Concepts

These pages explain how Discovery, Pulumi Policies, and the Context API work. To set something up, see Guides. To try it end to end, start with Get started.

Discovery

• Discovery: How Discovery scans your cloud accounts and organizes the resources it finds.
  • Cloud accounts: The accounts Discovery scans, how account hierarchies work, and the credentials each one uses.
  • Querying resources: How to search Pulumi-managed and discovered resources in one place.
  • Visual Import: How Visual Import turns discovered resources into Pulumi IaC code.
  • Discovered stacks: How Discovery models CloudFormation, AWS CDK, and ARM deployments as stacks.

Policy as code

• Policy as code: How Pulumi Policies checks IaC-managed and discovered resources, and the enforcement modes.
  • Policies: Resource and stack validation policies, enforcement levels, remediation, and configuration.
  • Policy packs: How policies are packaged, versioned, configured, and run.
  • Policy groups: How policy packs are applied to stacks and cloud accounts in preventative or audit mode.

Context API

• Context API: How graph queries answer dependency, ownership, and change-impact questions about your infrastructure.