`s1_security_groups` — version 1.2

Source: presets/security-group-models/s1-security-groups.satz

Purpose

The S1 security group model in ONE file: the five admin groups and their organization-level role grants.

Resource-type sections may repeat across files with distinct ids, so a typed pack sits beside the estate's own groups and grants. The pack is used at the top level of the estate:

To adopt groups that already exist in the tenant: satz adopt --only google_cloud_identity_group --execute Groups are looked up by email; no ids are hard-coded here (tenant-specific). Memberships are NOT part of this pack: presets define groups, humans grant membership.

Use it

params {
  // the pack's own defaults — copy only the lines you change
  gcp_organization_admins_name = "gcp-organization-admins"
  gcp_project_admins_name = "gcp-project-admins"
  gcp_security_admins_name = "gcp-security-admins"
  gcp_security_viewers_name = "gcp-security-viewers"
  gcp_billing_admins_name = "gcp-billing-admins"
}

use "presets/security-group-models/s1-security-groups.satz"

Needs from outside the pack:

customer_domain — declared by estate_core; use one of them alongside, or declare it in the estate.
infra_project_name — declared by estate_core; use one of them alongside, or declare it in the estate.
svc_iac_account — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

param	default
`gcp_organization_admins_name`	`"gcp-organization-admins"`
`gcp_project_admins_name`	`"gcp-project-admins"`
`gcp_security_admins_name`	`"gcp-security-admins"`
`gcp_security_viewers_name`	`"gcp-security-viewers"`
`gcp_billing_admins_name`	`"gcp-billing-admins"`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`gcp_organization_admins_name`	The organization admins group's name (the local part; the customer domain is added)	recreate	low	—
`gcp_project_admins_name`	The project admins group's name (the local part; the customer domain is added)	recreate	low	—
`gcp_security_admins_name`	The security admins group's name (the local part; the customer domain is added)	recreate	low	—
`gcp_security_viewers_name`	The security viewers group's name (the local part; the customer domain is added)	recreate	low	—
`gcp_billing_admins_name`	The billing admins group's name (the local part; the customer domain is added)	recreate	low	—

gcp_organization_admins_name — The address is the group's identity: renaming it later means a new group, every member moved by hand and every role re-granted. This group holds the organisation's highest roles.

gcp_project_admins_name — The address is the group's identity: renaming it later means a new group, every member moved by hand and every role re-granted.

gcp_security_admins_name — The address is the group's identity: renaming it later means a new group, every member moved by hand and every role re-granted.

gcp_security_viewers_name — The address is the group's identity: renaming it later means a new group, every member moved by hand and every role re-granted.

gcp_billing_admins_name — The address is the group's identity: renaming it later means a new group, every member moved by hand and every role re-granted.

Contributes

resource type	labels
`google_cloud_identity_group`	`{gcp_organization_admins_name}`, `{gcp_project_admins_name}`, `{gcp_security_admins_name}`, `{gcp_security_viewers_name}`, `{gcp_billing_admins_name}`
`google_organization_iam_member`	`domain:{customer_domain} (grant map)`, `group:{gcp_organization_admins_name}@{customer_domain} (grant map)`, `group:{gcp_project_admins_name}@{customer_domain} (grant map)`, `group:{gcp_security_admins_name}@{customer_domain} (grant map)`, `group:{gcp_security_viewers_name}@{customer_domain} (grant map)`, `group:{gcp_billing_admins_name}@{customer_domain} (grant map)`

Claims

None — this pack proves no control by itself.

History

version	date	change
1.2	2026-09-11	the security-admins group's description says what its roles do — organisation policies, folder IAM, Security Command Center, logging and monitoring, read access — instead of the Security Admin role and organisation, folder and project IAM admin, which the group never held. An in-place description update on the group; no role changes
1.1	2026-09-10	five `question` blocks, one per group name, same reasoning. Nothing emitted changes
1.0	2026-09-02	the S1 model in ONE typed file (groups + org grants) for a top-level `use`

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

The S1 model in one typed file, used at the top level of the estate: the five admin groups and their organization-level role grants together. For the role-by-role comparison with S2 and when to pick which, see s2_security_groups.

s1_security_groups — version 1.2