Pulumi Blog: Craig Symonds

Announcing the Next Generation of Pulumi Policies: AI-Accelerated Governance for the Cloud

Craig Symonds — Wed, 05 Nov 2025 00:05:00 +0000

The era of AI-accelerated development has created a paradox: the faster developers move, the bigger the governance challenge becomes. For years, security and platform teams have worked to “shift left,” but the tools available have been incomplete. Most focus on detection, which is necessary but not sufficient. They identify thousands of policy violations across an organization’s infrastructure but leave teams with an overwhelming backlog and no scalable way to remediate it. This creates a persistent gap between finding a problem and fixing it. The result is an impossible choice between development velocity and organizational control, forcing leadership to slow down innovation to manage risk.

Today, we end that compromise.

We are thrilled to announce the next generation of Pulumi Policies, a comprehensive governance solution that moves beyond detection to deliver AI-powered remediation at scale. We’re introducing a new lifecycle to secure your cloud: first, Get Clean by using AI to fix your existing policy violations. Second, Stay Clean by using policy as a universal guardrail that makes AI-driven development not just fast, but fundamentally safe. These are not strictly sequential steps; you can begin enforcing “Stay Clean” policies for all new infrastructure while you simultaneously work on the “Get Clean” process for your existing footprint.

Watch our Launch Video:

Part 1: Get Clean - From Thousands of Issues to a Compliant State

The first step to a secure cloud is tackling the mountain of existing misconfigurations spread across your environments.

First, Gain Complete Visibility with the New Policy Findings Hub

To fix your issues, you first need to see them clearly. We have introduced a powerful Policy Findings Hub designed to give every stakeholder the exact view they need.

The Overview Tab: A high-level dashboard with compliance scores for leadership to track trends and measure your organization’s posture.
The Compliance Tab: A control-centric view for auditors and infosec teams, grouping findings by policy (e.g., CIS, NIST) to simplify evidence gathering and prove compliance.
The Issues Tab: A collaborative workspace for platform and development teams to triage, assign, prioritize, and track the remediation of every policy issue.

This hub is powered by our flexible audit capabilities. With Audit Scans for IaC Stacks, you can get an instant compliance baseline on all your existing Pulumi-managed infrastructure without blocking developers or re-deploying thousands of stacks. This is combined with discovery scans of your cloud accounts to give you a single, unified view of every resource, whether managed by Pulumi or not.

The Solution to Remediation at Scale: AI-Powered Fixes with Pulumi Neo

Visibility creates a new problem: an overwhelming backlog. Manually fixing thousands of issues is an impossible task.

This is where Pulumi Neo provides a powerful solution.

Pulumi Neo, our AI platform engineer, is now integrated directly into the Policy Findings hub to automate the most difficult part of the process: the fix itself. From the Issues tab, your teams can now select a group of policy issues, assign them to Neo, and trigger a remediation flow.

Neo is smart. It will:

Analyze the non-compliant resources and the policies they are violating.
Understand the required configuration to make them compliant.
Generate a pull request with the exact code changes needed to fix the issues.

Most powerfully, for an unmanaged resource discovered via a cloud scan, Neo will generate the code to import the resource into a Pulumi stack and apply the fix. This “Import and Fix” workflow transforms unmanaged infrastructure into governed, compliant code, turning a task that could take a developer hours into a simple review-and-merge process. Your teams can finally burn down their issue backlog and achieve a state of continuous compliance.

Part 2: Stay Clean - The Universal Guardrail for Humans and AI

Once you begin cleaning your environment, the next challenge is to stay clean. As AI accelerates infrastructure creation, you need robust guardrails to ensure it doesn’t also accelerate the creation of security risks.

The answer is Policy as Real Code. Pulumi Policies uses general-purpose languages like TypeScript and Python to create sophisticated guardrails that govern every change. To help you establish these controls immediately, we are launching a new suite of pre-built compliance packs authored and maintained by Pulumi experts.

Framework	AWS	Azure	Google Cloud
CIS Controls v8.1	✅	✅	✅
NIST SP 800-53 Rev. 5	✅
PCI DSS v4.0	✅
HITRUST CSF v11.5	✅	✅	✅
Pulumi Best Practices	✅	✅	✅

These policies act as a universal guardrail for your entire organization by blocking non-compliant changes during pulumi up, before they are ever created. Learn more about our compliance packs.

And now, you can even use Neo to author new policies. You can ask Neo in plain English to “create a policy that prevents overly permissive IAM roles,” and it will generate the code for you. This creates a powerful, dynamic governance system where AI can help you build the very rules that then govern its own actions. If you then ask Neo to create an admin role, the deployment will be blocked by the policy it just helped write. This is how we make AI safe to go fast.

A New Era of Collaboration

This “Get Clean, Stay Clean” lifecycle transforms how teams work together:

Platform Teams lead prevention by building real-code guardrails, proving their value with measurable compliance scores.
Security Teams drive the “Get Clean” process with continuous, non-blocking audit scans and use the Findings hub to manage compliance without slowing development.

Governance That Accelerates You

The age of AI-driven development demands AI-powered governance. With this new generation of Pulumi Policies, we are providing the essential infrastructure for platform engineering teams to not just survive, but thrive. You can finally build preventative guardrails that developers love, secure your cloud at scale, and transform governance from a blocker into a business accelerator. Learn more about Pulumi Insights & Governance capabilities.

This powerful new experience is available today. Navigate to the Policies and Policy Findings tab in Pulumi Cloud to explore your new governance capabilities and meet the future of platform engineering.

Try Pulumi Policies

Ready to try these features?

Sign up for Pulumi Cloud and start a Neo task
Read the Get Started guide to set up and apply a policy group to stacks and clouds.
Join the Community Slack to share feedback on the new features

For complete documentation, visit our Policies documentation.

Who moved my menus?

Craig Symonds — Mon, 15 Sep 2025 10:00:00 -0700

We’re excited to share a new update to Pulumi Cloud: a redesigned left-hand navigation that makes it faster and easier to find what you need. With this update, the most common workflows are now front and center, while related features are grouped in a way that better reflects how teams actually use Pulumi Cloud every day.

This change is all about helping you spend less time clicking around and more time building, deploying, and managing your cloud infrastructure.

Faster Access to What You Use Most

We’ve moved the most commonly used sections of Pulumi Cloud like Stacks, Environments, and Resources into the top-level navigation. That means the things you use most are always just one click away.

The redesigned navigation groups related features into four clear categories, each designed around the way infrastructure teams work:

Platform includes all the IDP services that help you set up your infrastructure: defining services, configuring components and managing templates.
Management groups together all the tools you use to configure the tools you use daily like: accounts, policies and deployments. It also includes the tools used to monitor the interactions with the Pulumi platform like: approvals and audit logs.
Settings lists the tools you use to configure how the Pulumi platform needs to work for your organization including: billing and usage, access management and integrations.

These categories help to reduce clutter and give each section a clear purpose, so you always know where to go.

What’s Changed and Where to Find It

Several important updates make the new navigation cleaner and more intuitive:

Deployment Runners merged into Deployments: Deployment Runners are now integrated into the Deployments section. This unifies deployment tasks and their configuration in one place.
New Project integrated into Projects/Stacks: Instead of a separate menu entry, creating a new project is now handled by using the New Project button within the main Stacks page, reducing clutter and consolidating related actions.
Import integrated into Projects/Stacks: Importing unmanaged resources into stacks can now be initiated directly from the main Stacks page by selecting the Import button, better aligning aligning it with the overall stack management.
Customer Managed Keys integrated into Organization: As an organization-wide setting, Customer Managed Keys are now located under the Organization tab.

These changes reduce redundant items, consolidate related tasks, and surface the most important workflows where you expect them.

Cleaner Organization, Less Clutter

By consolidating related features, the left navigation UI is easier to scan and navigate. Infrastructure management tools like Stacks, Resources, Deployments and Policy Findings are grouped together, while IDP, platform configuration and organizational settings are streamlined under their own sections. The result is a navigation that mirrors how infrastructure teams actually work.

Built for Teams at Scale

Pulumi Cloud is used by teams managing everything from a handful of resources to thousands across multiple clouds and environments. This navigation update scales with you, helping teams quickly navigate between the services they need without slowing down as usage grows.

At Pulumi, we believe infrastructure as code should accelerate, not slow down, how teams deliver in the cloud. By simplifying navigation and surfacing the most important actions, Pulumi Cloud becomes an even faster, more reliable place to manage your infrastructure.

This update is another step toward our mission: enabling teams everywhere to build, deploy, and manage cloud infrastructure with greater speed, confidence, and joy.

Try It Out

The new navigation is available today for all Pulumi Cloud users. Sign in to Pulumi Cloud and experience the streamlined workflow for yourself. For more details, check out the docs.

We’d love your feedback as we continue to make Pulumi Cloud the best platform for modern infrastructure as code.

Announcing Public Preview of Insights Account Discovery

Craig Symonds — Mon, 02 Dec 2024 09:10:00 +0000

Note: This post discusses Pulumi Copilot, which Pulumi Neo has replaced. Learn about Neo →

Enterprise cloud infrastructures are complex environments that are evolved over time and made up of thousands of different kinds of resources. Enabling customers to wrap their arms around this complexity and get a complete understanding of the scope and structure is the goal of the Pulumi Insights 2.0 product.

We are excited to announce the public preview of Insights Account Discovery that makes it easy for you to gain visibility of your entire infrastructure regardless of how it is managed. Insights provides the tools to find, group and drill into your resources as needed to make sense of all aspects of your cloud infrastructure. In addition Copilot AI gives you the ability to get answers about your infrastructure that can be challenging to get in other ways, dramatically simplifying the work needed to move your infrastructure forward.

Account Management

To get started, Insights Account Discovery provides a simple UI approach to setting up all of your infrastructure accounts to be scanned and read into the Insights supergraph. Once discovered, all of your infrastructure resources can then be seen in the Resource Explorer and accessed by Pulumi Copilot and Resource Search, providing you the tools needed to deliver on your strategic infrastructure goals.

Account Discovery starts with the new Accounts page to provide a list of all accounts created along with the current status of the latest account scans. The Accounts page is the single place to go to manage all aspects of the Insights Account Discovery process.

Account Creation

From this page you can create new Accounts to provide the configuration and credentials needed for Insights to regularly scan and manage your infrastructure. Once you create a new top level Account, Insights will automatically create child accounts, based on the underlying platform model, for each group you enabled. These child accounts enable you to control the discovery behavior for each group separately. For example, AWS enables you to divide you infrastructure into regions and Insights will create separate child accounts for each region you specify.

Account Discovery leverages Pulumi ESC to enter and manage the credentials needed for the Discovery process to find and read all of the infrastructure resources. By relying on ESC, Insights aligns with enterprise best practices for creating and handling application secrets.

Understanding Your Infrastructure

Once each of your Accounts have started scanning, your resources will be displayed in the Insights Resources Explorer along with all Infrastructure as Code resources that you have imported. The Resources Explorer and Resources Search enables you to ask questions and factor your resources into logical groupings that significantly improves the process for managing your infrastructure and getting answers to key questions needed for your projects. For example, you can ask the AI Resource Search to ‘Find all public IP addresses’ and any other question you might have about your infrastructure.

More to Come

We are excited about the potential of Pulumi Insights and are working hard to bring additional capabilities to continue to simplify the experience of managing today’s complex cloud environments. Watch for additional features like Pulumi Crossguard Policy support for Discovered resources, along with additional platform support, and more, coming soon.

Insights Account Discovery is free while in public preview, with per-resource pricing for Team, Enterprise and Business Critical tiers coming in Q1 2025.

Conclusion

The addition of Account Discovery significantly expands the scope of Pulumi Insights. You can now leverage the capabilities of Insights 2.0, not just for your Pulumi IaC managed resources, but for all resources in your infrastructure regardless of how they are managed. With Pulumi Copilot and Resource Search, you are able to gain insights and ask questions about your infrastructure that would otherwise be challenging to answer, saving time and providing the critical information needed.

For additional information about Pulumi Insights please refer to: Pulumi Insights

Introducing the new Resources view

Craig Symonds — Wed, 02 Oct 2024 14:35:35 -0700

Pulumi Insights gives you the tools to stay informed about your cloud infrastructure. Our Resource explorer provides advanced search and filtering too find what you need. Today, we are excited to release an update that adds new ways to factor your resource data, and share those views with other users in your organization!

Factoring the Data

Being able find and group your resources using different fields and properties is the key to gaining the insights needed to understand the status of your infrastructure and determine any future projects needed. The new Resources view provides several updated tools for doing this factoring.

Groups - Resources can be grouped into logical categories, including nested groups. Group resources by properties like stack, modified time, or category to explore your infrastructure from different angles. Relevant aggregations are included for each grouping to help you understand the information at a glance.
Filters - Columns provide type-specific filters to narrow your search. Filters work in conjunction with the free-form search bar, giving you the control to build focused views for different aspects of your infrastructure.
Sorting - Each column supports sorting, and multi-sort support allows multiple columns to be included in the ordering.

Customizing Columns

The updated Resources page enables you to customize the view of your resources by enabling you to control the columns of the table. With the table actions menu you can add and remove columns as well as auto size each of the columns in the table to fit the current content. Like previous versions of the Resources page, this menu also enables you to export the Resources as a CSV file for integration into external tools.

Pinning Favorite Views

Once you have configured the resources view to provide the insights needed, you can now save that view as a pinned view under the Resource tab in the left navigation panel. These pinned views enable the Resources page to act as a dashboard to the most important views and insights into your infrastructure. The views are also defined in the url for the page which means you can freely copy the url and send it to a colleague, or add the URL to a work tracking system to provide context in the task definition.

Overall, the new Resources page provides the tools needed to enable you to gain additional insights and track and manage those insights to ensure your infrastructure is delivering on the goals you have set.

Introducing Pulumi Insights 2.0

Craig Symonds — Wed, 18 Sep 2024 08:57:00 +0000

Note: This post discusses Pulumi Copilot, which Pulumi Neo has replaced. Learn about Neo →

Pulumi Insights 2.0 brings the power of Insights to all of your cloud infrastructure, not just the infrastructure managed by Pulumi IaC. Insights 2.0 also brings an exciting new suite of tools that make it easy to discover your entire infrastructure, assess security and efficiency of it, and bring it under management of IaC for best-in-class infrastructure management practices.

Today we are outlining our vision for Pulumi Insights 2.0, and the features that are part of Insights 2.0 will be released over the coming weeks and months. Get started with Pulumi Insights 2.0.

Since the initial launch of Pulumi Insights, customers have used these tools to gain valuable awareness into their IaC platform resources through the flexibility of Resource Search and the power of Pulumi CrossGuard. Insights 2.0 builds on this previous generation of tools to provide a range of new capabilities:

Bring visibility to your entire infrastructure by enabling you to scan and import all of your resources
Add rich new visual explorers, structured graphs and dashboards for understanding and managing your entire infrastructure
Extends Pulumi CrossGuard to provide direct remediation of discovered policy violations inside the Pulumi Cloud
Integrates Pulumi IaC to make it easy to incrementally bring your infrastructure under management with Pulumi IaC in just a few clicks
Brings Pulumi Copilot to your entire infrastructure for intelligent insight discovery and analysis

Resources 2.0

The updated Resources page provides a customizable experience for grouping, filtering, sorting and visualizing your resources to help you manage scope and discover new insights about your infrastructure.

Grouping: To group by a particular column, drag and drop the column header to the grouping control in the top left of the grid. You can group by multiple columns and can control the order of the grouping by reordering them in the grouping control. Grouping enables you to factor your resources in different ways to help you understand the scope and uncover issues within your infrastructure.

Filtering: Adding filters to each column can be done by selecting the filter icon in the column header. A filter dialog will be displayed based on the type of data present in the column. Adding a column filter will add the specific filter to the Resource Search query enabling you to use the grid as a form of query builder.

Sorting: To sort your resources by a particular column, click once on the column header to sort in ascending order and click a second time to sort in descending order.

Column Selection: To add or remove columns from the grid, select the ‘Choose Columns’ menu item from the column menu selector. This presents a pop up to allow you to add, remove or rearrange the order of columns in the grid.

Column Resize: You can resize the width of a column by clicking and dragging on the column boundary line on the right side of the column header. To automatically resize the column to the width of the widest cell contents, double click on the boundary line.

Copy Contents: You can copy the contents of a cell to the clipboard by right clicking on the cell and selecting Copy. This is particularly useful for resource values you need to use in other contexts like the Name or URN.

Policy Violations

The Policy Violations page provides a comprehensive view of all policy violations across your organization, helping you maintain visibility and control over your infrastructure. See the Policy Violations blog post for more information.

Resource Structure Graph

The new resource structure graph provides a visual representation of the relationships for a selected resource. This provides the additional context needed to understand the structure around the resource and what actions might need to be taken.

Within this view you can navigate the relationships by clicking on the related resources. When a resource is clicked, the Resource Detail view navigates to the selected resource to give you the details needed to understand that context.

Policy violations are indicated on the Resource Structure graph to quickly highlight when an insight has been detected and what related nodes are affected.

Goto Definition

For any resource that is Pulumi IaC managed, the Resource Details page will contain a link to the file and line of code in your source code provider that defines the given resource.

Selecting this link will take you to the file and line making it easy for you to quickly see and edit the IaC code for the given resource.

User Customizable Dashboard

Pulumi Cloud will provide a rich, user customizable dashboard that enables you to define views of any aspect of your infrastructure. This provides a powerful overview of your infrastructure and lets you easily track progress of any project.

The dashboard supports defining multiple pages so you can create separate dashboards for each application, each department, or any configuration that maps to your configuration.

Each dashboard page enables you to add, remove, rearrange and create new cards. Each new card can be customized to show the aggregate results of a resource field or property including related policy violation fields. The card can be configured to use a variety of different chart and graph visualizations that best suit the associated data.

Infrastructure Account Scanning

We are excited to introduce Infrastructure Account Scanning (IAS). IAS fundamentally transforms Pulumi Cloud into an Intelligent Cloud Management platform that brings all of the Pulumi Insights capabilities to your entire infrastructure. With IAS, Pulumi can scan your entire infrastructure, even resources that are not IaC managed. This enables you to leverage all of the new tools like, the Resource Explorer with Resource Structure Graphs, Pulumi CrossGruard with Auto Remediation and the Policy Violations Explorer, and the User Customizable Dashboard to manage all of your cloud resources.

IAS leverages the rich ecosystem of Pulumi Platform Providers to discover and read your resources independently of whether they have been moved to IaC.

With IAS Account management you can quickly configure how Pulumi Cloud is enabled to discover new or changed resources keeping your customized Resources, Policy Violations and Dashboard views up to date with your physical infrastructure.

Auto Remediation

Insights 2.0 provides you the tools needed to understand your infrastructure and uncover issues to ensure you can maintain a secure and efficient cloud platform. In addition to these tools, Pulumi Cloud will also give you the context and tools needed to remediate the issues.

When a policy violation occurs for a given resource and that policy is an Auto Remediation policy, a ‘Remediate’ button will be displayed in the Resource Details page. When selected, the Remediate button will run the remediation and show a diff of the infrastructure changes that will be applied in order to remediate targeted insight. If approved, Pulumi Cloud will apply the changes defined by the diff to your infrastructure using the associated Pulumi Providers.

Any change made through the Remediation flow will be tracked and auditable using the Pulumi Audit tools to give you confidence and tracking of the changes made to your infrastructure. In addition, this Remediation flow will provide a warning if the Resource is IaC managed as this change would cause drift with the underlying IaC code. For IaC managed resources it is recommended that you use the new Goto Definition feature to jump to the IaC code for the resource to apply the necessary remediation in the code.

CLI Resource Query Import

Being able to browse your entire infrastructure and discover new opportunities to move your platform forward enables you to understand and build plans to move your infrastructure forward. However, leveraging Pulumi IaC for managing your resources gives you the best in class tools to ensure your infrastructure is delivering on your strategic goals. Insights 2.0 significantly simplifies the process of migrating your resources to IaC management by making it easy to find the resources needed and create resource queries to define those groups.

The Pulumi cli import command will now support passing a Resource Query as a parameter, simplifying the process of finding, grouping and importing the resources you want. The results of this query will be used to get the resource IDs and types needed to be able to import the resources into your IaC program. The result of the command is the source code needed to construct each of the resources defined by the query.

pulumi import \-q ‘.volumeType:Standard’
...
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const EC2Volumevol0a789ea1874bfac61 = new aws_native.ec2.Volume("EC2Volumevol0a789ea1874bfac61", {
 autoEnableIo: true,
 availabilityZone: "us-west-2b",
 encrypted: false,
 multiAttachEnabled: false,
 size: 8,
 snapshotId: "snap-0d017523dfd31e801",
 tags: [],
 volumeType: "standard",
}, {
 protect: true,
});
...

Visual Resource Import

In addition to the powerful command line tools for simplifying the process of importing your resources into Pulumi IaC, Insights 2.0 will provide an integrated UI workflow for finding and importing resources into IaC. The workflow leverages the rich Insights explorer tools for finding and grouping your resources, then enabling you to automatically create a PR with the generated IaC code for the resource group, all with a click of a button.

Conclusion

Insights 2.0 provides you the set of tools needed to understand the chaos of modern enterprise clouds and to bring that chaos under control. The ability to scan your entire infrastructure enables you to leverage the rich visualization, remediation, and IaC migrations tools for all aspects of your infrastructure and gives you the insights needed to enable you to deliver on your strategic objectives.

Get started with Pulumi Insights 2.0.