Pulumi Blog: Eric Rudder

Pulumi is SOC 2 Certified

Eric Rudder — Thu, 07 Jan 2021 00:00:00 +0000

Pulumi’s Commitment

Pulumi is committed to operational excellence for our customers and one of the ways that we decided to demonstrate this was by completing our SOC 2 Type 2 Audit. After a lot of hard work these past few months, we are pleased to announce that Pulumi is now SOC 2 compliant!

The audit involved the entire Pulumi team. We needed to have proper controls in place across the organization and ensure that our key processes were documented and exercised. In addition, we reviewed our vendor selection process and made sure that all of our key partners were compliant with SOC as well. Our team used the overall process as an opportunity to review our overall governance and risk management procedures. Interestingly, the change in our work environment caused by Covid-19 actually helped us stress some of our process and policies, since we were forced to work remotely, much as if we had any type of interesting “event” at our headquarters.

Of course, we spent a large amount of time reviewing the security of our service. Security is already baked into our culture, with processes around training, code reviews, and the like, however, there’s no doubt this process helped us “up our game.” The policies that we already had in place (encryption of data at rest and in transit, auditing, logging, secure backup, etc.) gave us a strong foundation, however, as we reviewed key areas we found several areas for simplification and improvement.

The SOC 2 Journey

As an organization, SOC 2 requires us to promise that we abide by well-documented policies, procedures, and operational controls and to prove it to an accredited firm that reviews our operational discipline for several months. We were fortunate to find a great partner that was a superb resource as we initiated our first report. The auditors had to review a tremendous amount of data, much of it over shared screens in Zoom. Their experience also helped us think about how we can continuously improve in several key areas.

We decided to use a third party tool to help with the process. In retrospect, this was one of the best decisions we made, and picking a tool that fits with your organization is hugely important. Our engineering culture definitely believes in “get clean, stay clean” and a great tool that automates many of the routine checks is indispensable. In addition, having a central dashboard that lets you know “where you are” in your journey is incredibly valuable and can really help motivate the team. The tool also helped us find a number of enhancements that go above and beyond what SOC strictly requires. For example, we created a network diagram, which, while not strictly a SOC requirement, was a suggestion from the tool. Finally, all team members now have agent software on their laptops that helps maintain key standards that we’ve chosen for our security profile.

In addition, much of the operational excellence for SOC certification requires great DevOps discipline. Here, we had a huge insider’s advantage! We were able to use Pulumi itself to automate key procedures required by the process.

Going Forward

While we already had the key cultural attributes required for operational excellence, our SOC 2 journey was a great way to reinforce the importance of this to the entire team. Security, privacy, and resiliency are everyone’s job!

We’ve added additional training, and some templates and processes that will help us do an even better job in the future.

We have a leadership team that reviews key areas of the SOC profile quarterly, with each quarter having a special focus. For example, one quarter may focus on security, while the next may zero-in on disaster recovery. The meetings are documented and any work items identified go onto our team’s task list.

Most importantly, the journey isn’t over! Pulumi will continue to evolve. The SOC standards will continue to evolve. Industry tools and best practices will continue to evolve. We’ve come a long way since we started our SOC 2 journey and we’re committed to continuing to improve our operational excellence every day.

If you’re interested in learning more about how we approach security at Pulumi or have questions about our SOC 2 process, please reach out. We’re happy to share what we’ve learned along the way.

Infrastructure as Code Resource Naming

Eric Rudder — Tue, 10 Sep 2019 00:00:00 +0000

We’ve introduced a new way to customize or disable auto-naming with a configuration option. See Auto-naming Configuration for more information about all the ways you can customize auto-naming.

“What’s in a name? That which we call a rose by any other name would smell as sweet.” William Shakespeare’s oft repeated quote was used to help Juliet explain that a “Montague” is worthy of love. Juliet may have underestimated the importance of a name, however, since things didn’t work out so well for everyone in Verona! Many customers have questions about “names” in Pulumi – and in an effort to make sure that things work out better for them than they did for Romeo, here’s a quick note on naming!

Usually, folks ask, “Why are resources created with funny characters at the end?” And more often than not, their next question is, “Can I use my own names instead?” Fear not! There are good reasons for Pulumi’s naming strategy and ultimately, you have complete control over naming.

Logical vs. Physical Names

Cloud resources typically have both a logical and a physical name, and given this level of abstraction, these names may not always match. More often than not, the physical resource names in Pulumi are “auto-named,” and it’s this auto-naming that appends a few random characters to end of the physical name.

Say that you have IAM role with a logical name of role-friar. Pulumi will choose a physical name for this that looks something more like: role-friar-3742fb, for several good reasons.

First and foremost, Pulumi Stacks are often instanced multiple times. Choosing a random suffix ensures that there are no naming collisions, and teams can stand up projects multiple times, for example, in a rapid create/test development cycle, or even in production, where you may want to stand up your Pulumi Stack in different regions for availability and scale.

Second, physical names are used in important ways when we update our resources. Sometimes, updates can happen in place, however, often updates require a resource to be replaced. Auto-naming helps ensure that Pulumi can stand up the new resource first and update any references to the new name, before deleting the old resource. This allows for zero-downtime updates, which is something we usually want to take advantage of. Indeed, customers often start to override auto-naming, only to realize that it’s much easier to let the platform manage this for you, and then revert back to auto-naming.

Controlled Naming

We’ve introduced a new way to customize or disable auto-naming with a configuration option. See Auto-naming Configuration for more information about all the ways you can customize auto-naming.

There are times, however, where precise naming is important. You might need to match an existing environment, or want to explicitly control other behavior. If you know for certain that you want to control the naming yourself, you can indeed override auto-naming. Simply specify the physical name on your resource during creation. Most resources expose a name property that may be specified in the argument object to the constructor:

const role = aws.iam.Role("role-friar", {
 name: "friar-lawrence",
});

Sometimes, the “name” property isn’t called name – just to keep you on your toes. For example, the AWS S3 Bucket requires setting the bucket property. So, you may have to scan the documentation for the specific resource you are creating to help you with your construction. There are also a few resources (like aws.kms.Key) that don’t have physical names and instead use other auto-generated IDs to uniquely identify them.

A Happy Ending

Eventually the Montagues and Capulets made peace. I’m sure you too will find peace with a naming strategy that works for you, whether it’s fully automatic, fully manual or a combination of both.