Bug Description

Stage 3 declares variable "tenant_accounts" (variables.tf lines 241–245, typed any, default null) — the same cross-stage passthrough contract Stage 2 actively consumes (2-networking-a-fedramp-high/variables.tf, strongly typed and consumed in branch-net-envs.tf) — but nothing in Stage 3's .tf ever reads var.tenant_accounts. It is accepted as input and silently discarded. Anyone assuming Stage 3 can resolve tenant-specific data (e.g., a tenant automation SA email for a per-tenant KMS IAM grant) the way Stage 2 does would be wrong — the variable exists but does nothing.

Environment and Deployment Context

• Stellar Engine Version/Commit: main at commit 3728fc98
• Deployment Type:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Medium
  • FedRAMP High
  • DoD IL4
  • DoD IL5
  • Stand-alone / Custom
• FAST Stage (if applicable):
  • Stage 0 (Bootstrap)
  • Stage 1 (Resource Management)
  • Stage 2 (Network Creation)
  • Stage 3 (Security and Audit)
• Affected Component: fast/stages-aw/3-security/variables.tf (lines 241–245)
• Terraform Version: 1.15.7
• GCP Provider Version: hashicorp/google 6.50.0

Steps to Reproduce

grep -rn "var.tenant_accounts" fast/stages-aw/3-security/*.tf
# → no matches (declaration only)

Expected Behavior

Stage-level variables that mirror an active cross-stage contract are either consumed (parity with Stage 2) or not declared.

Actual Behavior

The variable is declared and silently discarded.

Relevant Logs and Errors

N/A.

Additional Context

Fix: wire var.tenant_accounts into Stage 3's logic if parity with Stage 2 was intended, or remove the unused declaration. Same dead-variable pattern as the postgresql blueprint's unused inputs (filed separately).