, resources, modules, and files is crucial.
 
 5.  **Security:** Adhere to GCP security best practices and the principle of least privilege in all configurations. Ensure compliance with
-the targeted regime (FedRAMP High, IL5, etc.).
+the targeted regime (FedRAMP Moderate, FedRAMP High, IL5, etc.).
 
 ## Key Codebase Resources
 

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 ## Introduction
 
-Stellar Engine is a fork of the Google Cloud Foundation Fabric (CFF) repository, aimed at providing Infrastructure as Code (IaC) for Google Cloud Platform (GCP) customers who need to create a landing zone environment with the Assured Workload overlays. In addition to the IaC, there is [documentation available](./docs/path-to-authorization.md) for both FedRAMP High (FRH), Department of Defense (DoD) Impact Level 4 (IL4) and DoD Impact Level (IL5) compliance regimes that provide a mapping of National Institute of Standards and Technology (NIST) 800-53r5 controls to enable projects that leverage the Stellar Engine codebase to accelerate the speed at which an Authorization to Operate (ATO) can be attained.
+Stellar Engine is a fork of the Google Cloud Foundation Fabric (CFF) repository, aimed at providing Infrastructure as Code (IaC) for Google Cloud Platform (GCP) customers who need to create a landing zone environment with the Assured Workload overlays. In addition to the IaC, there is [documentation available](/docs/path-to-authorization.md) for FedRAMP High (FRH), FedRAMP Moderate (FRM), Department of Defense (DoD) Impact Level 4 (IL4) and DoD Impact Level (IL5) compliance regimes that provide a mapping of National Institute of Standards and Technology (NIST) 800-53r5 controls to enable projects that leverage the Stellar Engine codebase to accelerate the speed at which an Authorization to Operate (ATO) can be attained.
 
 ## Getting Started
 
@@ -14,7 +14,7 @@ This repository provides **end-to-end blueprints** and a **suite of Terraform mo
 
 The target audience for Stellar Engine is organizations and teams that operate in regulated industries or require robust compliance and security frameworks. Below are a few examples of these such users:
 
-- **Government Agencies:** Agencies and contractors, such as those that work with FRH, IL4, and IL5 environments.  <br />
+- **Government Agencies:** Agencies and contractors, such as those that work with FRM, FRH, IL4, and IL5 environments.  <br />
 - **Regulated Industries:** Regulated industries often face overlapping compliance and security requirements; Stellar Engine can simplify that.  <br />
 - **Educational and Research Institutions:** Universities and research organizations working on government-funded projects that require secure and compliant cloud environments.  <br />
 
@@ -45,26 +45,26 @@ The suite of modules in this repository is designed for rapid composition and re
 
 All modules share a similar interface where each module tries to stay close to the underlying provider resources, support IAM together with resource creation and modification, offer the option of creating multiple resources where it makes sense (e.g. not for projects), and be completely free of side-effects (e.g. no external commands).
 
-A well-defined naming standard is used across Stellar Engine to ensure adherence to Google Cloud's best practices, naming requirements, and naming collision avoidance for global resources. The Google Cloud naming standard documentation is [here](./documentation/naming-convention.md) and will be used before the Stellar Engine deployment begins by choosing a naming standard that will flow through the Google Cloud infrastructure state.
+A well-defined naming standard is used across Stellar Engine to ensure adherence to Google Cloud's best practices, naming requirements, and naming collision avoidance for global resources. The Google Cloud naming standard documentation is [here](/docs/naming-convention.md) and will be used before the Stellar Engine deployment begins by choosing a naming standard that will flow through the Google Cloud infrastructure state.
 
 The current modules support most of the core foundational and networking components used to design end-to-end infrastructure, with more modules in active development for specialized compute, security, and data scenarios.
 
 For more information and usage examples see each module's README file, as well as any associated blueprints.
 
 ## End-to-End Blueprints
 
-Stellar Engine currently offers blueprints that are compliant with [FRH](https://github.com/google/stellar-engine/tree/main/blueprints/fedramp-high) and [IL5](https://github.com/google/stellar-engine/tree/main/blueprints/il5) baselines. </br>
+Stellar Engine currently offers blueprints that are compliant with [FRM](https://github.com/google/stellar-engine/tree/main/blueprints/fedramp-moderate), [FRH](https://github.com/google/stellar-engine/tree/main/blueprints/fedramp-high), and [IL5](https://github.com/google/stellar-engine/tree/main/blueprints/il5) baselines. </br>
 These blueprints range from full end-to-end services like a Cloud Native Access Point (CNAP), to ad-hoc services that are designed to be molded to users' individual use cases.
 
 For more information, please look at each blueprint's README file.
 
 ## Cybersecurity Documentation
 
-In addition to the IaC, Stellar Engine provides supporting documentation that maps NIST 800-53r5 controls for users leveraging the IaC. This documentation is designed to streamline achieving ATO by providing generalized templates. All documentation can be requested [here](https://forms.gle/zdv7Gip4opmdhBqk7). For how to utilize these documents, please see the following [Path to Authorization](./docs/path-to-authorization.md) guide.
+In addition to the IaC, Stellar Engine provides supporting documentation that maps NIST 800-53r5 controls for users leveraging the IaC. This documentation is designed to streamline achieving ATO by providing generalized templates. All documentation can be requested [here](https://forms.gle/zdv7Gip4opmdhBqk7). For how to utilize these documents, please see the following [Path to Authorization](/docs/path-to-authorization.md) guide.
 
 ## Detailed Deployment Guide
 
-The Stellar Engine Cloud Foundation Fabric Detailed Deployment Guide (DDG) outlines a structured process for deploying a secure, compliant infrastructure on GCP using IaC. Designed to support compliance with standards such as FRH, IL4, and IL5, the guide enables organizations to create a foundational "landing zone" with Assured Workload overlays. It includes mappings of NIST 800-53r5 controls to streamline achieving ATO. The deployment process is divided into stages, each focusing on specific components like resource management, networking, and security configuration.
+The Stellar Engine Cloud Foundation Fabric Detailed Deployment Guide (DDG) outlines a structured process for deploying a secure, compliant infrastructure on GCP using IaC. Designed to support compliance with standards such as FRM, FRH, IL4, and IL5, the guide enables organizations to create a foundational "landing zone" with Assured Workload overlays. It includes mappings of NIST 800-53r5 controls to streamline achieving ATO. The deployment process is divided into stages, each focusing on specific components like resource management, networking, and security configuration.
 
 Key stages include Stage 0 (Bootstrap), which initializes the infrastructure, creates core Google Cloud Projects, and sets up service accounts; Stage 1 (Resource Management), which organizes Google Cloud Folders and Google Cloud Projects for tenants; and Stage 2 (Network Creation), which configures networking, including advanced setups like Palo Alto NGFWs for IL5 environments. The final stage, Stage 3 (Security and Audit Account Configuration), establishes security protocols, including Customer Managed Encryption Keys (CMEK) requirements and logging for audit purposes. Each stage requires detailed configuration of Terraform variables and adherence to prerequisites like IAM roles, service account setups, and enabling Google Cloud services.
 
@@ -82,7 +82,7 @@ For more information, please look at the [TDD](./docs/tdd.md).
 
 ## Security Best Practices Guide
 
-The Stellar Engine Security Best Practices Guide (SBPG) outlines a robust framework for deploying secure and compliant GCP infrastructure. Designed for organizations requiring adherence to FRH and IL5 standards, it employs IaC principles via Terraform. The Stellar Engine facilitates the automated creation of a baseline GCP environment, supporting modular deployment of both Google and approved third-party services. Its hierarchical architecture ensures effective organization, leveraging role-based access control (RBAC), strict IAM policies, and a hub-and-spoke VPC networking design for isolation and scalability.
+The Stellar Engine Security Best Practices Guide (SBPG) outlines a robust framework for deploying secure and compliant GCP infrastructure. Designed for organizations requiring adherence to FRM, FRH, and IL5 standards, it employs IaC principles via Terraform. The Stellar Engine facilitates the automated creation of a baseline GCP environment, supporting modular deployment of both Google and approved third-party services. Its hierarchical architecture ensures effective organization, leveraging role-based access control (RBAC), strict IAM policies, and a hub-and-spoke VPC networking design for isolation and scalability.
 
 The document emphasizes best practices in identity and access management, security monitoring, and compliance. IAM configurations focus on the principle of least privilege, with automation enabling minimal human interaction during setup. Security features include encryption-at-rest, TLS enforcement, and centralized logging and monitoring through audit logs, VPC flow logs, and other diagnostics. The system supports Assured Workloads, providing region-specific data residency and compliance settings to meet regulatory requirements.
 

diff --git a/blueprints/README.md b/blueprints/README.md
@@ -45,7 +45,7 @@ For more information, please see the individual README files in each blueprint's
 |  [Secret Manager](./fedramp-high/secret-manager/)                            |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |  &nbsp; &nbsp; ❌ &nbsp; &nbsp;  |
 |  [Shielded VM Project](./il5/shielded-vm-project/)                           |  &nbsp; &nbsp; 🔗 &nbsp; &nbsp;  |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |
 |  [Vertex MLOps](./fedramp-high/vertex-mlops/)                                |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |  &nbsp; &nbsp; ❌ &nbsp; &nbsp;  |
-|  [VPC Peering Project](./il5/vpc-peering-project/)                           |  &nbsp; &nbsp; 🔗 &nbsp; &nbsp;  |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |
+|  [VPC Peering Project](./stand-alone/vpc-peering-project/)                           |  &nbsp; &nbsp; 🔗 &nbsp; &nbsp;  |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |
 |  [Workflows](./fedramp-high/workflows/)                                      |  &nbsp; &nbsp; ✅ &nbsp; &nbsp;  |  &nbsp; &nbsp; ❌ &nbsp; &nbsp;  |
 
 <br>

diff --git a/blueprints/il5/compute-engine/README.md b/blueprints/il5/compute-engine/README.md
@@ -119,4 +119,3 @@ keyrings-keys = {
 ## Verification of a successful deployment?
 
 - Go to the Compute Engine in the GCP Console. Select the VM. Check the Presistent Disk Encryption
-![GCP Compute Engine Instance Presistent Disk Encryption](./images/vm-disk-1.png?raw=true "GCP Compute Engine Instance Presistent Disk Encryption")
diff --git a/blueprints/third-party-solutions/gitlab/README.md b/blueprints/third-party-solutions/gitlab/README.md
@@ -242,7 +242,7 @@ following [link](https://docs.gitlab.com/omnibus/settings/ssl/#configure-https-m
 If you want to deploy from your Cloud Shell, click on the image below, sign in
 if required and when the prompt appears, click on “confirm”.
 
-[![Open Cloudshell](../../../assets/images/cloud-shell-button.png)](https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2FGoogleCloudPlatform%2Fcloud-foundation-fabric&cloudshell_workspace=blueprints%2Fthird-party-solutions%2Fwordpress%2Fcloudrun)
+![Open Cloudshell](https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2FGoogleCloudPlatform%2Fcloud-foundation-fabric&cloudshell_workspace=blueprints%2Fthird-party-solutions%2Fwordpress%2Fcloudrun)
 
 Otherwise, in your console of choice:
 

diff --git a/docs/ddg.md b/docs/ddg.md
@@ -20,7 +20,7 @@ environment with the Assured Workload overlays. The project has been confirmed
 to work with (DISA) Impact Level 5 (IL5), Impact Level 4 (IL4), and FedRAMP
 High, but will function as a starting point for any other Assured Workloads
 overlay. In addition to the IaC, there is documentation available for both the
-IL5 and FedRAMP High compliance regimes that provide a mapping of National
+IL5, FedRAMP High, and FedRAMP Moderate compliance regimes that provide a mapping of National
 Institute of Standards and Technology (NIST) 800-53r5 controls to enable
 projects that leverage the Stellar Engine codebase to accelerate the speed at
 which an Authorization to Operate (ATO) can be attained. These responses are
@@ -67,7 +67,7 @@ To make using this deployment guide easier, the variables described below need t
 | :------------------------------------ | :------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | <strong>Billing Account</strong>      | `billing_account.id`             | The billing account to use for the deployment of the environments. <a href='https://console.cloud.google.com/billing'>Console Link</a>                                                                                                                                                                         |
 | <strong>Bootstrap Project ID</strong> | `bootstrap_project`              | The bootstrap project id (created below)                                                                                                                                                                                                                                                                       |
-| <strong>Compliance Regime</strong>    | `assured_workloads.regime`       | The <a href='https://assuredworkloads.googleapis.com/$discovery/rest?version=v1'>compliance regime</a> for this environment, (confirmed working in IL4, IL5, FEDRAMP_HIGH, and COMPLIANCE_REGIME_UNSPECIFIED)                                                                                                  |
+| <strong>Compliance Regime</strong>    | `assured_workloads.regime`       | The <a href='https://assuredworkloads.googleapis.com/$discovery/rest?version=v1'>compliance regime</a> for this environment, (confirmed working in IL4, IL5, FEDRAMP_MODERATE, FEDRAMP_HIGH, and COMPLIANCE_REGIME_UNSPECIFIED)                                                                                                  |
 | <strong>Customer ID</strong>          | `organization.customer_id`       | The Google Workspace Directory Customer ID. <br/>Run <strong>gcloud organizations list</strong> to view.                                                                                                                                                                                                       |
 | <strong>Domain Name</strong>          | `organization.domain`            | The primary Fully Qualified Domain Name (FQDN). Run <strong>gcloud organizations list</strong> to view (make sure you have authorized as per prerequisites below)                                                                                                                                              |
 | <strong>Alert Email</strong>          | `alert_email`                    | The email address used for logging alerts notifications.                                                                                                                                                                                                                                                       |
@@ -207,7 +207,7 @@ billing_account = {
  id = "`<billing_account_id>`" # taken from Google Cloud Console Billing Accounts -> Manage Billing Account
 }
 # region configuration - this will automatically populate locations for GCS, BigQuery, KMS, and logging buckets
-# Default to us-east4 for IL5/FedRAMP compliance - adjust as needed
+# Default to us-east4 for IL5/FedRAMP High/Moderate compliance - adjust as needed
 regions = {
  primary = "`<region>`"
 }
@@ -391,7 +391,7 @@ gcloud storage cp gs://${FAST_PREFIX}-prod-iac-core-outputs-0/tfvars/0-bootstrap
 
 ## Stage 2 - Network Creation
 
-## FedRAMP High - Stage 2.1 Networking
+## FedRAMP High / Moderate - Stage 2.1 Networking
 
 ### Steps
 

diff --git a/docs/path-to-authorization.md b/docs/path-to-authorization.md
@@ -1,6 +1,6 @@
 # Path to Authorization
 
-_Impact Level 5 (H-H-X) & FedRAMP High_
+_Impact Level 5 (H-H-X), FedRAMP High & FedRAMP Moderate_
 
 **Created Date:**
 
@@ -67,7 +67,7 @@ privacy risks
     managed, and authorized for operation or use.
   - [Impact Level 5 Authorization
     Boundary](https://forms.gle/zdv7Gip4opmdhBqk7)
-  - [FedRAMP High Authorization
+  - [FedRAMP High & Moderate Authorization
     Boundary](https://forms.gle/zdv7Gip4opmdhBqk7)
 - Regularly assess the security and privacy risks at the organization level
   and system level. Update risk assessment results on an on-going basis.
@@ -111,10 +111,10 @@ risk assessment(s)
     frequency in which the controls are monitored?
   - [Security Control Traceability Matrix (SCTM)
     Templates](https://forms.gle/zdv7Gip4opmdhBqk7)
-    (IL5 H-H-X and FedRAMP High Baselines)
+    (IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)
   - [Policies and Procedures
     Templates](https://forms.gle/zdv7Gip4opmdhBqk7)
-    (IL5 HHX and FedRAMP High Baselines)
+    (IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)
 
 [**Step 3;
 Implement**](https://csrc.nist.gov/Projects/risk-management/about-rmf/implement-step):
Original file line number	Diff line number	Diff line change
Expand Up		@@ -119,4 +119,3 @@ keyrings-keys = {
		## Verification of a successful deployment?

		- Go to the Compute Engine in the GCP Console. Select the VM. Check the Presistent Disk Encryption
		![GCP Compute Engine Instance Presistent Disk Encryption](./images/vm-disk-1.png?raw=true "GCP Compute Engine Instance Presistent Disk Encryption")