fix(gemini-enterprise): resolve stage-0 teardown, internal VIP sharing, and access day bounds

blueprints/fedramp-high/gemini-enterprise/README.md

@@ -902,8 +902,8 @@ The blueprint sets up the following key components:
       - **Customizable Business Hours:** The time-based access control (used in `moderate_device` and `strict_device` policies) can be customized using variables in your `terraform.tfvars` file:
         - `access_start_hour`: Start hour (0-23 ET, default: 9)
         - `access_end_hour`: End hour (0-23 ET, default: 17)
-        - `access_start_day`: Start day (1=Mon, 7=Sun, default: 1)
-        - `access_end_day`: End day (1=Mon, 7=Sun, default: 5)
+        - `access_start_day`: Start day (0=Sun, 6=Sat, default: 1 for Monday)
+        - `access_end_day`: End day (0=Sun, 6=Sat, default: 5 for Friday)
     - **Model Armor:** Template defined in `model_armor.tf` and optionally configured for the FedRAMP High compliance regime to provide an extra layer of security by filtering user prompts and model responses to conform to responsible AI practices.
 
 4.  **Data Stores:** CMEK-encrypted GCS buckets and BigQuery datasets for Vertex AI Search, managed by the `discovery-engine` module.

blueprints/fedramp-high/gemini-enterprise/deploy.sh

@@ -1160,9 +1160,9 @@ configure_access_policies() {
         read -p "Restrict incoming traffic based on a specific time schedule (Business Hours)? (y/N): " TIME_CHOICE
         if [[ "$TIME_CHOICE" == "y" || "$TIME_CHOICE" == "Y" ]]; then
             CREATE_TIME_ACCESS="true"
-            read -p "Enter Start Day (1=Mon, 7=Sun) [1]: " ACCESS_START_DAY
+            read -p "Enter Start Day (0=Sun, 6=Sat) [1]: " ACCESS_START_DAY
             ACCESS_START_DAY=${ACCESS_START_DAY:-1}
-            read -p "Enter End Day (1=Mon, 7=Sun) [5]: " ACCESS_END_DAY
+            read -p "Enter End Day (0=Sun, 6=Sat) [5]: " ACCESS_END_DAY
             ACCESS_END_DAY=${ACCESS_END_DAY:-5}
             read -p "Enter Start Hour (0-23) [7]: " ACCESS_START_HOUR
             ACCESS_START_HOUR=${ACCESS_START_HOUR:-7}

blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/analytics.tf

@@ -28,11 +28,12 @@ resource "google_project_iam_audit_config" "discovery_engine_audit" {
 }
 
 resource "google_bigquery_dataset" "analytics_dataset" {
-  count       = var.enable_analytics ? 1 : 0
-  dataset_id  = "${replace(var.prefix, "-", "_")}_gemini_analytics"
-  project     = var.main_project_id
-  location    = var.geolocation
-  description = "Dataset for Gemini Enterprise Discovery Engine audit logs"
+  count                      = var.enable_analytics ? 1 : 0
+  dataset_id                 = "${replace(var.prefix, "-", "_")}_gemini_analytics"
+  project                    = var.main_project_id
+  location                   = var.geolocation
+  description                = "Dataset for Gemini Enterprise Discovery Engine audit logs"
+  delete_contents_on_destroy = true
 }
 
 resource "google_logging_project_sink" "discovery_engine_sink" {

blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/network.tf

@@ -78,6 +78,7 @@ resource "google_compute_address" "gemini_enterprise_ip" {
   region       = var.region
   subnetwork   = var.deployment_type == "internal" ? local.vpc_subnet_id : null
   address_type = local.ip_address_type
+  purpose      = var.deployment_type == "internal" ? "SHARED_LOADBALANCER_VIP" : null
 }
 
 # -----------------------------------------------------------------------------

blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/terraform.tfvars.sample

@@ -89,8 +89,8 @@ deployment_type = "external"
 # to all traffic outside of business hours
 access_start_hour = 9  # e.g., 9 AM ET
 access_end_hour   = 17 # e.g., 5 PM ET
-access_start_day  = 1  # Monday
-access_end_day    = 5  # Friday
+access_start_day  = 1  # Monday (0=Sun, 6=Sat)
+access_end_day    = 5  # Friday (0=Sun, 6=Sat)
 
 # OPTIONAL: Shared VPC Configuration
 # Set use_shared_vpc to true to use an existing Shared VPC

blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/variables.tf

@@ -101,15 +101,23 @@ variable "access_end_hour" {
 }
 
 variable "access_start_day" {
-  description = "The day of the week when access starts (1 for Monday, 7 for Sunday)."
+  description = "The day of the week when access starts, evaluated using CEL getDayOfWeek() where 0 is Sunday, 1 is Monday, ..., 6 is Saturday (0-6)."
   type        = number
   default     = 1
+  validation {
+    condition     = var.access_start_day >= 0 && var.access_start_day <= 6
+    error_message = "access_start_day must be an integer between 0 (Sunday) and 6 (Saturday)."
+  }
 }
 
 variable "access_end_day" {
-  description = "The day of the week when access ends (1 for Monday, 7 for Sunday)."
+  description = "The day of the week when access ends, evaluated using CEL getDayOfWeek() where 0 is Sunday, 1 is Monday, ..., 6 is Saturday (0-6)."
   type        = number
   default     = 5
+  validation {
+    condition     = var.access_end_day >= 0 && var.access_end_day <= 6
+    error_message = "access_end_day must be an integer between 0 (Sunday) and 6 (Saturday)."
+  }
 }
 
 variable "access_time_zone" {